topic Re: IPS Core Protections in Firewall and Security Management

IPS Core Protections

Luis_Miguel_Mig — Tue, 11 Jun 2024 10:40:11 GMT

IPS core protections are installed via the access policy. However, even though you don't need a threat prevention and or IPS license, you need to activate the IPS blade, correct?

Re: IPS Core Protections

PhoneBoy — Tue, 11 Jun 2024 18:26:32 GMT

Not sure that's required since the entire reason they are enforced as part of Access Policy is because these protections are built into the firewall.

Re: IPS Core Protections

the_rock — Tue, 11 Jun 2024 18:33:47 GMT

I believe what Phoneboy said has been the case for a long time now actually.

Andy

Re: IPS Core Protections

Lesley — Tue, 11 Jun 2024 20:14:29 GMT

I think you can do it without IPS blade. You can attach the 'optimized setting' to a gateway that has no IPS blade enabled or license. Also same goes for GEO protection.

Re: IPS Core Protections

Luis_Miguel_Mig — Wed, 12 Jun 2024 09:51:00 GMT

Where can I find the optimized setting?
I guess I can try with no IPS blade but the policy type linked with the gateway needs to be both types access control and threat prevention, right?

Re: IPS Core Protections

the_rock — Wed, 12 Jun 2024 11:36:17 GMT

Re: IPS Core Protections

Luis_Miguel_Mig — Wed, 12 Jun 2024 12:12:19 GMT

Oh yeah, so you don't need to enable the IPS blade but you need to configure the policy as "threat prevention" policy type.
It feels a bit complex, because the policy contains all the IPS protections even though only the IPS core protections are expected to work without the IPS license. It would be nice if these 39 nine core protections were independent a bit like the inspection settings
Cool. Than you very much.

Re: IPS Core Protections

the_rock — Wed, 12 Jun 2024 12:19:37 GMT

Of course mate, any time, happy to assist. By the way, keep in mind, these core protections are super basic, specially if you are NOT using ips blade, I think thats been there since long time ago.

Andy

Btw, I have really good eve-ng and Azure cp labs, so if you need me to test anything, happy to do it.

Re: IPS Core Protections

Lesley — Wed, 12 Jun 2024 12:21:16 GMT

Indeed what the_rock posted as his last screenshot

Re: IPS Core Protections

the_rock — Wed, 12 Jun 2024 12:22:51 GMT

Reference link, though Im sure you had seen it already.

Andy

https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_ThreatPrevention_AdminGuide/Topics-TPG/IPS_Protections.htm#Editing_Core_IPS_Protections

Re: IPS Core Protections

Luis_Miguel_Mig — Wed, 12 Jun 2024 12:40:25 GMT

thanks. Yeah, I was aware of that way of filtering the core protections

Re: IPS Core Protections

the_rock — Wed, 12 Jun 2024 12:43:02 GMT

I figured you knew, since you said number 39, which is what shows there 🙂

Re: IPS Core Protections

Timothy_Hall — Thu, 20 Jun 2024 15:16:01 GMT

The 39 Core Activations exist in a kind of no man's land between Access Control & Threat Prevention, but everything stated in this thread is correct, you don't need the IPS feature enabled to use them. Core Activations have always been a bit confusing to deal with, and I'm happy to report that they are covered very nicely in the upcoming 2-day Threat Prevention Specialist course which should be released to Check Point ATCs worldwide later this month.

Re: IPS Core Protections

Luis_Miguel_Mig — Thu, 13 Jun 2024 15:08:23 GMT

Should the installation look like the file attached?
Threat prevention box available but not ticked.

Re: IPS Core Protections

Timothy_Hall — Thu, 13 Jun 2024 15:32:30 GMT

Right you don't need Threat Prevention ticked.

Re: IPS Core Protections

the_rock — Thu, 13 Jun 2024 16:01:02 GMT

All you need to remember is this...core protection will be ACTIVE, regardless if you have ips enabled. or install or not TP policy.

Andy

Re: IPS Core Protections

Luis_Miguel_Mig — Fri, 14 Jun 2024 11:17:05 GMT

But the problem is that I can't assign my gateway neither a threat prevention profile or a IPS Core Protection Profile.

I wonder if it has something to do with an Threat Prevention Layer generated by the system called IPS layer assigned (with 0 rules - coming from a migration from r77) and it is not used by it still exists

Re: IPS Core Protections

the_rock — Fri, 14 Jun 2024 11:33:52 GMT

If you are allowed to do remote, Im sure we can figure it out quickly. Make sure policy editor looks something similar to below.

Andy

Re: IPS Core Protections

Luis_Miguel_Mig — Fri, 14 Jun 2024 11:53:18 GMT

I have just enabled the IPS blade and all of the sudden I can assign the IPS core protections profile.
So it seems like the IPS blade needs to be enabled even though the policy installation goes through the access policy.

Re: IPS Core Protections

Luis_Miguel_Mig — Fri, 14 Jun 2024 11:55:03 GMT

Thanks Andy, I managed to configured it but with IPS blade enabled on the gateway.
There is no way to configure it IPS blade is not enabled as far I can see