topic Re: How to check if IPS is inspecting a particular traffic flow? (or any blades for that matter) in General Topics

How to check if IPS is inspecting a particular traffic flow? (or any blades for that matter)

Parabol — Wed, 21 Feb 2024 15:39:35 GMT

Hi all, we are trying to ascertain whether IPS specifically is inspecting a particular traffic flow, as we're having a throughput issue. The User is not experiencing the expected throughput between two IP addresses, and we're trying to understand if the firewall/IPS is influencing this.

I tried playing around with the fw monitor command with various flags, I don't see anything to indicate IPS is inspecting it.

Presumably IPS logs in SmartConsole should be visible when filtering on these IP's too if it was being inspected?

Is there any other checks I can do to be sure what inspection is being performed on the flow?

Or any other tips you could suggest when troubleshooting throughput between two IP's that I could perform would be appreciated!

Thanks

Re: How to check if IPS is inspecting a particular traffic flow? (or any blades for that matter)

the_rock — Wed, 21 Feb 2024 15:53:43 GMT

This is normally how I would check.

Best,

Andy

Re: How to check if IPS is inspecting a particular traffic flow? (or any blades for that matter)

Lesley — Wed, 21 Feb 2024 19:51:51 GMT

If the blade is on then there is "always" an IPS check. It is on quotes because it is mistaken that if you dont see IPS logs IPS is not doing anything. If you want more performance and no IPS check, it would be best to configure fastaccel for this IP

fastaccel: https://support.checkpoint.com/results/sk/sk156672

But for fastaccel to work you need to exclude the traffic from IPS!

You can also consider to disable IPS for a second and see what it does for the traffic:

on CLI: ips off -> ips on