FortiGate: enable IPS protection on a firewall policy

Effectively leveraging Intrusion Prevention System (IPS) capabilities on FortiGate firewalls is crucial for detecting and blocking network-based threats.…

Effectively leveraging Intrusion Prevention System (IPS) capabilities on FortiGate firewalls is crucial for detecting and blocking network-based threats. While FortiGate devices include a robust IPS engine, its protective functions are only active when explicitly enabled and correctly configured within firewall policies. This guide details the process of integrating IPS security profiles into FortiGate firewall policies, emphasizing best practices for high-security environments, including considerations for SSL inspection.

The core concept involves creating an IPS profile with desired signatures and actions, then associating this profile with specific firewall policies that govern traffic flows you wish to protect. For deep visibility into encrypted traffic, SSL inspection must be enabled in conjunction with IPS.

Creating and Customizing IPS Security Profiles

FortiGate offers several pre-defined IPS profiles, but for granular control and optimal security posture, creating a custom profile based on an existing template is recommended.

Cloning a Default IPS Profile

Start by cloning a default profile to retain a known good baseline and then customize it. The "strict" or "high-security" profiles are good starting points for environments requiring robust protection.

Navigate to Security Profiles > Intrusion Prevention.
Select an existing profile (e.g., default or high_security) and click Clone.
Rename the new profile to something descriptive, such as ips-strict-internal or ips-external-facing-servers.
Click OK.

Configuring IPS Signature Actions

Once cloned, edit your new IPS profile to define how it handles detected threats.

Edit the newly created profile (e.g., ips-strict-internal).
In the Signature and Anomalies section, you can filter by various criteria such as severity, target, or protocol. For example, to focus on critical vulnerabilities for a specific OS, you might filter by "Severity: Critical" and "Target: Windows".
For each signature or group of signatures, you can set the action:
- Block: Immediately drops the offending packet and logs the event. This is generally recommended for high-severity threats.
- Reset: Sends a TCP reset packet to both client and server, terminating the connection.
- Monitor: Logs the event without taking any action. Useful for initial deployment or for lower-severity events where you want visibility without disruption.
For a truly strict profile, consider setting the action for most medium to high severity signatures to Block. Be cautious with "High" or "Critical" severity signatures that default to "Monitor" and change them to "Block".
Review the Protocol Options section. Here you can enable or disable specific decoders for protocols like HTTP, FTP, or DNS, and configure options like HTTP/2 anomaly detection or SSH Tunneling detection.
Ensure that Threat Feed is enabled if you have a FortiGuard subscription, as this provides real-time updates for new threats.
Click Apply to save changes.

CLI Example for IPS Profile Configuration (FortiOS 7.0+):

config ips sensor
    edit "ips-strict-internal"
        set comment "Strict IPS profile for internal network traffic."
        config entries
            edit 1
                set rule "all_recommended"
                set action block
            next
            edit 2
                set rule "known_vulnerabilities_high_severity"
                set action block
            next
        end
        config protocol-options
            set http-ins-decoder enable
            set dns-ins-decoder enable
            set smb-ins-decoder enable
            set ftp-ins-decoder enable
            set ssh-ins-decoder enable
        end
        set scan-botnet-connections enable
        set block-malicious-url enable
        set extended-log enable
    end
end

The rule attribute in config entries refers to signature groups or individual signatures. For granular control, you might need to find specific signature IDs and configure them. You can search for signatures by ID or name in the GUI under the IPS profile editor.

Applying IPS to Firewall Policies

After creating and configuring the IPS profile, the next step is to apply it to the relevant firewall policies. IPS should be enabled on policies that permit traffic from less trusted zones to more trusted zones (e.g., WAN to LAN, DMZ to LAN) or between internal segments where lateral movement of threats is a concern.

Navigate to Policy & Objects > Firewall Policy.
Edit the specific firewall policy you wish to protect (e.g., a policy allowing internet access for internal users, or a policy allowing external access to a web server).
In the Security Profiles section, toggle IPS to Enabled.
From the dropdown menu that appears, select your custom IPS profile (e.g., ips-strict-internal).
Review other security profiles (Antivirus, Web Filter, Application Control) and enable them as appropriate for comprehensive protection.
Click OK to save the policy changes.

