topic Re: R80.30 Activating Anti-Bot/Anti-Virus detect only in Firewall and Security Management

R80.30 Activating Anti-Bot/Anti-Virus detect only

Dznman — Fri, 28 Jan 2022 09:24:43 GMT

Hi,

I'm trying to activate Anti-Bot and Anti-Virus in Detect Only.
We already have IPS activated with Medium-/High-Confidance in Prevent Mode. To check what Traffic (AB/AV) would be prevented if activated in the same Policy, we've created a second Policy where only AB/AV are activ and all Confidance Levels set to Detect.

Sadly this does not work, as Threat Prevention only seems to use the first Policy or whichever Policy is highest. If the Policies are switched, then AV/AB works but IPS does'nt.

To summarize: Top Policy with IPS activated, Second/Bottom with AV/AB only. See Screenshot attached.

Thanks!

Re: R80.30 Activating Anti-Bot/Anti-Virus detect only

yalmog — Sun, 30 Jan 2022 21:00:56 GMT

Hi. Currently you use two rules. In this setup only the first rule will be matched / activated. To get the action you described, create a new layer (right-click on the policy on the left) and move the second rule to this new layer. Now both rules will be matched.

Re: R80.30 Activating Anti-Bot/Anti-Virus detect only

the_rock — Mon, 31 Jan 2022 00:01:10 GMT

I believe what @yalmog said is actually correct. These rules don't work quite the same way as regular policy, so his suggestion makes sense.

Re: R80.30 Activating Anti-Bot/Anti-Virus detect only

Timothy_Hall — Mon, 31 Jan 2022 12:32:49 GMT

What @yalmog said is correct, only one Threat Prevention rule per TP layer can be matched. Here is some extra background on having more than one TP layer present from my IPS/AV/ABOT video course; this situation is not too common in my experience primarily because there could only be one TP layer prior to R80:

Re: R80.30 Activating Anti-Bot/Anti-Virus detect only

Dznman — Mon, 31 Jan 2022 13:22:20 GMT

Thank you for the Insight! We actually solved the Problem by just inserting AV/AB into the main policy, because it was able to activate AV/AB as detect only in the Cluster Properties.

Re: R80.30 Activating Anti-Bot/Anti-Virus detect only

the_rock — Mon, 31 Jan 2022 13:36:50 GMT

What do you mean exactly by inserting av/ab into main policy? You cant really do that, as its threat prevention blade(s), so it would only work as per screenshot @Timothy_Hall posted.

Re: R80.30 Activating Anti-Bot/Anti-Virus detect only

Dznman — Mon, 31 Jan 2022 13:49:26 GMT

My inital request was much simpler, it was to use AV/AB and IPS in the same policy, but have AV/AB detect only. Since it's possible to change the cluster Properties use: "Detect only" or "As Profile Settings", we didn't have to worry about AB/AV activated according to Profile Settings and preventing False Positives.

Re: R80.30 Activating Anti-Bot/Anti-Virus detect only

the_rock — Mon, 31 Jan 2022 13:52:51 GMT

O yes, you have to make sure those settings are correct, agreed. I was more referring to the fact that you cannot use AV/AB blades in the main access control policy, as those are threat prevention blades.