FortiGuard IPS is often applied per policy. If the firewall allows other services:
Limitation: A properly configured FortiGate applies IPS to all traffic, regardless of port. FortiGuard IPS is often applied per policy
IPS signatures look for patterns. Change the pattern, and you may slip through. Limitation: A properly configured FortiGate applies IPS to
nmap --mtu 32 -f <target>
Small fragments may cause the IPS to miss a malicious signature that would be caught in a full packet. Small fragments may cause the IPS to miss