Intrusion Prevention System (IPS). It is the difference between a burglar alarm that calls the police and a security guard who tackles the burglar the moment they break a window. For the NSE7 exam, you must understand how to configure and fine-tune FortiGate IPS so it blocks real threats without accidentally blocking your own customers or employees.
Jump to a section
A simple way to picture Intrusion Prevention System (IPS)
The airport security officer at the departures gate is responsible for more than just watching people walk through a metal detector. They have a detailed watch list of risky behaviours: someone pacing nervously, an oversized bag that matches a known threat profile, or a passenger whose ticket was bought at the last minute with cash. The officer doesn't just detect these signs; they actively intervene. If a passenger sets off the scanner repeatedly, the officer pulls them aside, searches their luggage, and if they find something dangerous, they stop that person from boarding. They also memorise new threats daily: today's bulletin might say criminals are hiding knives in rolled-up magazines, so the officer now pays extra attention to anyone carrying a magazine. Over time, they learn to ignore false alarms, like a phone in a pocket, because the real skill is distinguishing a harmless bleep from a genuine threat. This is exactly how a FortiGate IPS works. The IPS sits at the network's entrance, armed with a constantly updated database of attack signatures — the digital equivalent of a security watch list. It inspects every packet (every passenger) in real time. If a packet matches a known attack pattern, the IPS doesn't just raise an alarm; it drops the packet, blocks the source IP, and logs the incident. It learns from past false positives too, adapting its sensitivity so that a legitimate traffic spike doesn't trigger a lockdown. The officer's ability to block a passenger before they reach the plane is the IPS's ability to stop a cyber attack before it ever enters your network.
The officer also works alongside other security layers. The CCTV cameras (like a firewall) monitor for suspicious movement, but they don't physically stop anyone. The officer does. That's the distinction between Intrusion Detection (watching) and Intrusion Prevention (stopping). The airport doesn't just want to know about a potential hijacker — they want to prevent the hijacking. FortiGate IPS does the same for your network.
An Intrusion Prevention System (IPS) is a network security technology that monitors traffic for malicious activity and takes action to block that activity in real time. Think of it as a smart filter that sits between your internal network and the outside world. Unlike a traditional firewall, which only looks at IP addresses and ports, an IPS inspects the actual content of data packets — the tiny chunks of information that travel across a network.
The FortiGate IPS uses a massive database of attack signatures. A signature is a pattern that matches a known threat. For example, a signature might look for a specific string of characters that appears in a SQL injection attack. When a hacker sends a malicious command like 'SELECT * FROM users WHERE username = admin OR 1=1', the IPS recognises that pattern and blocks the packet before it reaches your web server.
How does the IPS know what's malicious? It uses four main detection methods. The first is signature-based detection, which compares traffic against a known list of attack patterns, similar to antivirus software checking files against a virus database. The second is anomaly-based detection, which establishes a baseline of normal network behaviour and then flags anything that deviates from that baseline. If your employees usually download 10 MB per minute and suddenly they're downloading 100 MB per minute, the IPS suspects a data exfiltration attempt. The third is protocol-based detection, which looks for violations of standard network protocols. For instance, a DNS query that is longer than the allowed 512 bytes is suspicious. The fourth is behaviour-based detection, which looks for specific attack behaviours that unfold over time, like a series of port scans followed by a brute force attack.
The FortiGate IPS operates in several modes. The most common is 'block' mode, where the IPS actively drops malicious packets. There is also 'monitor' mode, where the IPS logs alerts but does not block traffic, which is useful for testing before you go live. Another mode is 'quarantine' mode, where the IPS temporarily isolates the source IP address after detecting an attack. You can also set the IPS to 'reset' mode, which sends a TCP reset packet to the attacker's machine to close the connection.
Why does this matter for the NSE7 exam? Because 4.3 specifically tests your ability to configure and fine-tune IPS settings. You must know how to create IPS policies, select appropriate signatures, and adjust sensitivity to avoid false positives. A false positive occurs when the IPS blocks legitimate traffic, mistaking it for an attack. This can crash your company's e-commerce site or prevent employees from accessing critical tools. Tuning the IPS involves tweaking the 'IPS severity' level, enabling exceptions for trusted IPs, and configuring the 'IPS filter' to only check for threats relevant to your environment. For example, if your company doesn't run a web server, you can disable all web application signatures to reduce overhead and false alerts.
