쫑콩아빠의 지금 이 순간...

DefensePro 장비 주로 쓰는 CLI
system logfile : 장비 LOG 확인
system cpu-temp : 장비 CPU 온도 확인
system config immediate : 장비 config 확인
system total-in-traffic-peak : 유입되는 최대 트래픽 확인(Mbps)
system os buffer : Memory 사용량 확인
system hardware temperature-show : DP장비 CPU온도확인(= system cpu-temp)
system internal fans : Fan 상태 확인
system internal port-stats : 가장 최근에 들어오는 트래픽 용량 확인(5초, 30초, 60초)
system sw-version : DP 버전 확인
system utilization cpu : CPU 사용량 확인
system inf-stats : 인터페이스에 들어오는 트래픽량 확인
system license application : DP 라이선스 키 및 MAC address 확인
system device-info : 장비 정보 확인
system date : DP 날짜 및 시간 확인
device static-forwarding-table : Inline 상태 확인
services ntp server-name : NTP 주소 확인
services ntp status : NTP 서버 상태 확인
manage web status : 웹 데몬 상태 확인
net arp table : ARP 테이블 확인
net l2-interface : 포트 링크 상태 확인
net l2-information : 포트 정보 확인
net physical-interface : 포트 Speed, Duplex, Autonego 확인
net route table : 매니지먼트 라우팅 테이블 확인
net ip-interface : 매니지먼터 IP 정보
shutdown : 장비 shutdown
reboot : 장비 rebooting
dp attack-database version : DP 시그니쳐 버전
Apsolute Vision CLI
net ip get : Vision 서버 IP 확인
system hadware status get : FAN 상태 및 온도 확인
system vision-server status : Vision 서버, Reporter 서버 데몬 상태 확인
system version : Vision 서버 버전 확인

# Fortigate IPS DoS configuration Sample

qvrexhqfw2 $ show ips DoS block_dos
config ips DoS
    edit "block_dos"
            config anomaly
                edit "tcp_syn_flood"
                    set status enable
                    set log enable
                    set action block
                    set threshold 10
                next
                edit "tcp_port_scan"
                    set status enable
                    set log enable
                    set action block
                    set threshold 10
                next
                edit "tcp_src_session"
                    set status enable
                    set log enable
                    set action block
                    set threshold 10
                next
                edit "tcp_dst_session"
                    set status enable
                    set log enable
                    set action block
                    set threshold 10
                next
                edit "udp_flood"
                    set status enable
                    set log enable
                    set action block
                    set threshold 10
                next
                edit "udp_scan"
                    set status enable
                    set log enable
                    set action block
                    set threshold 10
                next
                edit "udp_src_session"
                    set status enable
                    set log enable
                    set action block
                    set threshold 10
                next
                edit "udp_dst_session"
                    set status enable
                    set log enable
                    set action block
                    set threshold 10
                next
                edit "icmp_flood"
                    set status enable
                    set log enable
                    set action block
                    set threshold 10
                next
                edit "icmp_sweep"
                    set status enable
                    set log enable
                    set action block
                    set threshold 10
                next
                edit "icmp_src_session"
                    set status enable
                    set log enable
                    set action block
                    set threshold 10
                next
                edit "icmp_dst_session"
                    set status enable
                    set log enable
                    set action block
                    set threshold 10
                next
                edit "ip_src_session"
                    set status enable
                    set log enable
                    set action block
                    set threshold 10
                next
                edit "ip_dst_session"
                    set status enable
                    set log enable
                    set action block
                    set threshold 10
                next
            end
    next
end
qvrexhqfw2 $ sh firewall interface-policy
config firewall interface-policy
    edit 1
        set interface "dmz"
            set srcaddr "all"
            set dstaddr "all"
            set service "ANY"
        set ips-DoS-status enable
        set ips-DoS "block_dos"
    next
end