Fortinet Network Device IPS User Manual
USER GUIDE
FortiGate
IPS User Guide
Version 3.0 MR7
www.fortinet.com
FortiGate IPS User Guide
Version 3.0 MR7
September 16, 2008
01-30007-0080-20080916
© Copyright 2008 Fortinet, Inc. All rights reserved. No part of this
publication including text, examples, diagrams or illustrations may be
reproduced, transmitted, or translated in any form or by any means,
electronic, mechanical, manual, optical or otherwise, for any purpose,
without prior written permission of Fortinet, Inc.
Trademarks
Dynamic Threat Prevention System (DTPS), APSecure, FortiASIC,
FortiBIOS, FortiBridge, FortiClient, FortiGate, FortiGate Unified Threat
Management System, FortiGuard, FortiGuard-Antispam, FortiGuardAntivirus, FortiGuard-Intrusion, FortiGuard-Web, FortiLog, FortiAnalyzer,
FortiManager, Fortinet, FortiOS, FortiPartner, FortiProtect, FortiReporter,
FortiResponse, FortiShield, FortiVoIP, and FortiWiFi are trademarks of
Fortinet, Inc. in the United States and/or other countries. The names of
actual companies and products mentioned herein may be the trademarks
of their respective owners.
Contents
Contents
Introduction ........................................................................................ 5
The FortiGate IPS............................................................................................... 5
About this document......................................................................................... 6
Document conventions.................................................................................. 6
Fortinet documentation .................................................................................... 6
Fortinet Knowledge Center .......................................................................... 8
Comments on Fortinet technical documentation .......................................... 8
Customer service and technical support ........................................................ 8
IPS overview and general configuration.......................................... 9
The FortiGate IPS............................................................................................... 9
IPS settings and controls .............................................................................. 9
When to use IPS ......................................................................................... 10
Network performance...................................................................................... 10
Default signature and anomaly settings ...................................................... 10
Default fail open setting............................................................................... 10
Controlling sessions .................................................................................... 11
Setting the buffer size ................................................................................. 11
Monitoring the network and dealing with attacks ........................................ 11
Configuring logging and alert email............................................................. 11
Attack log messages ................................................................................... 12
The FortiGuard Center ................................................................................ 13
Using IPS sensors in a protection profile ..................................................... 14
Creating a protection profile that uses IPS sensors .................................... 14
Adding protection profiles to firewall policies .............................................. 14
Adding protection profiles to user groups.................................................... 15
Predefined signatures ..................................................................... 17
IPS predefined signatures .............................................................................. 17
Viewing the predefined signature list............................................................ 17
Fine tuning IPS predefined signatures for enhanced system performance 18
Custom signatures........................................................................... 21
IPS custom signatures.................................................................................... 21
Viewing the custom signature list.................................................................. 21
Custom signature configuration .................................................................... 22
Adding custom signatures using the web-based manager ......................... 22
Adding custom signatures using the CLI..................................................... 22
FortiGate IPS User Guide Version 3.0 MR7
01-30007-0080-20080916 3
Creating custom signatures........................................................................... 23
Custom signature fields .............................................................................. 23
Custom signature syntax ............................................................................ 24
Example custom signatures........................................................................ 33
Protocol decoders ........................................................................... 37
Protocol decoders........................................................................................... 37
Upgrading the IPS protocol decoder list....................................................... 37
Viewing the protocol decoder list.................................................................. 38
IPS sensors ...................................................................................... 39
Viewing the IPS sensor list............................................................................. 39
Adding an IPS sensor ................................................................................. 40
Configuring IPS sensors................................................................................. 40
Configuring filters ........................................................................................ 42
Configuring pre-defined and custom overrides ........................................... 43
DoS sensors..................................................................................... 45
Viewing the DoS sensor list ........................................................................... 46
Configuring DoS sensors ............................................................................... 46
Understanding the anomalies ........................................................................ 48
SYN flood attacks ............................................................................ 51
What is a SYN flood attack? ........................................................................... 51
How SYN floods work ..................................................................................... 51
The FortiGate IPS Response to SYN flood attacks ...................................... 52
What is SYN threshold?.............................................................................. 52
What is SYN proxy? ................................................................................... 52
How IPS works to prevent SYN floods........................................................ 52
Configuring SYN flood protection ................................................................. 54
Suggested settings for different network conditions .................................. 54
ICMP sweep attacks......................................................................... 55
What is an ICMP sweep? ................................................................................ 55
How ICMP sweep attacks work ...................................................................... 55
The FortiGate IPS response to ICMP sweep attacks.................................... 55
Predefined ICMP signatures ....................................................................... 56
ICMP sweep anomalies .............................................................................. 57
Configuring ICMP sweep protection.............................................................. 58
Suggested settings for different network conditions .................................. 58
Index.................................................................................................. 59
FortiGate IPS User Guide Version 3.0 MR7
4 01-30007-0080-20080916
Introduction The FortiGate IPS
Introduction
This section introduces you to the FortiGate Intrusion Prevention System (IPS)
and the following topics:
• The FortiGate IPS
• About this document
• Fortinet documentation
• Customer service and technical support
The FortiGate IPS
Spam and viruses are not the only threats facing enterprises and small
businesses. Sophisticated, automated attack tools are prevalent on the Internet
today, making intrusion detection and prevention vital to securing corporate
networks. An attack or intrusion can be launched to steal confidential information,
force a costly web site crash, or use network resources to launch other attacks.
