Syslog packets dropped by IPS

fjulianom — Fri, 10 Mar 2023 11:17:08 GMT

Hi mates,

I have a problem with the IPS. I have configured the SMS to send logs to a SIEM server, and the IPS started blocking the syslog packets. So I added an exception defining the source, destination and service, and I tried with "Apply on the matched rule" and "Add to global exception group (apply on all rules)", and neither of them works, I still see this logs:

[Expert@fw1:0]# fw ctl zdebug + drop | grep "192.168.1.8"
@;1786452969;[vs_0];[tid_1];[fw4_1];fw_log_drop_ex: Packet proto=17 192.168.100.132:9271 -> 192.168.1.8:514 dropped by fw_spii_execute_inspections Reason: spii inspection matrix drop;
@;1786452969;[vs_0];[tid_1];[fw4_1];fw_log_drop_ex: Packet proto=17 192.168.100.132:9271 -> 192.168.1.8:514 dropped by fw_spii_execute_inspections Reason: spii inspection matrix drop;
@;1786452969;[vs_0];[tid_1];[fw4_1];fw_log_drop_ex: Packet proto=17 192.168.100.132:9271 -> 192.168.1.8:514 dropped by fw_spii_execute_inspections Reason: spii inspection matrix drop;
@;1786452969;[vs_0];[tid_1];[fw4_1];fw_log_drop_ex: Packet proto=17 192.168.100.132:9271 -> 192.168.1.8:514 dropped by fw_spii_execute_inspections Reason: spii inspection matrix drop;

I have only seen this post with no solution

https://community.checkpoint.com/t5/Threat-Prevention/fw-spii-execute-inspections-Reason-spii-inspection-matrix-drop/td-p/30071

Any ideas?

Regards,

Julián

Re: Syslog packets dropped by IPS

PhoneBoy — Fri, 10 Mar 2023 23:53:03 GMT

What is the precise log card for this?
Please post with sensitive data redacted.

In any case, you can try and disable the "Cisco IOS IPv4 Denial of Service" protection as mentioned here: https://support.checkpoint.com/results/sk/sk61542
Otherwise, I recommend a TAC case.

topic Syslog packets dropped by IPS in General Topics

Syslog packets dropped by IPS

Re: Syslog packets dropped by IPS