Configuring Predefined Signatures - Fortinet FortiGate FortiGate-500 Administration Manual

Signature
298
Table 24: Actions to select for each predefined signature
Reset Client
Reset Server
Drop Session
Clear Session
Pass Session

Configuring predefined signatures

To enable or disable predefined signature groups
1 Go to IPS > Signature > Predefined.
2 Select the Configure icon next to the predefined signature group that you want to
enable or disable.
Figure 142:Enabling or disabling a predefined signature group
3 Select the enable box to enable the predefined signature group or clear the enable
box to disable the predefined signature group.
4 Select OK.
To configure predefined signature settings
1 Go to IPS > Signature > Predefined.
2 Select the blue triangle next to a signature group name to display the members of that
group.
3 Select the Configure icon for the signature you want to configure.
Figure 143:Configuring predefined IPS signatures
The FortiGate unit drops the packet that triggered the signature, sends a
reset to the client, and removes the session from the FortiGate session
table. Used for TCP connections only. If you set this action for non-TCP
connection based attacks, the action will behave as Clear Session. If the
Reset Client action is triggered before the TCP connection is fully
established it acts as Clear Session.
The FortiGate unit drops the packet that triggered the signature, sends a
reset to the server, and removes the session from the FortiGate session
table. Used for TCP connections only. If you set this action for non-TCP
connection based attacks, the action will behave as Clear Session. If the
Reset Server action is triggered before the TCP connection is fully
established it acts as Clear Session.
The FortiGate unit drops the packet that triggered the signature and drops
any other packets in the same session.
The FortiGate unit drops the packet that triggered the signature, removes
the session from the FortiGate session table, and does not send a reset.
The FortiGate unit lets the packet that triggered the signature and all other
packets in the session pass through the firewall.
01-28006-0007-20041105
IPS
Fortinet Inc.