Справочник Пользователя для Fortinet IPS

The FortiGate IPS uses a traffic anomaly detection feature to identify network 
traffic that does not fit known or common traffic patterns and behavior. For 
example, one type of flooding is the denial of service (DoS) attack that occurs 
when an attacking system starts an abnormally high number of sessions with a 
target system. The high number of sessions slows down or disables the target 
system so legitimate users can no longer use it. This type of attack gives the DoS 
sensor its name, although it is capable of detecting and protecting against a 
number of anomaly attacks.

You can enable or disable logging for each traffic anomaly, and configure the 
detection threshold and action to take when the detection threshold is exceeded.

You can create multiple DoS sensors. Each sensor consists of 12 anomaly types 
that you can configure. Each sensor examines the network traffic in sequence, 
from top to bottom. When a sensor detects an anomaly, it applies the configured 
action. Multiple sensors allow great granularity in detecting anomalies because 
each sensor can be configured to examine traffic from a specific address, to a 
specific address, on a specific port, in any combination.

When arranging the DoS sensors, place the most specific sensors at the top and 
the most general at the bottom. For example, a sensor with one protected address 
table entry that includes all source addresses, all destination addresses, and all 
ports will match all traffic. If this sensor is at the top of the list, no subsequent 
sensors will ever execute.

The traffic anomaly detection list can be updated only when the FortiGate 
firmware image is upgraded.

This section describes:

•

•

•

Note: If virtual domains are enabled on the FortiGate unit, the Intrusion Protection settings 
must be configured separately in each VDOM. All sensors and custom signatures will 
appear only in the VDOM in which they were created.