The FortiGate IPS detects intrusions by using attack signatures for known
intrusion methods, and detects anomalies in network traffic to identify new or
unknown intrusions. Not only can the IPS detect and log attacks, but users can
choose actions to take on the session when an attack is detected. This guide
describes how to configure and use the IPS and the IPS response to some
common attacks.
This guide describes:
• IPS overview and general configuration
• Predefined signatures
• Custom signatures
• Protocol decoders
• IPS sensors
• DoS sensors
• SYN flood attacks
• ICMP sweep attacks
FortiGate IPS User Guide Version 3.0 MR7
01-30007-0080-20080916 5
About this document Introduction
!
About this document
Document conventions
The following document conventions are used in this guide:
• In the examples, private IP addresses are used for both private and public IP
addresses.
• Notes and Cautions are used to provide important information:
Note: Highlights useful additional information.
Caution: Warns you about commands or procedures that could have unexpected or
undesirable results including loss of data or damage to equipment.
Typographic conventions
FortiGate documentation uses the following typographical conventions:
Convention Example
Keyboard input In the Gateway Name field, type a name for the remote VPN
Code examples F-SBID (--protocol tcp; --flow
CLI command syntax config firewall policy
Document names FortiGate Administration Guide
File content <HTML><HEAD><TITLE>Firewall
Menu commands Go to VPN > IPSEC > Phase 1 and select Create New.
Program output Welcome!
Variables
Fortinet documentation
peer or client (for example, Central_Office_1).
established; --content "content here";
--no_case)
edit id_integer
set http_retry_count <retry_integer>
set natip <address_ipv4mask>
end
Authentication</TITLE></HEAD>
<BODY><H4>You must authenticate to use this
service.</H4>
<address_ipv4>
The most up-to-date publications and previous releases of Fortinet™ product
documentation are available from the Fortinet Technical Documentation web site
at http://docs.forticare.com.
The following FortiGate product documentation is available:
• FortiGate QuickStart Guide
Provides basic information about connecting and installing a FortiGate unit.
FortiGate IPS User Guide Version 3.0 MR7
6 01-30007-0080-20080916
Introduction Fortinet documentation
• FortiGate Installation Guide
Describes how to install a FortiGate unit. Includes a hardware reference,
default configuration information, installation procedures, connection
procedures, and basic configuration procedures. Choose the guide for your
product model number.
• FortiGate Administration Guide
Provides basic information about how to configure a FortiGate unit, including
how to define FortiGate protection profiles and firewall policies; how to apply
intrusion prevention, antivirus protection, web content filtering, and spam
filtering; and how to configure a VPN.
• FortiGate online help
Provides a context-sensitive and searchable version of the Administration
Guide in HTML format. You can access online help from the web-based
manager as you work.
• FortiGate CLI Reference
Describes how to use the FortiGate CLI and contains a reference to all
FortiGate CLI commands.
• FortiGate Log Message Reference
Describes the structure of FortiGate log messages and provides information
about the log messages that are generated by FortiGate units.
• FortiGate High Availability User Guide
Contains in-depth information about the FortiGate high availability feature and
the FortiGate clustering protocol.
