Intrusion Prevention and Anti-Malware
Intrusion Prevention and Anti-Malware tests signature-based detection, inspection modes, and the profile settings that determine whether malicious content is blocked or only logged. Expect questions on IPS sensors, antivirus scanning, sandbox integration, and SSL inspection.
IPS essentials
- An IPS sensor contains signature entries and anomaly rules; entries can be set to block, monitor, or reset.
- Signatures have severity, protocol, and target; rate-based signatures trigger on frequency.
- IPS can operate in flow or proxy mode; proxy mode buffers and scans, while flow mode inspects as packets pass.
- Exemptions and filters reduce false positives; a signature set to monitor only logs, so the attack is not stopped.
- SSL inspection is required for encrypted attacks; without it, IPS sees ciphertext.
Anti-malware
- Antivirus profiles scan content on protocols configured in the profile; scanning may be limited by file size and oversize settings.
- Sandbox inspection sends suspicious files to FortiSandbox; verdicts can be blocking or logging.
- Content disarm and reconstruction removes active content from documents.
- Quarantine and replacement messages notify users; monitor action does not block.
- Signature updates arrive through FortiGuard; the sensor must reference updated signatures.
Worked example
An IPS sensor has a signature for a known exploit set to monitor. A detection appears in logs but the attack succeeds. The correct change is to set the signature action to block and ensure the sensor is applied on the policy covering the server subnet. If the traffic is HTTPS and the policy lacks deep inspection, the signature will not match at all. Also check the policy's inspection mode: flow-based inspection may not detect patterns that span multiple packets in the same way as proxy-based inspection.
Traps
- An antivirus profile with only monitor action does not block downloads.
- Oversize file settings can skip scanning; attackers use large archives.
- IPS sensors are attached to policies, not interfaces; a missing policy means no inspection.
Key points
- IPS signature actions control whether traffic is blocked or only logged.
- Deep inspection is required for encrypted attacks.
- Flow and proxy inspection modes differ in buffering and detection depth.
- Oversize file limits can allow malware to pass unscanned.
- IPS sensors are applied through firewall policies.