topic Re: any sources scanning and attack to my network in Firewall and Security Management https://community.checkpoint.com/t5/Firewall-and-Security-Management/any-sources-scanning-and-attack-to-my-network/m-p/3624#M14168 <HTML><HEAD></HEAD><BODY><P>You can make the automatic reaction in this case a script that executes fw samp to block the IP address.</P></BODY></HTML> Wed, 21 Jun 2017 13:29:32 GMT PhoneBoy 2017-06-21T13:29:32Z any sources scanning and attack to my network https://community.checkpoint.com/t5/Firewall-and-Security-Management/any-sources-scanning-and-attack-to-my-network/m-p/3621#M14165 <HTML><HEAD></HEAD><BODY><P>any sources scanning and attack to my network. &nbsp;they are always replacing source address. &nbsp;how can i block or prevent for them?&nbsp;</P><P></P><P>i want below 2 ways prevention.&nbsp;</P><P></P><P>1. if first time detect any infect source ip then i will automatically block 1 hour or 24 hours</P><P>2. i want block or prevent for risk level.&nbsp;</P></BODY></HTML> Tue, 20 Jun 2017 03:03:41 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/any-sources-scanning-and-attack-to-my-network/m-p/3621#M14165 batmunkh_unubuk 2017-06-20T03:03:41Z Re: any sources scanning and attack to my network https://community.checkpoint.com/t5/Firewall-and-Security-Management/any-sources-scanning-and-attack-to-my-network/m-p/3622#M14166 <HTML><HEAD></HEAD><BODY><P>Presumably you could write a script to watch logs and/or use triggers in SmartEvent to do this, depending on your definition of an "attack."</P><P>However, this could be especially problematic for non-TCP traffic, as that's trivial to spoof and could open yourself up to a denial of service.</P></BODY></HTML> Tue, 20 Jun 2017 05:05:04 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/any-sources-scanning-and-attack-to-my-network/m-p/3622#M14166 PhoneBoy 2017-06-20T05:05:04Z Re: any sources scanning and attack to my network https://community.checkpoint.com/t5/Firewall-and-Security-Management/any-sources-scanning-and-attack-to-my-network/m-p/3623#M14167 <HTML><HEAD></HEAD><BODY><P>for example my ips critical signatures first time detected then after can i block this detected source by schedule? is it possible? plese see below picture right?</P><P><IMG alt="" class="image-1 jive-image j-img-original" src="https://community.checkpoint.com/legacyfs/online/checkpoint/57084_ips.png" style="width: 620px; height: 366px;" /></P></BODY></HTML> Wed, 21 Jun 2017 12:11:14 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/any-sources-scanning-and-attack-to-my-network/m-p/3623#M14167 batmunkh_unubuk 2017-06-21T12:11:14Z Re: any sources scanning and attack to my network https://community.checkpoint.com/t5/Firewall-and-Security-Management/any-sources-scanning-and-attack-to-my-network/m-p/3624#M14168 <HTML><HEAD></HEAD><BODY><P>You can make the automatic reaction in this case a script that executes fw samp to block the IP address.</P></BODY></HTML> Wed, 21 Jun 2017 13:29:32 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/any-sources-scanning-and-attack-to-my-network/m-p/3624#M14168 PhoneBoy 2017-06-21T13:29:32Z