topic Re: Found some traffic prevented by optimized profile although didn't use it as firewall IPS profile in Firewall and Security Management

Found some traffic prevented by optimized profile although didn't use it as firewall IPS profile

LeeBingKang — Mon, 03 Mar 2025 08:16:26 GMT

Hi Guys,

Recently, i found out a weird symptom whereby there are some logs mentioned prevented because of using "Optimized" profile although my firewall is using a custom profile. Meanwhile, the firewall version is R81.20 latest recommended Jumbo Hotfix.

Hence, I'm here seek for you suggestion on this matter.

Thank you.

Re: Found some traffic prevented by optimized profile although didn't use it as firewall IPS profile

Timothy_Hall — Mon, 03 Mar 2025 13:07:52 GMT

That IPS protection/signature is a Core Activation (shield w/ firewall icon) instead of a ThreatCloud protection (shield icon). Core Activations have their own separate profile not set by the Threat Prevention policy, the default one is "Optimized". See here: https://community.checkpoint.com/t5/Threat-Prevention/Inspection-Settings/m-p/47720/highlight/true#M1231

Re: Found some traffic prevented by optimized profile although didn't use it as firewall IPS profile

LeeBingKang — Tue, 04 Mar 2025 07:54:59 GMT

Hi Timothy Hall,

Thanks for your kind reply on my post. I got what you mean and below are some references for others to have a look in future.

Re: Found some traffic prevented by optimized profile although didn't use it as firewall IPS profile

the_rock — Tue, 04 Mar 2025 18:59:39 GMT

Maybe just as a quick check, under tab for ips profiles once in smart console, right click on each profile and see "where used"

Andy