topic Does Threat-Prevention exception inherit DNS-Trap property of profiles in Firewall and Security Management

Does Threat-Prevention exception inherit DNS-Trap property of profiles

robin_van_royen — Thu, 22 Jul 2021 10:40:02 GMT

Hello,

The title of this post already expresses my question pretty well.
I have a situation where I must maintain visiblity for the "Reputation Domains" protection of a few specific servers, without it triggering the Malware DNS-Trap for those specific servers only.

I have possible solutions in mind such as creating a copy of the profile, disabling DNS-trap on it, and putting the servers only under this new profile. But those feel like sloppy solutions with too much ugly configuration to be justified.

Which brings me to my question, If I were to create an exception bound to this profile with the action detect. Will the DNS trap still be triggered as it would use the parameters of the profile?
One step further, if I were to include it in a global exception, would it also inherit the action? Because the global exception sort-off appends an exception but to every existing profile, I'd expect the same behaviour as with an exception to a profile specifically.

Thanks in advance for your input.

Running R80.40 on Quantum 15400 appliances

Re: Does Threat-Prevention exception inherit DNS-Trap property of profiles

PhoneBoy — Sun, 25 Jul 2021 02:20:19 GMT

As far as I know, exceptions for this specific protection should work.
That said, we do log as detect even when it's preventing prior to R81.
See: https://community.checkpoint.com/t5/Threat-Prevention/Threat-Prevention-is-Not-Block-DNS-Reputation-Which-Policy-Are/m-p/27139#M818

Re: Does Threat-Prevention exception inherit DNS-Trap property of profiles

robin_van_royen — Mon, 26 Jul 2021 07:09:27 GMT

Thank you very much for the feedback.

I have tried the detect rule, and it works like a charm. Now resulting in "action: exception". Also good to know that this categorization as detect is changed for R81.