An administrator wanted to configure an IPS sensor to block traffic that triggers a signature set number of times during a specific time period. How can the administrator achieve the objective?

Rate-based IPS blocking is configured under an IPS filter, where you specify how many times (rate-count) a signature may fire within a defined window (rate-expiration). To make the counter restart every window, you set rate-mode periodical. When the threshold is exceeded, the action defined in the filter (for example, block) is applied, thus preventing traffic that repeatedly triggers the signature in the chosen time period.

A. Group signatures have no rate-count / rate-expiration / rate-mode settings; they cannot enforce period-based thresholds.
B. Packet logging only records matching packets; it does not influence detection thresholds or blocking behaviour.
D. Duplicate of C in the list—only option C is needed once.

1. Fortinet

“FortiOS 7.4 CLI Reference – Intrusion Prevention

” section “config ips filter”

parameters: ratecount

rateexpiration

ratemode {periodical|continuous}

pp. 1700-1701.

2. Fortinet

“FortiOS 7.4 Administration Guide

” chapter “Intrusion Prevention System”

subsection “Rate-based signatures”

pp. 476-477.