CLI Example for Firewall Policy with IPS (FortiOS 7.0+):

config firewall policy
    edit 10
        set name "Internal_to_Internet_with_IPS"
        set srcintf "port1"  # e.g., LAN interface
        set dstintf "port2"  # e.g., WAN interface
        set srcaddr "all"
        set dstaddr "all"
        set service "ALL"
        set action accept
        set schedule "always"
        set nat enable
        set utm-status enable  # Must be enabled for security profiles
        set ips-sensor "ips-strict-internal"
        set av-profile "default"
        set webfilter-profile "default"
        set application-list "default"
        set ssl-ssh-profile "deep-inspection" # See next section
    next
end

Note the set utm-status enable and set ips-sensor "ips-strict-internal" lines. The utm-status must be enabled for any UTM profile (like IPS, AV, Webfilter) to function on a policy.

Enabling SSL Inspection for Encrypted Traffic

A significant portion of modern network traffic, particularly web traffic, is encrypted using SSL/TLS. Without SSL inspection, the FortiGate IPS engine cannot effectively inspect the contents of these encrypted sessions for threats. To enable IPS for HTTPS and other SSL/TLS encrypted traffic, deep-inspection SSL inspection is required.

Configuring Deep Inspection SSL/SSH Profile

Navigate to Security Profiles > SSL/SSH Inspection.
Select the deep-inspection profile.
Ensure that Inspection Method is set to Deep Inspection.
Under Certificate Inspection Options, you typically want to choose Apply to all ports for thoroughness.
If not already done, generate or import a FortiGate CA certificate and distribute it to all client devices that will have their traffic inspected. Without the CA certificate, users will receive browser warnings for every inspected site.
Click Apply.

Applying Deep Inspection to Firewall Policies

Edit the firewall policy where you enabled IPS (e.g., "Internal_to_Internet_with_IPS").
Under Security Profiles, ensure SSL/SSH Inspection is enabled.
Select the deep-inspection profile from the dropdown.
Click OK.

Note: Deep inspection is resource-intensive and can impact firewall performance, especially on older or lower-end FortiGate models. Monitor CPU and memory utilization closely after enabling it.

Monitoring IPS Detections and Performance

After deploying IPS, continuous monitoring is essential to ensure it's functioning as expected and not causing false positives or performance bottlenecks.

Viewing IPS Logs

IPS logs provide details on detected threats, actions taken, and source/destination information.

GUI: Go to Log & Report > Security Events > IPS. You can filter logs by severity, action, signature ID, etc.
CLI:
```
execute log display ips
```
For more detailed, real-time logging to the console, use debugging commands:
```
diagnose debug reset
diagnose debug application ipsd -1
diagnose debug enable
```
To stop debugging: diagnose debug disable then diagnose debug reset.

Checking IPS Session Status

You can verify if IPS is inspecting sessions using the diagnostic CLI commands:

diagnose ips anomaly list
diagnose ips session list
diagnose sys session list | grep ips

The diagnose sys session list | grep ips command will show active sessions and indicate if an IPS sensor is attached (sensor: 10(ips-strict-internal)).

Performance Monitoring

Keep an eye on FortiGate resource utilization, particularly CPU and memory, from FortiView > Sessions or System > Dashboard > Performance Widget. IPS, especially with deep inspection, can consume significant resources.

Common Pitfalls and Troubleshooting

No IPS detections:
- Is IPS enabled on the correct firewall policy?
- Is utm-status enabled on the policy?
- Are the services specified in the policy correct?
- Are the IPS signatures configured to "Block" or "Reset" rather than "Monitor"?
- Is FortiGuard subscription active and IPS definitions up-to-date? (Security Profiles > Intrusion Prevention > FortiGuard Updates)
- For HTTPS traffic, is deep inspection enabled and are client devices trusting the FortiGate CA certificate?
- Check diagnose debug application ipsd -1 for real-time IPS engine activity.
False Positives:
- If legitimate traffic is being blocked, check IPS logs to identify the triggering signature ID.
- Edit the custom IPS profile and either set the action for that specific signature to "Monitor" or "Bypass", or add an exclusion filter.
- Adding an exclusion involves specifying source/destination IP addresses or services that should bypass that particular signature.
Performance Degradation:
- Deep inspection is a common cause. Consider selective application of deep inspection (e.g., only for internal users, not for servers).
- Review the number and complexity of enabled IPS signatures. Can less critical signatures be set to "Monitor" or disabled?
- Ensure the FortiGate hardware is adequately sized for the expected traffic throughput and security profile load.
SSL/TLS Certificate Warnings: These are expected if deep inspection is enabled and the FortiGate CA certificate has not been installed and trusted by client browsers/OS. Distribute the CA certificate via GPO or MDM.