FortiGuard Intrusion Prevention System (IPS) is a powerful security feature included in Fortinet devices designed to detect and block malicious traffic before it reaches the internal network. While it provides essential protection against various attacks, there are situations where administrators might need to disable IPS temporarily, such as troubleshooting network issues, performance optimization, or testing applications that are being inadvertently blocked. Understanding how FortiGuard IPS works, its configuration, and the safe methods to disable it is crucial for maintaining network security while performing necessary administrative tasks.
Understanding FortiGuard Intrusion Prevention
FortiGuard IPS works by inspecting network traffic for known attack signatures, abnormal behaviors, and vulnerabilities. It can block exploits, malware propagation, and network intrusions in real time. IPS is a critical component of Fortinet’s security ecosystem and integrates with other features such as antivirus scanning, web filtering, and application control to provide comprehensive protection. Disabling IPS should only be done with caution because it temporarily removes a layer of network defense, potentially exposing the network to threats.
Key Functions of FortiGuard IPS
The primary functions of FortiGuard IPS include
- Signature-Based Detection Identifies known attack patterns and blocks them automatically.
- Anomaly-Based Detection Monitors network behavior to detect suspicious activity not covered by signatures.
- Protocol Analysis Examines network protocols for misuse or abnormal behavior that could indicate an attack.
- Integration with FortiOS Policies Works seamlessly with firewall rules and other FortiOS security features to enhance overall protection.
Reasons to Disable FortiGuard IPS
There are legitimate scenarios where an administrator might need to disable IPS temporarily. Common reasons include troubleshooting network issues where legitimate traffic is being blocked, testing new applications that are incorrectly flagged by IPS signatures, or optimizing performance in a controlled environment. However, disabling IPS should always be accompanied by risk assessment and, if possible, performed in a staging or test network before applying changes in production.
Performance Considerations
IPS inspection consumes CPU and memory resources on Fortinet devices. In high-traffic environments, enabling IPS on all traffic may lead to performance degradation. Temporarily disabling IPS can help identify if performance issues are related to IPS processing, but administrators must monitor the network closely to ensure no security gaps are exploited during this period.
Steps to Disable FortiGuard IPS
Disabling FortiGuard IPS involves accessing the Fortinet management interface and adjusting the relevant security policies. There are two main methods via the graphical user interface (GUI) and through the command-line interface (CLI). Both methods allow administrators to selectively disable IPS for specific policies or globally across the device.
Disabling IPS via GUI
The graphical interface of FortiGate devices provides an intuitive way to manage IPS settings. The steps are as follows
- Log in to the FortiGate web interface using an administrator account.
- Navigate to Security Profiles > Intrusion Prevention.
- Select the IPS profile currently applied to your policies.
- Either unassign the IPS profile from specific firewall policies or edit the profile to disable detection temporarily.
- Save the changes and ensure the policy updates are applied across the network.
Disabling IPS via CLI
The command-line interface offers a more granular approach for advanced administrators. Steps include
- Access the FortiGate device via SSH using an administrator account.
- Enter global configuration mode by typing
config firewall policy. - Select the policy you want to modify using
edit <policy_id>. - Remove or change the IPS profile assignment using
unset ips-sensoror assign a profile with detection disabled. - End the configuration session with
endand confirm that the changes are active.
Selective vs. Global Disabling
Administrators can choose to disable IPS selectively for specific policies or globally across the device. Selective disabling allows critical segments of the network to remain protected while isolating problem areas for troubleshooting. Global disabling is riskier and should only be performed in a controlled or test environment to prevent potential attacks from exploiting unmonitored traffic.
Selective Disabling Benefits
By disabling IPS only on targeted policies
- Minimizes exposure to threats while troubleshooting.
- Allows specific applications or services to function without interference from IPS signatures.
- Helps identify whether IPS is causing performance or connectivity issues.
Global Disabling Risks
Disabling IPS globally exposes the entire network to potential attacks and should be avoided unless absolutely necessary. Administrators performing global changes should ensure that alternative security measures, such as firewall rules and antivirus scanning, remain active to reduce the risk of compromise.
Overcoming Challenges When Disabling IPS
Disabling IPS can introduce temporary challenges in security management. It is important to implement compensating controls and monitoring strategies to maintain network integrity.
Monitoring and Logging
Even when IPS is disabled, administrators should continue to monitor traffic and review logs for suspicious activity. Utilizing FortiAnalyzer or other monitoring tools can provide visibility into network behavior, allowing for rapid response if a potential threat is detected.
Testing and Verification
Before making permanent changes, test the effects of disabling IPS in a controlled environment. Verify that the specific issues you aim to resolve are addressed without introducing new security gaps. Testing ensures that the network maintains functionality and stability while reducing unnecessary risk.
Re-enabling IPS
After troubleshooting or performing necessary maintenance, IPS should be re-enabled as soon as possible to restore full protection. Administrators can reassign IPS profiles to firewall policies via the GUI or CLI, ensuring that all detection and prevention capabilities are active again. Regularly updating IPS signatures is also critical to maintain protection against the latest threats.
Best Practices When Disabling IPS
To ensure safe management of FortiGuard IPS, follow these best practices
- Always perform changes in a controlled or test environment when possible.
- Document the reason for disabling IPS and the affected policies or segments.
- Monitor network traffic closely during the period IPS is disabled.
- Re-enable IPS promptly after troubleshooting or maintenance.
- Keep IPS signatures up to date to ensure protection against emerging threats.
FortiGuard Intrusion Prevention is a key security feature that protects networks from malicious traffic and exploits. While it is highly recommended to keep IPS enabled at all times, there are scenarios where temporarily disabling it is necessary for troubleshooting or performance optimization. Administrators can disable IPS selectively for specific policies or globally, using either the GUI or CLI. However, careful planning, monitoring, and timely re-enabling of IPS are crucial to maintaining network security. By following best practices and understanding the implications of disabling IPS, network administrators can balance operational needs with strong protection against cyber threats.