An administrator applied a block-all IPS profile for client and server targets to secure the...

Applying an aggressive IPS profile without prior testing can disrupt legitimate applications by incorrectly identifying normal traffic as malicious. To prevent disruptions while still monitoring for threats:

● Enable IPS in "Monitor Mode" first:

● This allows FortiGate to log and analyze potential threats without actively blocking traffic.

● Administrators can review logs and fine-tune IPS signatures to minimize false positives before switching to blocking mode.

● Verify and adjust signature patterns:

● Some signatures might trigger unnecessary blocks for legitimate application traffic.

● By analyzing logs, administrators can disable or modify specific rules causing false positives.