The IPS also works alongside other FortiGate security features. For instance, the Application Control feature can block specific applications like BitTorrent, while the IPS can block the malware those torrents might carry. Similarly, the Web Filter can block access to known malicious URLs, while the IPS blocks the actual exploit that tries to execute after the user clicks a link. They are complementary layers.
A critical point for the exam is understanding IPS profiles and filters. In FortiGate, you create an IPS sensor — a collection of signatures and settings. Then you attach that sensor to a firewall policy. The firewall policy decides which traffic the sensor inspects. If you attach an IPS sensor to a policy that allows port 80 (HTTP) traffic, the FortiGate will inspect all web traffic for attacks. You can also create multiple sensors for different parts of your network. For example, a strict sensor for your public web server and a lenient one for internal file transfers.
Finally, the IPS engine updates automatically via FortiGuard, Fortinet's cloud-based threat intelligence service. But for the exam, you must know how to manually update signatures in environments without internet access. You can download the IPS package from the Fortinet support site and upload it to the FortiGate via the CLI or GUI. This is a common exam scenario because real-world banks and air-gapped networks often restrict internet connectivity.
Create an IPS Sensor
Navigate to Security Profiles > Intrusion Prevention > IPS Sensor. Click 'Create New' and give the sensor a descriptive name (e.g., 'Web_Protection'). This sensor is a container where you will select which attack signatures to check for.
Select Signatures and Set Actions
In the sensor, click 'Add Signature' and filter by category (e.g., Web Server), severity (e.g., Critical), or platform. Choose the action for each signature: 'block' stops the attack, 'monitor' logs it, 'quarantine' isolates the source IP. For initial deployment, set critical ones to 'block' and medium ones to 'monitor'.
Configure Exceptions
Add exceptions for trusted IP addresses or specific traffic patterns that you know are safe. For example, exempt your internal monitoring server from IPS inspection. This prevents false positives from affecting critical internal operations.
Apply the IPS Sensor to a Firewall Policy
Go to Policy & Objects > Firewall Policy. Edit the policy that governs inbound web traffic. Under 'Security Profiles', select the IPS sensor you created. Without this step, the sensor is not active.
Test and Tune the IPS
Check the IPS logs under Log & Report > Security Events > Intrusion. Look for alerts and identify false positives. Tune the sensor by disabling irrelevant signatures, adjusting severity levels, or adding more exceptions. Repeat until the false positive rate is acceptable.
Enable Automatic Updates
Navigate to System > FortiGuard and enable automatic IPS signature updates. In an air-gapped environment, manually download the IPS package from the Fortinet support site and upload it via CLI with the command 'execute restore image ips tftp://your-server/ips.db'.
An IT professional at a medium-sized manufacturing company is tasked with deploying FortiGate IPS to protect the company's new customer-facing web portal. The portal handles credit card payments and personal information. The CISO demands that no data breach occurs, but also insists that the website must not become slow or crash due to false positives blocking legitimate customers.
The IT professional starts by logging into the FortiGate GUI and navigating to the IPS section. They first create a new IPS sensor called 'WebPortal_Strict'. They then browse the signature database, filtering by the 'Web Server' category because the portal runs Apache on Linux. They select all signatures with a critical severity, but they are cautious not to enable every single signature because the FortiGate would then use too many CPU resources and could cause latency.
Next, they configure the IPS sensor to use 'block' action for all high-severity SQL injection and cross-site scripting signatures. For medium-severity ones, they set the action to 'monitor' so they can see what gets flagged without risking blocking real customers during the first week. They also create an exception list: the company's internal IP addresses (like the finance team who run automated reports against the portal) are exempt from IPS inspection.
The IT professional then applies the sensor to the firewall policy that allows external traffic to the web server. They enable logging so they can review logs daily. On the first day, they see an alert: a customer from an IP in Russia triggered a medium-severity signature called 'HTTP.SQL.Injection'. But when they check the full packet log, they see it was a false positive — the customer typed a comment in a form field that contained SQL-like text. The professional adjusts the IPS sensor to exclude that particular signature from checking the form field path.
