Справочник Пользователя для Fortinet IPS

Custom signature fields and syntax are fully described in this chapter, though 
using them to build a custom signature can be complex. It’s best to start with a 
simpler signature.

In this first example, we will create a custom signature to block access to the 
example.com URL.

Custom signature basic format

All custom signatures have a header, and at least one keyword/value pair. The 
header is always the same:

F-SBID( )

The keyword/value pairs appear within the parentheses and each pair is followed 
by a semicolon.

Choosing a name for the custom signature

Every custom signature requires a name, so it is good practice to assign a name 
before any other keywords are added.

Use the --name keyword to assign the custom signature a name. The name 

value follows the keyword after a space. Enclose the name value in double-
quotes:

F-SBID( --name "Block.example.com"; )

The signature, as it appears here, will not do anything if used. It has a name, but 
doesn’t look for any patterns in network traffic. You must specify a pattern for the 
FortiGate unit to search for.

Adding a signature pattern

Use the --pattern keyword to specify what the FortiGate unit will search for:

F-SBID( --name "Block.example.com"; --pattern 

"example.com"; )

The signature will now detect the example.com URL appearing in network traffic. 
The custom signature should only detect the URL in HTTP traffic, however. Any 
other traffic with the URL should be allowed to pass. For example, an Email 
message to or from example.com should not be stopped.

Specifying the service

Use the --service keyword to limit the effect of the custom signature to only the 

HTTP protocol.

F-SBID( --name "Block.example.com"; --pattern 

"example.com"; --service HTTP; )

--rpc_num <app_int>[, 
<ver_int> | *][, 
<proc_int> | *>];

Check for RPC application, version, and 

procedure numbers in SUNRPC CALL 

requests. The * wildcard can be used for 

version and procedure numbers.

--same_ip;

The source and the destination have the same 

IP addresses.