• FortiGate IPS User Guide
Describes how to configure the FortiGate Intrusion Prevention System settings
and how the FortiGate IPS deals with some common attacks.
• FortiGate IPSec VPN User Guide
Provides step-by-step instructions for configuring IPSec VPNs using the webbased manager.
• FortiGate SSL VPN User Guide
Compares FortiGate IPSec VPN and FortiGate SSL VPN technology, and
describes how to configure web-only mode and tunnel-mode SSL VPN access
for remote users through the web-based manager.
• FortiGate PPTP VPN User Guide
Explains how to configure a PPTP VPN using the web-based manager.
• FortiGate Certificate Management Guide
Contains procedures for managing digital certificates including generating
certificate requests, installing signed certificates, importing CA root certificates
and certificate revocation lists, and backing up and restoring installed
certificates and private keys.
• FortiGate VLANs and VDOMs User Guide
Describes how to configure VLANs and VDOMS in both NAT/Route and
Transparent mode. Includes detailed examples.
FortiGate IPS User Guide Version 3.0 MR7
01-30007-0080-20080916 7
Customer service and technical support Introduction
Fortinet Knowledge Center
Additional Fortinet technical documentation is available from the Fortinet
Knowledge Center. The knowledge center contains troubleshooting and how-to
articles, FAQs, technical notes, and more. Visit the Fortinet Knowledge Center at
http://kc.forticare.com.
Comments on Fortinet technical documentation
Please send information about any errors or omissions in this document, or any
Fortinet technical documentation, to techdoc@fortinet.com.
Customer service and technical support
Fortinet Technical Support provides services designed to make sure that your
Fortinet systems install quickly, configure easily, and operate reliably in your
network.
Please visit the Fortinet Technical Support web site at http://support.fortinet.com
to learn about the technical support services that Fortinet provides.
FortiGate IPS User Guide Version 3.0 MR7
8 01-30007-0080-20080916
IPS overview and general configuration The FortiGate IPS
IPS overview and general configuration
This section contains the following topics:
• The FortiGate IPS
• Network performance
• Monitoring the network and dealing with attacks
• Using IPS sensors in a protection profile
The FortiGate IPS
An IPS is an Intrusion Prevention System for networks. While early systems
focused on intrusion detection, the continuing rapid growth of the Internet, and the
potential for the theft of sensitive data, has resulted in the need for not only
detection, but prevention.
The FortiGate IPS detects intrusions by using attack signatures for known
intrusion methods, and detects anomalies in network traffic to identify new or
unknown intrusions. Not only can the IPS detect and log attacks, but users can
choose actions to take on the session when an attack is detected. This guide
describes how to configure and use the IPS and the IPS response to some
common attacks.
Both the IPS predefined signatures and the IPS engine are upgraded through the
FortiGuard Distribution Network (FDN). These upgrades provide the latest
protection against IM/P2P and other threats. Firmware upgrades will update
anomaly options. The FortiGate IPS default settings implement the recommended
settings for all signatures and anomalies. Signature settings and some anomaly
thresholds are pre-set to work best with the normal traffic on the protected
networks. You can create custom signatures for the FortiGate IPS in diverse
network environments.
Administrators are notified of intrusions and possible intrusions through log
messages and alert email.
Packet logging provides administrators with the ability to analyze packets for
forensics and false positive detection.
IPS settings and controls
Configure the Intrusion Protection system using either the web-based manager or
the CLI, then select IPS sensors in individual firewall protection profiles.
Note: If virtual domains are enabled on the FortiGate unit, the Intrusion Protection settings
are configured separately in each VDOM. All sensors and custom signatures will appear
only in the VDOM in which they were created.
FortiGate IPS User Guide Version 3.0 MR7
01-30007-0080-20080916 9
Network performance IPS overview and general configuration
To create an IPS sensor, go to Intrusion Protection > IPS Sensor. See “IPS
sensors” on page 39 for details. To access the protection profile IPS sensor
selection, go to Firewall > Protection Profile, select Edit or Create New, and
select IPS.
To create a DoS Sensor, go to Intrusion Protection > DoS Sensor. See “DoS
sensors” on page 45 for details.
