topic Re: TP - Best Practices in Firewall and Security Management

TP - Best Practices

Matlu — Wed, 11 Jun 2025 15:50:36 GMT

Hello, Mates.

In VSX environments, the recommendation regarding enabling Threat Prevention Blades on all the VS's you have, is always going to depend on how ‘robust’ your main VSX box is?

Does enabling Threat Prevention “force” you to also enable HTTPS Inspection on your VS's or is this always optional?

Thanks for your recommendations.

Re: TP - Best Practices

the_rock — Wed, 11 Jun 2025 16:11:30 GMT

Hey bro,

I always tell people to follow this mentality "When in doubt, always leave default settings". If then, you notice any issues, you can tailor it as needed.

Andy

Re: TP - Best Practices

Lesley — Wed, 11 Jun 2025 18:17:53 GMT

You only enable IPS on VS0 for updates not to protect VS0. VS0 is for mgmt purpose

Should I enable IPS Software Blade on the VSX Gateway?

You must enable and configure the IPS Software Blade in these objects:

VSX Gateway or VSX Cluster (because VS0 handles contract validation for all Virtual Systems).

Applicable Virtual Systems.

To enable Anti-Bot, Anti-Virus, or IPS on Virtual Systems

Important:

Make sure the routing, DNS, and proxy settings for the VSX GatewayClosed or VSX ClusterClosed Members (VS0) are configured correctly.

You must enable and configure the Software Blades in these objects:

VSX Gateway or VSX Cluster (because VS0 handles contract validation for all Virtual Systems).

Applicable Virtual Systems.

Make sure the VSX Gateway or VSX Cluster and the applicable Virtual Systems can connect to the Internet.

Virtual Systems get updates through the VSX Gateway or VSX Cluster (VS0).

If the VSX Gateway or VSX Cluster fails to connect, each Virtual SystemClosed uses its proxy settings to get the updates from the Internet.

Regarding HTTPS inspection. Now you can run IPS without but you don't get the full inspection. The firewall cannot inspect traffic that is encrypted. Most traffic now is encrypted so it is quite important.

Re: TP - Best Practices

Matlu — Wed, 11 Jun 2025 18:28:31 GMT

To enable IPS/AB/AV blades, there are 2 ways?

Because I know people who enable these blades ‘Instance by Instance’ (VS x VS), but according to your explanation, I understand that I can enable the blades from the box as such (VS0) and this should ‘Replicate’ on all my VS's?

Is that the logic?

Re: TP - Best Practices

Lesley — Wed, 11 Jun 2025 18:34:27 GMT

If you want to use IPS on a VS you always enable it on VS0 and any other VS that you want to run IPS.

For example

VS0: IPS

VS1:No ips because internal fw

VS2: IPS enabled

You can attach a IPS profile on each VS, also VS0

Re: TP - Best Practices

Matlu — Wed, 11 Jun 2025 19:17:52 GMT

Does the IPS recommendation also apply to other blades, such as AB and AV?

Or AV/AB can be enabled on the VS's one needs, without the need to enable it also on VS0?

Re: TP - Best Practices

PhoneBoy — Wed, 11 Jun 2025 19:56:21 GMT

Yes, AB/AV should only be enabled on VSes where it is required.
Traffic is checked via ThreatCloud, so the VS needs Internet access.

Re: TP - Best Practices

Matlu — Wed, 11 Jun 2025 22:49:37 GMT

In general terms, does Threat Prevention make sense to be used in FW or VS's that have Internet access?

Because these blades, enabling them in FW that do not have Internet access, would not make sense, right?

Re: TP - Best Practices

the_rock — Wed, 11 Jun 2025 22:53:20 GMT

Personally bro, at least in my logical opinion, it makes total sense to use those blades on VS with Internet access and NOT use them on ones that dont have it. Its literally same method for regular quantum fws and truth be told, pretty much applies to any fw vendor out there.

Andy

Re: TP - Best Practices

Chris_Atkinson — Thu, 12 Jun 2025 00:00:03 GMT

HTTPS is not mandatory for TP but what the blades can see is limited to clear traffic without it same as any gateway.

IPS and TEX are the two blades I believe must be enabled also on VSO if to be used on other VS.

Re: TP - Best Practices

Lesley — Thu, 12 Jun 2025 07:38:39 GMT

Yes also needed on VS0

Anti-Bot and Anti-Virus

Click Here to Show This Section

When I enable the Anti-Bot / Anti-Virus Software Blade in the Virtual System object, should I also enable this blade in the VSX Gateway object?

Yes.

Because contracts validation and initialization of default updates parameters are performed from the VSX Gateway itself (context of VS0).