topic Re: IPS exception not working QS 1550 R81.10.07 in Spark Firewall (SMB)

IPS exception not working QS 1550 R81.10.07

ANANTADSULE — Sat, 16 Dec 2023 07:37:59 GMT

Hello everyone.

I have created Command injection IPS exception for anywheremail.qlc.co.in domain,but firewall is preventing traffic.Added above domain to URL allowlist as well.I want to bypass IPS only,not HTTPS inspection because it's business email service.

Check Point's 1550 Appliance R81.10.07 - Build 430

All subscriptions & licenses are valid,No errors in configload_status.

Re: IPS exception not working QS 1550 R81.10.07

Timothy_Hall — Sat, 05 Aug 2023 14:32:02 GMT

Command Injection is a Core Activation (not IPS ThreatCloud Protection) and as such general Threat Prevention exceptions do not apply to it. You need to add a Core Activation exception by editing the Command Injection protection itself and adding the exception there. If that doesn't work: sk171624: False positive drop for "SQL Injection" and "Command Injection" IPS protections

Re: IPS exception not working QS 1550 R81.10.07

Daniel_Cimpeanu — Tue, 19 Sep 2023 07:45:10 GMT

Hi Timothy,

Would this be valid for QLS250? I'm seeing the same behaviour, with traffic being dropped despite having an IPS exception.

Thanks,

Daniel

Re: IPS exception not working QS 1550 R81.10.07

G_W_Albrecht — Tue, 19 Sep 2023 09:06:09 GMT

Yes - this is IPS AND not specific to Spark SMB.

Re: IPS exception not working QS 1550 R81.10.07

pedro_filipe — Fri, 15 Dec 2023 10:26:08 GMT

Hey,

I am having the same problem with a 1570. Did you find a way to bypass this False Positive?

Regards

Re: IPS exception not working QS 1550 R81.10.07

ANANTADSULE — Sat, 16 Dec 2023 07:45:35 GMT

You need to create Threat prevention exception for Source-LAN,Destination-any,Protection - Command injection,Service-any,Action-Inactive.

As suggested by TAC.

The exception should apply to traffic from inside the organization to the outside. This protection is specifically for internal servers, so everything else should be excluded.