MENU
An administrator wanted to configure an IPS sensor to block traffic that triggers the signature set number of times during a specific time period. How can the administrator achieve the objective?
In FortiOS 7.6, if an administrator wants to block traffic only after an IPS signature is triggered a specific number of times within a defined time window, this must be done using IPS filters with rate-based settings.
Why option D is correct
IPS filters allow administrators to match signatures based on attributes such as:
Severity
Protocol
CVE
Signature ID
IPS filters support rate-based actions using:
rate-mode periodical
rate-count
rate-duration
With rate-mode periodical, FortiGate:
Counts how many times a signature is triggered
Within a defined time period
And applies the configured action (for example, block) once the threshold is exceeded
This directly matches the requirement:
''block traffic that triggers the signature set number of times during a specific time period.''
Why the other options are incorrect
A . IPS group signatures, set rate-mode 60 Group signatures do not provide the required per-period rate-based blocking logic.
B . IPS packet logging option Logging does not enforce blocking behavior.
C . IPS signatures, rate-mode periodical option Rate-based controls are applied via IPS filters, not directly on individual signature definitions.