FortiOS 4.0: IDS/IPS

FortiGate IPS

The FortiGate IPS detects intrusions by using attack signatures for known intrusion methods, and detects anomalies in network traffic to identify new or unknown intrusions. Not only can the IPS detect and log attacks, but users can choose actions to take on the session when an attack is detected.

FortiOS IPS offers a wide range of tools so that you can monitor and block malicious activity. These tools are predefined signatures, out-of-band mode (or one-arm IPS mode), protocol decoders, custom signature entries, packet logging, and IPS sensors.

FortiGate IDS (one-arm IPS mode)

• FortiOS IPS is operating as an Intrusion Detection System (IDS) detecting attacks and reporting them, but not taking any action against them.

• The unit does not process network traffic. Instead a FortiGate interface operates in sniffer mode and is connected to a spanning or mirrored port of a switch that processes all of the traffic to be analyzed.

FortiGate IPS General Overview

• The FortiGate IPS is composed of several tools that can be used to monitor and block malicious activity:

• Predefined signatures• Custom Signatures• Protocol Decoders

FortiGate IPS General Overview

Predefined Signatures:• Predefined signatures are provided to

FortiOS through the FortiGuard network.

• These signatures are used to detect attacks and FortiOS supports more than 4000 attack signatures, that can detect everything, from attacks against unpatched operating system vulnerabilities to invalid checksums in UDP packets.

FortiGate IPS General Overview

Custom Signatures:

Custom signatures provide the ability to customize the FortiGate IPS Engine to meet diverse network environments.

Custom signatures can be developed to protect specialized environments or custom applications.

FortiGate IPS General Overview

Protocol decoders:

• Before examining network traffic, the IPS engine uses protocol decoders to identify each protocol appearing in the traffic.

• Attacks are protocol-specific, so your FortiGate unit conserves resources by looking for attacks only in the protocols used to transmit them. Ex: the FortiGate will only examine HTTP traffic for the presence of a signature describing an HTTP attack.

FortiGate IPS General Overview

Protocol decoders:

FortiGate IPS Engine

• Once the protocol decoders separate the network traffic by protocol, the IPS engine examines the network traffic for the attack signatures.

IPS sensors• The IPS engine does not examine network

traffic for all signatures, however. You must first create an IPS sensor and specify which signatures are included. Add signatures to sensors individually using signature entries, or in groups using IPS filters.

FortiGate IPS filters

• A filter is a collection of signature attributes that you specify. The signatures that have all of the attributes specified in a filter are included in the IPS filter.

• Ex: if your FortiGate unit protects a Linux server running the Apache web server software, you could create a new filter to protect it. By setting OS to Linux, and Application to Apache, the filter will include only the signatures that apply to both Linux and Apache. If you wanted to scan for all the Linux signatures and all the Apache signatures, you would create two filters, one for each.

FortiGate IPS Tuning

Network Design Considerations:

• Trusted vs Non-Trusted Networks• Number of Protected Segments• Physical Media (Copper or Fiber)• Operating Systems / Databases / Applications• Traffic Distribution

Reduce the number of signatures that will be used to analyze traffic that will never represent an issue. i.e. Analyze traffic from a network segment that has only Windows Server with Signatures for Linux.

FortiGate IPS Tuning

Network Design Considerations:

Trusted vs Non-Trusted Networks• Apply IPS Sensors to networks with non-encrypted information.• Never apply IPS Sensors that you are not willing to monitor or tune.

Try to enforce IPS Inspection to important traffic (Consider FW vs IPS Performance)

FortiGate IPS Tuning

Network Design Considerations:

Number of Protected Segments

• Try to define IPS Sensors for each network segment you are willing to inspect.

• As every network segment is different, each IPS Sensor should be different.

FortiGate IPS Tuning

Network Design Considerations:

Operating Systems/Applications/Databases

• Tune IPS Sensor according to the operating system being protected.

FortiGate IPS Tuning

Network Design Considerations:

Operating Systems/Applications/Databases

• Tune IPS Sensor according to the Application/Database being protected.

FortiGuard Intrusion Prevention Service

• Provides to customers with the latest defenses against stealthy network-level threats. It uses a customizable database of more than 4000 known threats to enable FortiGate and FortiWiFi appliances.

• It also provides behavior-based heuristics, enabling the system to recognize threats for which no signature has yet been developed.

General Configuration Steps

1. Create an IPS sensor.

2. Add filters and/or predefined signatures and custom signatures to the sensor.

3. Select a security policy or create a new one.

4. In the security policy, turn on IPS, and choose the IPS sensor from the list.

For More Information

• http://kb.fortinet.com (Knowledge base)

• http://docs.fortinet.com/fos50hlp/50/index.html (Handbook)

• http://docs.fortinet.com/cb/fortigate-cookbook.pdf (Cookbook)

• http://www.fortiguard.com/