topic Re: IPS Protection - Scrambling in Firewall and Security Management

IPS Protection - Scrambling

Elias — Sat, 23 Dec 2023 16:49:46 GMT

Hi team, I search information about IPS protection Scrambling but , I find nothing, what does this DNS protection refer to?

Re: IPS Protection - Scrambling

Chris_Atkinson — Sun, 24 Dec 2023 11:51:52 GMT

From memory this relates to cache poisoning mitigations

https://sc1.checkpoint.com/documents/R80.20/SmartConsole_OLH/EN/html_frameset.htm?topic=documents/R80.20/SmartConsole_OLH/EN/kXUI5yDM8ekjxNgwPEM3Vw2

Refer also: sk35624, sk106246, sk107527

Re: IPS Protection - Scrambling

Timothy_Hall — Sun, 24 Dec 2023 13:26:19 GMT

Never enable this protection. Along with Network Quota and Small PMTU, enabling any of these will cause all traffic traversing the gateway to go F2F/slowpath!

Re: IPS Protection - Scrambling

Elias — Sun, 24 Dec 2023 16:29:05 GMT

Thank you

Re: IPS Protection - Scrambling

michaelgo — Thu, 29 Feb 2024 10:39:39 GMT

I do not want to sound rude, but why did you ask? The protection indicates critical performance impact together with low confidence and low severity which must be a very strong indication that you should never enable it for multiple reasons (see response from Timothy_Hall for example).

Re: IPS Protection - Scrambling

_Val_ — Thu, 29 Feb 2024 11:28:06 GMT

This is one of the legacy IPS features that should have been dropped ages ago. It is about manipulating some parameters of IP packet to scramble certain signs of the OS you are using. The last time it was relevant was in the early 90s of the last century.

As mentioned multiple times here, don't even think about enabling it 🙂