topic Threat Prevention - IPS policy in Firewall and Security Management

Threat Prevention - IPS policy

carl_t — Thu, 19 May 2022 08:40:17 GMT

Hi All

Can anyone clarify for me the below

1.Under the Threat Prevention, I see IPS and threat prevention layers, yet IPS is enabled on the Threat Prevention profile anyway.

Is the IPS layer just there for pre R80 or R77 software from when it was upgraded and is no longer needed?

2.Under the Threat prevention rule, if we click on the arrow, we get E-1.1 etc, are these just all the exceptions which also can be accessed under the Exceptions menu also?

cheers

Re: Threat Prevention - IPS policy

PhoneBoy — Fri, 20 May 2022 01:28:48 GMT

If you don’t manage any pre-R80 gateways, you can remove the IPS layer.

The Threat Prevention exceptions may or not be listed as rules in the policy as the policy can be more granular.

Re: Threat Prevention - IPS policy

Timothy_Hall — Fri, 20 May 2022 12:41:27 GMT

To further expand on what PhoneBoy said, here is the relevant page from my IPS/AV/ABOT video series that fully explains the Legacy IPS layer and how to get rid of it: