topic Re: Threat Prevention Rule/Profile Matching in Firewall & Security Management

Threat Prevention Rule/Profile Matching

cdav — Thu, 17 Apr 2025 07:27:45 GMT

I have a custom threat policy with three rules defined for IDS purposes - no prevent. The rules have 3 different threat profiles:

one for high performance impact and below,
one for medium performance impact and below
one for low/very low performance impact.

Each rule has a different protected scope. The high performance impact profile is at the top and the low performance impact profile is at the bottom.

In the logs I see the low performance impact rule detecting high performance impact protections.

I do not understand why. Is anyone able to advise or should I raise with TAC?

Re: Threat Prevention Rule/Profile Matching

G_W_Albrecht — Thu, 17 Apr 2025 07:46:54 GMT

Better ask CP TAC for help - i can not see what you are trying to achieve and how ! If different GWs should have different IPS / TP policies, i can use a different profile for each GW. You sound as if the three profiles have the same target GW...

Re: Threat Prevention Rule/Profile Matching

cdav — Thu, 17 Apr 2025 08:25:05 GMT

Maybe I have misunderstood the use of threat profiles. The intention is to have different levels of inspection based on the performance impact.

E.g dev networks could have medium or below and production networks could have high or below. Each rule has a different protected scope.

Re: Threat Prevention Rule/Profile Matching

PhoneBoy — Thu, 17 Apr 2025 20:29:43 GMT

You understand the purpose of the Threat Profiles correctly.
TAC may be necessary to figure out why this is protection is firing.

Re: Threat Prevention Rule/Profile Matching

the_rock — Thu, 17 Apr 2025 23:18:44 GMT

I am fairly sure you understood how threat prevention works just right. Lots of people do it exactly that way. Personally, I would try disable ips blade, push policy, re-enable, push policy again. If that doe snot fix it, would open TAC case.

Andy

Re: Threat Prevention Rule/Profile Matching

Timothy_Hall — Fri, 18 Apr 2025 00:34:42 GMT

This "Sensitive Configuration File Disclosure" protection was created very recently on 4/14/2025. This may be a situation where the gateway automatically updated itself (if it is configured to do so), the gateway picked up this new signature in some network traffic and tried to log it, but there was a mismatch in the IPS database version between the two entities. This can cause some rather strange logs to appear that don't always make sense.

Re: Threat Prevention Rule/Profile Matching

cdav — Tue, 22 Apr 2025 06:32:10 GMT

thank you @Timothy_Hall @the_rock

Re: Threat Prevention Rule/Profile Matching

the_rock — Tue, 22 Apr 2025 10:31:23 GMT

Always welcome!