topic Re: ips tuning in Firewall and Security Management

ips tuning

FW-VPN-ITALY — Sat, 06 Feb 2021 18:22:02 GMT

Hello, I received a request from a customer to perform IPS tuning on Checkpoint. Currently the customer has only one rule with the IPS profile active. In my opinion two rules should be created with two distinct ips profiles to divide the traffic according to the direction. One for inbound traffic and the other for outbound traffic . What do you think about my idea ? What do you recommend?

I've read the checkpoint best practices but they don't say much about how to proceed. Tips ?

Re: ips tuning

PhoneBoy — Sat, 06 Feb 2021 21:52:46 GMT

No real benefit to doing that since the protections are largely directional already and you’re likely doing App Control/URL Filtering as well, which use the same engines as IPS.
It might help to know the starting point you’re at (what profile you’re using, what version/JHF you’re at).

You can see what signature is using the most CPU with this tool: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk43733&partition=Advanced&product=IPS,
However, I wouldn’t do that until do some more fundamental tuning of system performance, including possibly changing the snd/fwk mix.
But start with the Super Seven commands: https://community.checkpoint.com/t5/Scripts/S7PAC-Super-Seven-Performance-Assessment-Commands/td-p/40528

Re: ips tuning

Chris_Atkinson — Sun, 07 Feb 2021 05:02:27 GMT

What are your tuning objectives. Are you tuning for security, performance or a balance of both?

TailoredSafe (sk164812) and the IPS Analyzer Tool might be helpful:

Refer:

https://community.checkpoint.com/t5/Infinity-Threat-Prevention/IPS-Analyzer-Tool-How-to-analyze-IPS-performance-efficiently/m-p/96140#M2880

Re: ips tuning

Timothy_Hall — Sun, 07 Feb 2021 14:12:07 GMT

As Chris said TailoredSafe and the IPS Analyzer Tool will be very helpful here. IPS optimization was also covered in my Max Power 2020 book (pages 352-369), but the tuning techniques documented there are a bit of a manual slog compared to these newer tools doing a lot of the heavy lifting for you. There is also some coverage of this topic in my IPS Immersion Course including the so-called "null profile" trick; IPS is definitely one of those blades that can be a bit intimidating to work with at first due to the sheer number of IPS protections...