When to use IPS
IPS is best for large networks or for networks protecting highly sensitive
information. Using IPS effectively requires monitoring and analysis of the attack
logs to determine the nature and threat level of an attack. An administrator can
adjust the threshold levels to ensure a balance between performance and
intrusion prevention. Small businesses and home offices without network
administrators may be overrun with attack log messages and not have the
networking background required to configure the thresholds and other IPS
settings. In addition, the other protection features in the FortiGate unit, such as
antivirus (including grayware), spam filters, and web filters offer excellent
protection for all networks.
Network performance
The FortiGate IPS is extremely accurate and reliable as an in-line network device.
Independent testing shows that the FortiGate IPS successfully detects and blocks
attacks even under high traffic loads, while keeping latency within expected limits.
This section describes:
• Default signature and anomaly settings
• Default fail open setting
• Controlling sessions
• Setting the buffer size
Default signature and anomaly settings
You can use IPS sensors to apply appropriate IPS signatures to different
protection profiles, then different firewall policies.
Default fail open setting
If for any reason the IPS should cease to function, it will fail open by default. This
means that crucial network traffic will not be blocked and the Firewall will continue
to operate while the problem is resolved.
Change the default fail open setting using the CLI:
config ips global
end
set fail-open [enable | disable]
FortiGate IPS User Guide Version 3.0 MR7
10 01-30007-0080-20080916
IPS overview and general configuration Monitoring the network and dealing with attacks
Controlling sessions
Use this command to ignore sessions after a set amount of traffic has passed.
The default is 204800 bytes.
config ips global
set ignore-session-bytes <byte_integer>
end
Setting the buffer size
Set the size of the IPS buffer. The size of the buffer is model-dependent.
config ips global
set socket-size <ips_buffer_size>
end
Monitoring the network and dealing with attacks
After configuring IPS and enabling it in protection profiles, it is time to set up
tracking and notification of attacks. Enabling logging and alert email to maintain
user awareness of attacks on the network.
The next step is dealing with attacks if and when they occur. The FortiGuard
Center at http://www.fortinet.com/FortiGuardCenter/ provides a comprehensive
Attack Encyclopedia to help decide what actions to take to further protect the
network.
This section describes:
• Configuring logging and alert email
• Attack log messages
• The FortiGuard Center
Configuring logging and alert email
Whenever the IPS detects or prevents an attack, it generates an attack log
message that can be recorded or sent as an alert email.
The FortiGate unit categorizes attack log messages by signature or anomaly and
includes the attack name in the log message. Enable logging and alert email for
attack signatures and attack anomalies.
Note: Attack and intrusion attempts occur frequently on networks connected to the Internet.
Reduce the number of log messages and alert email by disabling signatures for attacks that the
system is not vulnerable to (for example, web attacks when not running a web server).
To configure logging and alert email for IPS events using the web-based
manager
1 Go to Log&Report > Log Config > Log Setting.
2 Select and configure the settings for any logging locations to use.
3 Select Apply.
4 Go to Log&Report > Log Config > Alert Email.
FortiGate IPS User Guide Version 3.0 MR7
01-30007-0080-20080916 11
Monitoring the network and dealing with attacks IPS overview and general configuration
5 Select and configure authentication if required and enter the email addresses that
will receive the alert email.
6 Enter the time interval to wait before sending log messages for each logging
severity level.
Note: If more than one log message is collected before an interval is reached, the messages
are combined and sent out as one alert email.
7 Select Apply.
To access log messages from memory or on the local disk
View and download log messages stored in memory or on the FortiGate local disk
from the web-based manager. Go to Log&Report > Log Access and select the
log type to view.
See the FortiGate Administration Guide and the FortiGate Log Message
Reference Guide for more logging procedures.
Attack log messages
Signature
The following log message is generated when an attack signature is found:
Message ID: 70000
Severity: Alert
Message: attack_id=<value_attack_id> src=<ip_address> dst=<ip_address>
Example: 2004-07-07 16:21:18 log_id=0420073000 type=ips subtype=signature
Meaning: Attack signature message providing the source and destination
Action: Get more information about the attack and the steps to take from the
src_port=<port_num> dst_port=<port_num>
interface=<interface_name> src_int=<interface_name>
dst_int=<interface_name> status={clear_session | detected | dropped |
reset} proto=<protocol_num> service=<network_service>
msg="<string><[url]>"
pri=alert attack_id=101318674 src=8.8.120.254 dst=11.1.1.254
src_port=2217 dst_port=25 interface=internal src_int=n/a dst_int=n/a
status=reset proto=6 service=smtp msg="signature: Dagger.1.4.0.Drives
[Reference: http://www.fortinet.com/ids/ID101318674]"
addressing information and the attack name.
