IPS Protection - Scrambling

[Elias]

Hi team, I search information about IPS protection Scrambling but , I find nothing, what does this DNS protection refer to?

[Chris_Atkinson · Accepted solution]

From memory this relates to cache poisoning mitigations

https://sc1.checkpoint.com/documents/R80.20/SmartConsole_OLH/EN/html_frameset.htm?topic=documents/R8...

Refer also: sk35624, sk106246, sk107527

[Elias]

Thank you 

[michaelgo]

I do not want to sound rude, but why did you ask? The protection indicates critical performance impact together with low confidence and low severity which must be a very strong indication that you should never enable it for multiple reasons (see response from Timothy_Hall for example).

[Timothy_Hall · Accepted solution]

Never enable this protection.  Along with Network Quota and Small PMTU, enabling any of these will cause all traffic traversing the gateway to go F2F/slowpath!  

[_Val_]

This is one of the legacy IPS features that should have been dropped ages ago. It is about manipulating some parameters of IP packet to scramble certain signs of the OS you are using. The last time it was relevant was in the early 90s of the last century. 

As mentioned multiple times here, don't even think about enabling it 🙂