topic Re: IPS best practice in Firewall and Security Management

IPS best practice

Jon_Dyke — Thu, 23 Nov 2017 15:29:59 GMT

I am interested in how people use IPS in R80.10. In R77.30 we would go through the flagged list then set the relevant protections to detect for 7 days – we would then clear down the flags for the ones we do not set. We would then review the logs to make sure there is no impact to legitimate site traffic (we have a customer facing SAAS platform) then we would set the flagged detects to protect and push policy. We would then repeat the cycle over a two week period.

In R80.10 I am thinking I would need to do the following to emulate this:-

Set activation mode to Detect on high and medium confidence
Set Activate IPS protections according to the following additional properties and select the vendors we want.
Set newly update protections to activation detect in Staging
Download the IPS update and push policy
Review the logs filtered to staging protections after 7 days
Set any that are affecting legitimate traffic to inactive (or add an exception)
Set the rest to Prevent and push policy.

Repeat steps 4 -7

What do other people do?

Thanks

Jon

Re: IPS best practice

Tomer_Sole — Thu, 23 Nov 2017 15:48:07 GMT

Hi, in a few days we will publish an "IPS Best Practices in R80.10".

This document is a recommendation, of course any customer can do what he prefers. The document is in its final stages of review.

Regardless of the Check Point document, we are always interested to hear you guys' processes.

Re: IPS best practice

aner_sagi — Mon, 04 Dec 2017 09:47:04 GMT

hi tomer,

any news on this document ?

Re: IPS best practice

Tomer_Sole — Mon, 04 Dec 2017 10:11:13 GMT

delayed by a couple of days unfortunately.. we will update here.

in the meantime your thoughts on Jon's notes?

Re: IPS best practice

K__P__Kennedy — Wed, 10 Jan 2018 15:42:11 GMT

Any word on an update for the guide? Thanks!

Re: IPS best practice

Tomer_Sole — Fri, 21 Jun 2019 09:04:13 GMT

Apologize for the delays, please follow this thread - https://community.checkpoint.com/message/13840-r8010-ips-best-practices-guide