Custom IPS Signature Not Triggering on FortiGate: Missing Protocol Parameter
A network administrator is troubleshooting a FortiGate IPS sensor that is not generating alerts for a custom signature they created. The custom signature uses the pattern 'malicious. The signature is enabled and applied to a firewall policy. What is the MOST likely cause of the issue?
Quick Answer
The answer is that the custom IPS signature is missing the mandatory protocol parameter. Without specifying a protocol such as TCP, UDP, or HTTP, the FortiGate IPS engine has no context for which traffic layer to inspect, so even a correctly enabled signature applied to a policy will never trigger an alert. This is a common pitfall on the Fortinet NSE 7 Advanced Security NSE7 exam, which tests your understanding of how custom signatures must include all required fields—especially protocol—to function within the IPS sensor. A frequent trap is assuming that a pattern alone is sufficient, but the engine requires explicit protocol binding to match against flows. Remember the mnemonic: “No protocol, no patrol”—if you omit the protocol, your signature will never patrol the traffic.
⚠ Common exam trap
Many candidates assume a missing protocol parameter would cause a syntax error or prevent the signature from being saved, but FortiGate allows saving incomplete custom signatures that simply never match traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The custom signature is missing the 'protocol' parameter
The custom signature is missing the 'protocol' parameter, which is mandatory for FortiGate custom IPS signatures. Without specifying the protocol (e.g., TCP, UDP, HTTP), the IPS engine cannot match the pattern against any traffic flow, so no alerts are generated even if the signature is enabled and applied to a policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The signature severity is set to 'Low' and logging is disabled for low severity
Why it's wrong here
Even if logging is disabled, the signature would still be evaluated; alerts would be generated if logging is enabled.
- ✓
The custom signature is missing the 'protocol' parameter
Why this is correct
Custom signatures must specify a protocol decoder (e.g., HTTP, FTP) to be evaluated; without it, the signature is ignored.
- ✗
The IPS sensor is configured in 'Passive' mode
Why it's wrong here
Passive mode would still generate logs but not block; alerts would still appear.
- ✗
The firewall policy is using 'Flow-based' inspection
Why it's wrong here
IPS works in both flow and proxy modes.
Go deeper
Related to this question
About these practice questions
One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator is troubleshooting why a custom IPS signature for protocol anomaly detection is not triggering. The signature is designed to detect abnormal DNS query lengths. Which TWO steps should the administrator take to verify the signature is working? (Choose two.)
medium- A.Reboot the FortiGate to reset the IPS engine
- B.Disable the firewall policy to see if the signature triggers
- ✓ C.Verify that the IPS sensor containing the signature is applied to the correct firewall policy
- ✓ D.Generate traffic that matches the signature and check the IPS logs for alerts
- E.Increase the signature's severity to see it in logs
Why C: An IPS sensor must be explicitly applied to a firewall policy for the signatures it contains to be evaluated against traffic passing through that policy. Without this binding, the custom signature for DNS protocol anomaly detection will never be inspected, regardless of its configuration or the traffic type.
Variation 2. An administrator runs 'diagnose ips anomaly list' and sees many 'data_leak' events from a specific internal IP address. The IPS sensor has the default pre-defined signatures enabled. What additional step should the administrator take to block this specific anomaly?
hard- A.Enable protocol anomaly detection in the antivirus profile
- ✓ B.Create a custom IPS signature to match the anomaly pattern and apply it to the IPS sensor
- C.Enable the 'data_leak' signature in the IPS sensor and set action to 'block'
- D.Configure a firewall policy with application control to block the traffic
Why B: The 'diagnose ips anomaly list' command shows protocol anomaly events, which are detected by the IPS engine's built-in anomaly detection logic, not by pre-defined signatures. To block a specific anomaly pattern like 'data_leak', the administrator must create a custom IPS signature that matches the exact anomaly characteristics and apply it to the IPS sensor. Pre-defined signatures cannot be modified to block anomalies; only custom signatures can target these events.
Variation 3. An administrator runs 'diagnose ips anomaly http' and sees many entries with 'type=SQLi' and 'score=0'. What does a score of 0 indicate?
hard- A.The anomaly detection is disabled
- ✓ B.The traffic showed suspicious patterns but did not meet the threshold
- C.The IPS sensor is not applied to any policy
- D.The traffic is definitely an SQL injection attack
Why B: In Fortinet's IPS anomaly detection, a score of 0 indicates that the traffic exhibited suspicious patterns (e.g., SQLi signatures) but did not accumulate enough anomaly points to meet the configured threshold for triggering an action. This means the traffic was flagged as potentially malicious but was not deemed severe enough to warrant logging or blocking, so it remains in a 'monitoring' state without enforcement.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.