topic IPS exceptions in Firewall and Security Management

IPS exceptions

carl_t — Wed, 02 Oct 2019 16:01:01 GMT

Hi All

Can anyone talk to me about the IPS exceptions on the R80 Firewall.

If you want to create an exception, you generally apply it to whatever policy you have on applied to the Firewall.

What are the Core exceptions?

Also if we bypass certain things, I am guessing this doesn't get scanned at all?

Many thanks

Re: IPS exceptions

PhoneBoy — Wed, 02 Oct 2019 18:16:34 GMT

For R80+ gateways, apply the exceptions as part of the Threat Prevention policy applied to the gateway.
Because of where they are enforced in the product, there are ~40 protections that are considered "Core Protections" and must be handled differently.
See: https://community.checkpoint.com/t5/IPS-Anti-Virus-Anti-Bot-Anti/Exceptions-on-IPS-Core-Protections/m-p/63103#M1822

For Core Protections, an Exception means "don't look for or block on this traffic."
For all other IPS protections, it depends on what you set the override to.