Fortinet Attack Encyclopedia in the FortiGuard Center. Copy and paste
the URL from the log message into your browser to go directly to the
signature description in the Attack Encyclopedia.
FortiGate IPS User Guide Version 3.0 MR7
12 01-30007-0080-20080916
IPS overview and general configuration Monitoring the network and dealing with attacks
Anomaly
The following log message is generated when an attack anomaly is detected:
Message ID: 73001
Severity: Alert
Message: attack_id=<value_attack_id> src=<ip_address> dst=<ip_address>
Example: 2004-04-07 13:58:53 log_id=0420073001 type=ips subtype=anomaly
Meaning: Attack anomaly message providing the source and destination
Action: Get more information about the attack and the steps to take from the
src_port=<port_num> dst_port=<port_num>
interface=<interface_name> src_int=<interface_name>
dst_int=<interface_name> status={clear_session | detected | dropped |
reset} proto=<protocol_num> service=<network_service>
msg="<string><[url]>"
pri=alert attack_id=100663396 src=8.8.120.254 dst=11.1.1.254
src_port=2217 dst_port=25 interface=internal src_int=n/a dst_int=n/a
status=reset proto=6 service=smtp msg="anomaly: syn_flood, 100 >
threshold 10.[Reference: http://www.fortinet.com/ids/ID100663396]"
addressing information and the attack name.
Fortinet Attack Encyclopedia in the FortiGuard Center. Copy and paste
the URL from the log message into your browser to go directly to the
signature description in the Attack Encyclopedia.
The FortiGuard Center
The FortiGuard Center combines the knowledge base of the Fortinet technical
team into an easily searchable database. FortiGuard Center includes both virus
and attack information. Go to http://www.fortinet.com/FortiGuardCenter/.
Search for attacks in the FortiGuard Attack Encyclopedia by any of the criteria
shown in Figure 1.
Figure 1: Searching the FortiGuard Attack Encyclopedia
Type in the name or ID of the attack, or copy and paste the URL from the log
message or alert email into a browser.
FortiGate IPS User Guide Version 3.0 MR7
01-30007-0080-20080916 13
Using IPS sensors in a protection profile IPS overview and general configuration
Using IPS sensors in a protection profile
IPS can be combined with other FortiGate features – antivirus, spam filtering, web
filtering, and web category filtering – to create protection profiles. Protection
profiles are then added to individual user groups and then to firewall policies, or
added directly to firewall policies.
This section describes:
• Creating a protection profile that uses IPS sensors
• Adding protection profiles to firewall policies
• Adding protection profiles to user groups
Creating a protection profile that uses IPS sensors
To create a protection profile using the web-based manager
1 Go to Firewall > Protection Profile.
2 Select Create New.
Figure 2: New Protection Profile
3 Enter a name for the protection profile.
4 Expand the IPS option list.
5 Select an IPS sensor from the dropdown list. For information about IPS sensors,
see “IPS sensors” on page 39.
6 Configure any other required protection profile options.
7 Select OK.
The protection profile can now be added to any firewall policies that require it. The
protection profile can also be added to user groups and these user groups can be
used to apply authentication to firewall policies.
Adding protection profiles to firewall policies
Adding a protection profile to a firewall policy applies the profile settings, including
IPS, to traffic matching that policy.
FortiGate IPS User Guide Version 3.0 MR7
14 01-30007-0080-20080916
IPS overview and general configuration Using IPS sensors in a protection profile
Adding protection profiles to user groups
When creating a user group, select a protection profile that applies to that group.
Then, when configuring a firewall policy that includes user authentication, select
one or more user groups to authenticate. Each user group selected for
authentication in the firewall policy can have a different protection profile, and
therefore different IPS settings, applied to it.
