A FortiGate firewall can block known malicious traffic, but only when its IPS policy is matched to the way your business actually operates. Turning on every available signature may sound safer, yet it can create false positives, slow troubleshooting, and interrupt legitimate applications. The better approach is to implement IPS policies on FortiGate in stages, beginning with clear visibility and moving toward carefully controlled blocking.
For businesses handling cloud applications, remote users, customer data, and internet-facing services, IPS is a practical layer against exploit attempts, ransomware activity, command-and-control traffic, and attacks targeting unpatched systems. It should support your firewall policy, endpoint protection, patching, and user-access controls – not replace them.
Start with the traffic that creates real exposure
Before creating an IPS sensor, identify where threats are most likely to enter or spread. Internet-to-server traffic should receive the most attention, especially if your organization publishes web portals, VPN services, mail systems, or remote-access applications. Outbound traffic also deserves inspection because compromised endpoints often contact malicious infrastructure after an initial breach.
Internal segmentation policies are another priority. A flat network gives malware and unauthorized users more opportunity to move between departments, servers, and devices. Applying IPS inspection between user VLANs and critical server networks can help identify exploit attempts that perimeter-only security controls may miss.
A sensible starting scope usually includes inbound traffic to public-facing services, outbound traffic from user networks, traffic between users and critical servers, and remote-access connections where appropriate. The right coverage depends on your applications, bandwidth, FortiGate model, and acceptable level of inspection overhead.
Confirm your FortiGate prerequisites
IPS signatures rely on current FortiGuard intelligence. Confirm that the FortiGate appliance has an active FortiGuard subscription and can retrieve signature updates. A genuine, supported appliance with valid licensing matters here: an expired service bundle or unsupported unit may still pass traffic, but it will not provide current protection against newly identified threats.
Also verify that the FortiGate is running a stable, supported FortiOS version. Firmware upgrades should be planned, tested, and backed up rather than treated as a casual maintenance task. Configuration compatibility, feature behavior, and signature handling can change between releases.
Review system capacity before enabling deep inspection across every policy. IPS processing consumes resources, particularly on busy internet connections or when combined with SSL inspection, antivirus, web filtering, and application control. Check CPU, memory, session counts, and throughput during normal and peak periods. If the firewall is consistently operating near its limits, broad inspection may affect business applications and user experience.
Create an IPS sensor with a phased approach
An IPS sensor is the set of signatures and actions that FortiGate will use to inspect matching traffic. FortiGate includes predefined sensors, but many organizations benefit from creating a custom sensor for their environment. This makes it easier to document why particular signatures are enabled and to adjust them without changing a default profile.
Begin with high-confidence signatures that target critical or high-severity threats. FortiGate signature filters can be based on severity, operating system, protocol, application, or other characteristics. The goal is not to activate every signature immediately. The goal is to detect and stop the threats that are relevant to the systems you run.
For example, an organization with Windows servers, Microsoft 365, VPN access, and a public web application may prioritize signatures associated with Windows exploits, web-server attacks, SSL VPN vulnerabilities, and common command-and-control behavior. A business with industrial devices, legacy systems, or specialized software may need a more conservative policy because those environments can be sensitive to aggressive inspection.
Set new or uncertain signatures to monitor or log first when the potential for false positives is unclear. This creates evidence before enforcement. After reviewing normal traffic patterns, you can change confirmed high-risk signatures to block, reset, or another suitable action.
Apply the IPS profile to the correct firewall policies
Creating a sensor alone does not protect traffic. You must attach it to the relevant IPv4 or IPv6 firewall policy under Security Profiles. Apply it first to a limited set of well-understood policies rather than changing every rule at once.
For internet-facing server policies, IPS should generally be paired with restrictive source and destination controls. Do not use IPS as a reason to leave unnecessary ports open to the internet. Limit published services to required ports, restrict administrative access, use VPN where possible, and maintain server patches.
For outbound user traffic, attach the IPS profile to the policy that allows internal users to access the internet. This helps detect exploitation attempts coming from websites and suspicious traffic leaving compromised devices. If SSL inspection is not enabled, remember that IPS visibility into encrypted traffic may be limited. Deep SSL inspection can provide stronger inspection coverage, but it requires certificate deployment, privacy review, application testing, and a clear business policy.
When attaching IPS to internal segmentation rules, start with monitor mode for business-critical traffic. Older applications may use unusual protocols or depend on behavior that resembles an attack signature. Logging first gives your IT team the information needed to tune controls without disrupting operations.
Test safely before enforcing blocks
A controlled test is the difference between an IPS deployment and a guess. Record a baseline before enabling the policy: normal application response times, VPN behavior, server connectivity, and peak bandwidth use. After applying the profile, test the services that use the affected firewall rule.
Check that staff can reach business applications, remote users can connect as expected, and public services remain available. Review FortiGate logs for detected signatures, blocked sessions, affected source addresses, destination servers, and policy IDs. The policy ID is particularly useful because it shows where the inspection decision occurred.
If a signature flags legitimate traffic, do not disable the entire IPS profile immediately. First determine whether the alert relates to an expected application behavior, an outdated signature, misidentified traffic, or a genuine security concern. A narrow exception for a specific signature and policy may be appropriate. Broad exclusions are easier to create but leave more security gaps.
Tune alerts so the security team can act
An IPS system that produces thousands of unreviewed events is not providing meaningful protection. Configure logging for relevant security events and establish a review process. Critical and high-severity detections, repeated exploit attempts, and alerts involving public-facing systems should receive prompt attention.
Look for patterns rather than isolated events. Repeated attempts from multiple external addresses may indicate automated scanning. A single internal device generating outbound exploit or command-and-control alerts may require immediate endpoint investigation, network isolation, and credential review. An alert against an exposed application can also reveal a patching gap before it becomes an incident.
Keep a change record for sensor adjustments, exclusions, firmware upgrades, and policy changes. This helps IT teams explain why a rule exists and makes troubleshooting faster when applications change. It is especially valuable for organizations with compliance obligations or outsourced IT support.
Maintain IPS protection after deployment
IPS is not a one-time configuration. Threat signatures, business applications, remote-work patterns, and firewall software all change. Review IPS events regularly, confirm subscription status, and apply updates through a controlled maintenance process.
Periodic policy reviews are equally valuable. Remove firewall rules that are no longer needed, narrow overly broad services, and confirm that IPS profiles remain attached after network changes. If your organization adds a new cloud platform, branch office, public application, or VPN service, revisit the inspection design rather than assuming the existing policy covers it.
For organizations without dedicated security staff, local implementation and ongoing support can reduce the risk of missed updates, misconfigured profiles, or unnecessary downtime. Digital World Technology can help businesses select the right FortiGate model, deploy licensed security services, tune IPS policies, and maintain protection as the network grows.
A well-tuned IPS policy should be quiet during normal operations and decisive when real threats appear. Start with the services that matter most, validate every change, and let the evidence in your logs guide the next step.