Over the next week, they fine-tune the IPS by:
Reducing the severity level for 'scanner' signatures (like port scans) to 'monitor' only, because port scans from legitimate security researchers are common and do not warrant blocking.
Enabling the 'IPS bypass' for traffic exceeding 100 Mbps to prevent performance degradation.
Scheduling automatic IPS signature updates from FortiGuard every four hours.
Creating a second IPS sensor for internal traffic (employees accessing the company VPN) with a lower detection threshold, because internal threats are more likely to be malicious.
The professional also sets up an alert email to be sent whenever a critical signature is triggered. One week in, they receive an alert about a real SQL injection attempt from abroad. The IPS blocked it immediately. The professional reviews the log, confirms it was a genuine attack, and then reports to the CISO that the system prevented a potential data breach. They also export the IPS log for the company's compliance audit evidence. This step-by-step process of deploying, monitoring, and fine-tuning is exactly what the NSE7 exam expects you to know how to do.
The NSE7 Advanced Security exam (NSE7) tests your practical ability to configure and fine-tune IPS on FortiGate. Expect multiple-choice questions, drag-and-drop ordering tasks, and scenario-based questions where you must choose the correct configuration sequence.
The exam creators love to test your understanding of IPS sensors versus IPS policies. A common trap is a question that asks: 'Where do you attach the IPS sensor?' The correct answer is 'to a firewall policy', not 'to the network interface directly' or 'to the IPS policy menu'. Another trap is about action modes. They might ask: 'Which IPS action mode should you use during a trial deployment before enabling blocking?' The answer is 'monitor mode'. They also test the difference between 'IPS signature' and 'IPS filter'. A signature is a specific pattern, while a filter is a set of conditions that select multiple signatures (like all critical SQL injection signatures).
Key topics you must memorise:
The four detection methods: signature-based, anomaly-based, protocol-based, and behaviour-based.
The IPS action modes: block, monitor, quarantine, and reset.
The differences between IPS (active blocking) and IDS (Intrusion Detection System, which only alerts).
How to create an IPS sensor and attach it to a firewall policy.
How to manage false positives: by creating exceptions, adjusting severity thresholds, or disabling specific signatures.
The role of FortiGuard in providing signature updates.
How to manually update signatures via CLI (the command 'execute update-now ips').
The importance of tuning the 'IPS scan' mode: flow-based versus proxy-based. Flow-based is faster but less thorough; proxy-based is slower but safer.
Common exam traps:
A question might say: 'The IPS is blocking traffic even though you set it to monitor mode.' The catch is that another IPS sensor or a global setting might be overriding your sensor. Or the IPS is set to block on a different firewall policy. Always check for duplicate policies.
Another trap: 'What is the default IPS action?' There is no default; you must choose an action.
A scenario: 'A user reports a slow website. You check the IPS logs and see thousands of blocked requests from a single IP.' The correct action is to add that IP to an exception list, not to disable the entire IPS sensor.
Questions that ask: 'How do you prevent IPS from inspecting certain traffic?' Answer: configure an exception in the IPS sensor or use a separate firewall policy without an IPS sensor for that traffic type.
They might ask about 'IPS bypass' — this feature allows traffic to skip IPS inspection when CPU usage is high, to avoid performance issues. This is not the same as disabling IPS.
Finally, the exam often includes a question about 'IPS and SSL inspection'. The FortiGate cannot inspect encrypted traffic (HTTPS) without SSL inspection enabled. A trick question might ask: 'Why is your IPS not detecting attacks on HTTPS traffic?' The answer: SSL inspection is not configured. So you must enable SSL inspection and then add a certificate to your clients.
An Intrusion Prevention System (IPS) actively blocks malicious traffic, whereas an Intrusion Detection System (IDS) only alerts you to potential threats.
FortiGate IPS uses four detection methods: signature-based, anomaly-based, protocol-based, and behaviour-based.
IPS sensors must be attached to a firewall policy, and each policy can have a different sensor for different traffic types.
