topic Re: How packet flow works inside the IPS balde..? in Firewall & Security Management

How packet flow works inside the IPS blade..?

BeaconBits — Mon, 20 May 2019 03:07:27 GMT

Hello Everyone,

I am troubleshooting one of the issue that involve the IPS.

But I'm unable to understand the IPS behaviour in terms of packet flow inside the IPS blade.

Can anyone share the IPS structure in Checkpoint firewall?

The administrative document does not explain well instead of configuration.

Regards,

Danny — Sat, 18 May 2019 20:56:29 GMT

Nick_Doropoulos — Sat, 18 May 2019 21:53:19 GMT

Hi B,

I take it that you have already consulted the ATRG IPS document and that it has not provided you with the requested information.

Could you elaborate for us what is the exact problem you are facing please in case we can help?

Thanks.

Timothy_Hall — Sat, 18 May 2019 22:21:21 GMT

As far as IPS and its related features, it goes more or less like this in R80.10+:

1) Geo Policy Enforcement

2) Inspection Settings enforcement as part of Access Policy

3) Core Activations & ThreatCloud Protections early in the Threat Prevention policy

Please provide what problem you are looking to solve and the gateway version, as IPS is implemented quite differently in R77.30 and earlier.

Lari_Luoma — Sun, 19 May 2019 02:09:51 GMT

More technical, but still very simplified steps. Go ahead and read the IPS ATRG as recommended earlier.

Passive Streaming (PSL)
1. Re-ordering of packets
Unified Streaming and ASPII
1. US decides which parser will handle this traffic
2. ASPII decides which protections to run for this traffic
Protocol Parsers
1. Parse protocols for RFC compliance etc. and recognize contexts.
2. Inspection settings and core protections are executed here.
CMI
1. Receives contexts from parsers.
2. Executes relevant protections to traffic
3. Returns result to parsers

PhoneBoy — Mon, 20 May 2019 03:34:11 GMT