IPS Add ip under Prevent

[charlie]

Hello,

I have the fw under IPS protection.

My customer request to modify the action for a single ip.
For all signature put this source ip under Prevent Action so override the action defined under the IPS general rule.
So I created an Exception with source "host ip" Protection/site/File/blade "n-A" service "Any" Action "prevent". It's correct?


Regards,

Christian

[Timothy_Hall]

By putting a Prevent in the Action field of a TP Exception as in your sample rule, the effect will be that any matched protections set for Prevent will still Prevent, and also any protections matched that are set for Detect will also now Prevent.  This exception will not apply to protections that are themselves set to "Inactive", as all an exception does is potentially change the final verdict it does not control which actual protections are enforced.