Fortinet Network Device IPS - Manual (Page 33)

Custom signatures Creating custom signatures
FortiGate IPS User Guide Version 3.0 MR7
01-30007-0080-20080916
33
Example custom signatures
Custom signature fields and syntax are fully described in this chapter, though
using them to build a custom signature can be complex. It’s best to start with a
simpler signature.
Example 1: signature to block access to example.com
In this first example, we will create a custom signature to block access to the
example.com URL.
1 Custom signature basic format
All custom signatures have a header, and at least one keyword/value pair. The
header is always the same:
F-SBID( )
The keyword/value pairs appear within the parentheses and each pair is followed
by a semicolon.
2 Choosing a name for the custom signature
Every custom signature requires a name, so it is good practice to assign a name
before any other keywords are added.
Use the --name keyword to assign the custom signature a name. The name
value follows the keyword after a space. Enclose the name value in double-
quotes:
F-SBID( --name "Block.example.com"; )
The signature, as it appears here, will not do anything if used. It has a name, but
doesn’t look for any patterns in network traffic. You must specify a pattern for the
FortiGate unit to search for.
3 Adding a signature pattern
Use the --pattern keyword to specify what the FortiGate unit will search for:
F-SBID( --name "Block.example.com"; --pattern
"example.com"; )
The signature will now detect the example.com URL appearing in network traffic.
The custom signature should only detect the URL in HTTP traffic, however. Any
other traffic with the URL should be allowed to pass. For example, an Email
message to or from example.com should not be stopped.
4 Specifying the service
Use the --service keyword to limit the effect of the custom signature to only the
HTTP protocol.
F-SBID( --name "Block.example.com"; --pattern
"example.com"; --service HTTP; )
--rpc_num [,
| *][,
| *>]; Check for RPC application, version, and
procedure numbers in SUNRPC CALL
requests. The * wildcard can be used for
version and procedure numbers.
--same_ip; The source and the destination have the same
IP addresses.
Table 9: Other keywords (Continued)
Keyword and Value Description