topic Re: Threat policy on internal traffic in Firewall and Security Management

Threat policy on internal traffic

LostBoY — Sun, 28 Jun 2020 15:28:31 GMT

Hello,

Does threat policy which has ips,antobot and antivirus blades apply to exterbal traffic only or internal traffic also ?

Does it apply to both internal and external traffic automatically aur any configuration is requires

Thanks

Re: Threat policy on internal traffic

PhoneBoy — Sun, 28 Jun 2020 21:44:53 GMT

Your precise threat policy determines what protections are applied when.
Anti-Bot in general only applies to the Internet as that’s where the related threats are.
IPS and AV can potentially apply to internal traffic also.

Re: Threat policy on internal traffic

HristoGrigorov — Mon, 29 Jun 2020 03:49:11 GMT

You need to have topology properly defined and then in profile's AV settings there is an option to choose which traffic to inspect.

Re: Threat policy on internal traffic

LostBoY — Mon, 29 Jun 2020 10:33:28 GMT

Thanks for the reply... i found that section in the AV section ..however can i enable such setting for IPS as well ?

Re: Threat policy on internal traffic

LostBoY — Mon, 29 Jun 2020 10:34:49 GMT

Thanks for the reply...i found the section in AV tab where i can define whether i want to inspect AV on DMZ/External or all interfaces.. however i cant see any such setting for IPS ..is it implied that IPS automatically inspects all interface traffic ?

Re: Threat policy on internal traffic

PhoneBoy — Tue, 30 Jun 2020 00:27:35 GMT

This should happen for IPS unless your precise Threat Prevention policy layer(s) say otherwise.