topic Re: Gateway properties - IPS - Does changing this setting take precedence over everything IPS relate in Firewall & Security Management

Gateway properties - IPS - Does changing this setting take precedence over everything IPS related?

supruzer1 — Mon, 16 Aug 2021 14:31:03 GMT

Hi Team,

Gateway Cluster Properties page: The IPS tab--> Activation Mode --> According to Threat Prevention policy or Detect only modes.

Does this setting take precedence to all the IPS configuration (inactive, detect, prevent) of signatures? Where is this setting described in the R80.30 Documentation?

Cheers!

Re: Gateway properties - IPS - Does changing this setting take precedence over everything IPS relate

Marcel_Gramalla — Mon, 16 Aug 2021 14:49:16 GMT

Hi,

you can find the information here: Threat Prevention R80.30 Administration Guide (checkpoint.com)

It actually only mentiones Anti-Bot and Anti-Virus but it's the same with IPS. When choosing "Detect Only" nothing is blocked but only logged and according to policy is obviously blocking traffic if you have configured it properly.

Re: Gateway properties - IPS - Does changing this setting take precedence over everything IPS relate

supruzer1 — Mon, 16 Aug 2021 14:57:30 GMT

Yes that's the issue> I can't find any related info on the IPS settings. There are many settings on that page also

Re: Gateway properties - IPS - Does changing this setting take precedence over everything IPS relate

G_W_Albrecht — Mon, 16 Aug 2021 15:00:05 GMT

It uses the configuration as follows: inactive is still inactive, detect stays detect (and is no good anyway, as it costs the same resources as prevent, but without much gain), and prevent gets changed to detect.

Re: Gateway properties - IPS - Does changing this setting take precedence over everything IPS relate

Timothy_Hall — Mon, 16 Aug 2021 15:54:26 GMT

As Gunter says setting "Detect Only" temporarily causes IPS protections set to Prevent to act like Detect. As mentioned in my IPS Immersion series this function was called "Troubleshooting Mode" in R77.30 and earlier, and may still be referred to by that name in some places.

Re: Gateway properties - IPS - Does changing this setting take precedence over everything IPS relate

supruzer1 — Mon, 16 Aug 2021 16:18:07 GMT

Thank you G_W. Sounds like Threat Emulation setting to Detect does the same thing here.
@ Marcel - The settings for Anti-Virus and Anti-Bot aren't on this page and I per G_W what he mentions makes sense as far as the Firewall properties settings are concerned. CP has settings everywhere for everything and not very intuitional. I would say for majority common administrators this becomes a major headache unless you have a dedicated team of pros, tons of money for TAC and a forgiving workplace.