topic Re: IPS Protection Overrides in Firewall and Security Management

IPS Protection Overrides

Steve_Pearson — Wed, 18 Dec 2024 11:03:38 GMT

I'm currently removing the legacy IPS layer from the policy on an R81.20 deployment.

In the summary section it shows "1 Override" (see attached), which appears to be a link, but when I click it I get a list of protections (either full list or filtered list)

So the question is, how do I find this 1 override, so that I can ensure I copy it to the new TP policy?

Thanks

Re: IPS Protection Overrides

AkosBakos — Wed, 18 Dec 2024 11:14:16 GMT

Hi Steve,

My first idea is this the Inspection Settings

And by the Threat Prevention policy

Check which one has been overridden.

Akos

Re: IPS Protection Overrides

Steve_Pearson — Wed, 18 Dec 2024 11:47:24 GMT

I've found it now but by manually scrolling through the list, as I couldn't see a way to get it to show me just the one with an override. Is there a way to do this, or is it always going to be a manual task?

Re: IPS Protection Overrides

AkosBakos — Wed, 18 Dec 2024 11:52:19 GMT

I haven't faced such kind of issue in my life. But if the link didn't work, it seems you should check it one-by-one. I hope the Legends will correct me, and I will learn something new again today. 🙂

The list is not too long.

Akos

Re: IPS Protection Overrides

Timothy_Hall — Wed, 18 Dec 2024 13:06:41 GMT

Just use the "User Modified" filtering checkbox under Activations to find them:

You can also undo all User Modification overrides at once under the Actions...Profile Cleanup menu:

Re: IPS Protection Overrides

AkosBakos — Wed, 18 Dec 2024 13:19:53 GMT

Not in vain, the legends. 🙂