FortiGate IPS User Guide Version 3.0 MR7
01-30007-0080-20080916 15
Using IPS sensors in a protection profile IPS overview and general configuration
FortiGate IPS User Guide Version 3.0 MR7
16 01-30007-0080-20080916
Predefined signatures IPS predefined signatures
Predefined signatures
This section describes:
• IPS predefined signatures
• Viewing the predefined signature list
IPS predefined signatures
Predefined signatures are arranged in alphabetical order. By default, some
signatures are disabled to prevent interference with common traffic, but logging is
enabled for all signatures.
Use the IPS sensor to customize the predefined signatures and apply appropriate
sensors to different protection profiles. For details, see “IPS sensors” on page 39.
Note: By allowing your IPS signature settings to run on default, you may be slowing down
the overall performance of the FortiGate unit. By fine tuning the predefined signature and
logging setting, you can ensure maximum performance as well as maximum protection.
See “Fine tuning IPS predefined signatures for enhanced system performance” on
page 18.
Viewing the predefined signature list
The predefined signature list displays the characteristics of each signature. Use
these characteristics to define which signatures are included in your IPS sensors.
The signature list also displays the default action, the default logging status, and
whether the signature is enabled by default.
Note: If virtual domains are enabled on the FortiGate unit, the Intrusion Protection settings
are configured separately in each VDOM. All sensors and custom signatures will appear
only in the VDOM in which they were created.
To view the predefined signature list, go to Intrusion Protection > Signature >
Predefined. You can also use filters to display the signatures you want to view.
Figure 3: Predefined signature list
FortiGate IPS User Guide Version 3.0 MR7
01-30007-0080-20080916 17
Viewing the predefined signature list Predefined signatures
By default, the signatures are sorted by name. To sort the table by another
column, select the required column header name.
Column
Settings
Clear All Filters If you have applied filtering to the predefined signature list display, select
Name The name of the signature, linked to the FortiGuard Center web page
Severity The severity rating of the signature. The severity levels, from lowest to
Tar get The target of the signature. Servers, clients, or both.
Protocols The protocol the signature applies to.
OS The operating system the signature applies to.
Applications The applications the signature applies to.
Enable The default status of the signature. A green circle indicates the signature
Action The default action for the signature. The available actions are pass and
ID A unique numeric identifier for the signature.
Logging The default logging behavior of the signature. A green circle indicates
Group A functional group that is assigned to the signature. This group is only
Packet Log The default packet log status of the signature. A green circle indicates
Revision The revision level of the signature. If the signature is updated, the
Select to customize the signature information displayed in the table. You
can also readjust the column order.
this option to clear all filters and display all the signatures.
about the signature.
highest, are Information, Low, Medium, High, and Critical.
is enabled. A gray circle indicates the signature is not enabled.
drop.
• Pass allows the traffic to continue without any modification. If you
want to determine what effect IPS protection would have on your
network traffic, you can enable the required signatures, set the action
to pass, and enable logging. Traffic will not be interrupted, but you
will be able to examine in detail which signatures were detected.
• Drop prevents the traffic with detected signatures from reaching its
destination.
If logging is enabled, the action appears in the status field of the log
message generated by the signature.
logging is enabled. A gray circle indicates logging is disabled.
for reference and cannot be used to define filters.
packet log is enabled. A gray circle indicates packet log is disabled.
revision number will be incremented.
Fine tuning IPS predefined signatures for enhanced system performance
In FortiOS the FortiGate unit will have most of the predefined signatures enabled
and will log all of them by default. To meet your specific network requirements, you
need to fine tune the signature settings.
By fine tuning the signatures and log settings you can provide the best protection
available but also free up valuable FortiGate resources. Fine tuning enables you
to turn off features that you are not using. By turning off signatures and logs that
you do not use, you allow the FortiGate unit to perform tasks faster thus improving
overall system performance.
Not all systems require you to scan for all signatures of the IPS suite all the time.
By configuring the FortiGate unit to not monitor for these signatures, you will
maintain a high level of security and increase overall performance.
FortiGate IPS User Guide Version 3.0 MR7
18 01-30007-0080-20080916
Predefined signatures Viewing the predefined signature list
You should also review exactly how you use the information provided by the
logging feature. If you find that you do not review the information, it is best to turn
off IPS logging. Logging is best used to provide actionable intelligence.
To create an IPS sensor
1 Go to Intrusion Protection > IPS Sensor.
2 Create a sensor and add IPS filters to it.
FortiGate IPS User Guide Version 3.0 MR7
01-30007-0080-20080916 19
Loading...