topic Re: Access policy matching and IPS autonomous in Firewall and Security Management

Access policy matching and IPS autonomous

Stephan_Lache — Sun, 07 Aug 2022 10:17:04 GMT

Hey Checkmates,

i have a question regarding access policy matching in conjunction with IPS ( autonomous mode)

I have blocked traffic from an known malicious IP in an access policy.

I can see that the relevant traffic is dropped but nevertheless the traffic hits the IPS blade.

Is this a expected behavior?

I thought that no further inspection is going on, when the traffic is dropped by the access rule.

Thanks in advance

Stephan

Chris_Atkinson — Sun, 07 Aug 2022 10:00:40 GMT

Are you able to share a copy of the redacted log card for review, which protection is matched?

Stephan_Lache — Sun, 07 Aug 2022 10:21:49 GMT

I just found that transit traffic is dropped like expected and not hitting the IPS blade.

Traffic to the gateways seems to be handled different , as this is inspected by IPS.

Chris_Atkinson — Sun, 07 Aug 2022 10:57:29 GMT

Yes most likely due to some implied rules.

Stephan_Lache — Mon, 08 Aug 2022 07:21:17 GMT

Thank you.