topic Re: Threat Prevention policy configuration when HTTP emulation on Private Cloud Appliance in Firewall and Security Management

Threat Prevention policy configuration when HTTP emulation on Private Cloud Appliance

Chinmaya_Naik — Thu, 26 Sep 2019 07:26:43 GMT

Hi Team,

Pls help me for the configuration.

As per the Diagram, we have Gateway with TE Appliance.

So basically we are using TE appliance only for emulation, not for extraction, ThreatExtraction happening on Gateway.

So for any file we are download from the Internet then first come to the gateway then gateway sends that file to TE for emulation then TE gives the verdict to Gateway then gateway sends the file to the end-user base on the policy. Correct me I am wrong.

I need a clear idea about configuration and working.

Is this required to set Threat Prevention policy as Detect mode in TE Policy Package 2 ?

If I enable Threat Extraction on TE policy package 2 then?

@Chinmaya_Naik

Re: Threat Prevention policy Configuration when HTTP emulation on Private Cloud Appliance

FedericoMeiners — Mon, 23 Sep 2019 16:13:13 GMT

@Chinmaya_Naik

Your diagram and notes seem correct. I would recommend to set the policy on detect the first few days so you can see how it works.

Another important part is to decide the file extensions that you will be checking and if you want to go with a fail open or fail close policy for your emulations.

Regards,

Re: Threat Prevention policy Configuration when HTTP emulation on Private Cloud Appliance

Chinmaya_Naik — Thu, 26 Sep 2019 06:13:01 GMT

Hi @FedericoMeiners

Thanks for the quick response.

I need to understand which one is the best practise to "set TE policy package threat prevention profile mode as DETECT or Prevent".

I also need to understand, as per my current scenario If am enable the Threat Extraction on TE policy package threat prevention profile then?

Regards

@Chinmaya_Naik

Re: Threat Prevention policy configuration when HTTP emulation on Private Cloud Appliance

G_W_Albrecht — Thu, 26 Sep 2019 07:08:40 GMT

I must confess that your diagram confuses me ! I have a similar (LAB) configuration with a single GW instead of a cluster and a local TE appliance. But i have configured it differently:

- My TE has only FW and TE blades enabled - i see no point in enabling ABot and AV in both GW and TE. As the GW AV will check the hash before sending to TE, AV on TE seems useless.

- TE does three passes for a verdict and the sums it up. There is no confidence level involved here, as the GW will send according to File Type and size only to TE and TX

Re: Threat Prevention policy configuration when HTTP emulation on Private Cloud Appliance

Chinmaya_Naik — Thu, 26 Sep 2019 08:31:21 GMT

Hi @G_W_Albrecht

Thanks for the update. I updated my diagram.

So basically you mean to say that, there not required to create a separate policy package for TE appliance.

So when I will install the Threat prevention policy on standard policy package then it needs to select the TE object as well? ,

Correct me If I am wrong.

Regards

Chinmaya_Naik

Re: Threat Prevention policy configuration when HTTP emulation on Private Cloud Appliance

G_W_Albrecht — Thu, 26 Sep 2019 08:54:35 GMT

No - i have a separate TP policy for GWs (with enabled AV, ABOT, IPS and TE on remote appliance) and for TE (only TE enabled with local emulation).

Re: Threat Prevention policy configuration when HTTP emulation on Private Cloud Appliance

G_W_Albrecht — Thu, 26 Sep 2019 10:43:26 GMT

What is important for your configuration:

Cluster

Threat Emulation local cache is not synchronized.

See sk114806: ATRG: Threat Emulation and sk102309 - Threat Emulation support for Multiple Private Cloud Appliances.

Re: Threat Prevention policy configuration when HTTP emulation on Private Cloud Appliance

Chinmaya_Naik — Thu, 26 Sep 2019 10:55:22 GMT

Hi @G_W_Albrecht

Thanks for the update.

Find the below screenshot.

As last screenshot , this is what I need to know that what I need to set on Activation Mode.

Still, I am not face any issue, I need to understand the proper configuration because I see some different configuration on two different places but still both are working.

Thank You

Chinmaya Naik

Re: Threat Prevention policy configuration when HTTP emulation on Private Cloud Appliance

Chinmaya_Naik — Tue, 20 Oct 2020 16:53:03 GMT

Hi Team,

Pls give me a clarification on this.

Thanks and Regards

@Chinmaya_Naik