Monitor mode logs alerts without blocking traffic and is essential for testing IPS before going live.
False positives are reduced by creating exceptions, adjusting severity thresholds, or disabling specific signatures that are irrelevant to your environment.
FortiGate requires SSL inspection to be enabled in order to inspect encrypted HTTPS traffic for IPS threats.
These come up on the exam all the time. Here's how to tell them apart.
Intrusion Prevention System (IPS)
Actively blocks malicious traffic in real time
Sits inline with the traffic path
Can cause downtime if misconfigured
Intrusion Detection System (IDS)
Only alerts when it detects a threat
Can be inline or out-of-band (passive)
Does not affect traffic flow if it fails
Signature-Based Detection
Matches known attack patterns from a database
Low false positive rate for known threats
Cannot detect unknown (zero-day) attacks
Anomaly-Based Detection
Flags deviations from a learned baseline of normal behaviour
Can detect unknown attacks
Higher false positive rate initially
Flow-Based IPS Scanning
Inspects packets as they traverse the firewall
Lower latency and CPU usage
Cannot reassemble fragmented packets for deep inspection
Proxy-Based IPS Scanning
Reassembles the entire packet stream before inspecting
Higher security but uses more resources
Better at detecting attacks spread across multiple packets
Mistake
IPS and firewall are the same thing.
Correct
A firewall blocks traffic based on IP addresses and ports; an IPS inspects the actual content of packets to block malicious patterns. Firewalls do not look inside the data.
Many beginners assume that because both are security tools found on the same device (FortiGate), they are interchangeable. In reality, they are complementary layers.
Mistake
You can just turn on IPS and it will work perfectly without any configuration.
Correct
IPS requires careful tuning to avoid false positives and performance issues. Out-of-the-box IPS with all signatures enabled will likely block legitimate traffic and slow down your network.
Marketing materials often show IPS as a 'turn it on and forget it' feature. Real-world deployment demands significant manual fine-tuning.
Mistake
IPS only uses signature-based detection.
Correct
FortiGate IPS uses four methods: signature-based, anomaly-based, protocol-based, and behaviour-based. Signature-based is just one of them, and behavioural detection is critical for catching zero-day attacks.
Beginners often think of IPS like antivirus software, which traditionally relies only on signatures. They forget that modern IPS uses multiple techniques.
Mistake
If you set IPS to monitor mode, it will still block attacks but also log them.
Correct
Monitor mode logs alerts but DOES NOT block traffic. For blocking, you must set the action to 'block', 'quarantine', or 'reset'.
The word 'monitor' sounds passive, but beginners interpret it as 'I'll watch and block if needed'. The exam explicitly tests this distinction.
Mistake
You can apply an IPS sensor directly to a network interface.
Correct
An IPS sensor is attached to a firewall policy, not a network interface. The firewall policy determines which traffic the sensor inspects.
FortiGate's GUI might make it seem like you can apply IPS to an interface under the 'IPS' menu, but that is only for selecting a sensor; the actual enforcement is through policies.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
An Intrusion Prevention System (IPS) actively blocks malicious traffic. An Intrusion Detection System (IDS) only sends an alert when it detects a threat; it does not stop the traffic.
Add an exception in the IPS sensor for your internal IP addresses or specific signature IDs that cause false positives. Alternatively, create a separate firewall policy without an IPS sensor for internal trusted traffic.
FortiGate cannot inspect encrypted traffic unless SSL inspection is enabled. Configure SSL inspection in the firewall policy and install the FortiGate CA certificate on client devices.
An IPS signature is a pattern that matches a known cyber attack. For example, a signature might look for the string 'SELECT * FROM users' to detect a SQL injection attempt.
Yes. You can manually download the IPS signature database from the Fortinet support site and upload it to the FortiGate via the CLI or GUI. This is common in air-gapped networks.
The FortiGate will consume too many CPU resources, slowing down your network. It will also likely block legitimate traffic due to false positives. Always select only signatures relevant to your environment.
You've finished Intrusion Prevention System (IPS). Continue through the NSE7 study guide to build a complete picture of the exam.
Done with this chapter?