Technical Deep Dive Why Maintain Both Normal and V2 IPS Signatures in Check Point?

[WiliRGasparetto]

Check Point’s Intrusion Prevention System (IPS) is a core component of Threat Prevention, providing proactive protection against a wide range of network threats. Over time, the IPS engine and its signature formats have evolved, leading to the coexistence of "normal" and "version 2 (Ver 2)" signatures. This post explains the technical reasons for maintaining both, their architectural differences, and best practices for deployment.

IPS Architecture Overview

Check Point IPS uses a multi-layered detection engine:

• Passive Streaming Library (PSL): Reconstructs network streams for inspection.
• Protocol Parsers: Identify and separate protocols (HTTP, FTP, DNS, etc.) for context-aware analysis.
• Context Management Infrastructure (CMI): Determines which protections (signatures) apply to each protocol context.
• Pattern Matcher: The detection engine that uses signatures to identify malicious patterns.

IPS Inspection Flow Diagram

Traffic is processed through multiple analysis stages, with signatures applied at different protocol layers.

Normal vs. V2 Signatures: Technical Comparison

Feature	Normal Signature	V2 Signature (INSPECTv2)
Detection Engine	Classic Pattern Matcher	INSPECTv2 (advanced engine)
Coverage	Known threats	New threats, evasive techniques, improved accuracy
Performance	Lower resource usage	May require more CPU/memory, but optimized for accuracy
Compatibility	Legacy gateways	Modern gateways (R80+)
Update Frequency	Less frequent	Updated regularly

• Normal Signatures: Use traditional pattern matching, suitable for legacy environments and lower resource consumption.

• V2 Signatures: Leverage the advanced INSPECTv2 engine, supporting complex logic, context awareness, and better detection of modern threats.

Why Maintain Both Signature Types?

• Backward Compatibility: Some older gateways may not support V2 signatures. Keeping both ensures all devices remain protected.
• Redundancy: If a V2 signature causes issues (e.g., false positives), the normal signature can provide fallback protection.
• Gradual Migration: Allows administrators to test V2 signatures in "Detect" mode before fully switching from normal signatures.
• Maximum Coverage: Certain threats may only be detected by one signature type, so using both maximizes security.

Performance Considerations

• V2 signatures can be more resource-intensive due to deeper inspection and advanced logic.
• IPS Tuning: Administrators can enable/disable specific signatures or use different profiles for perimeter vs. internal gateways.
• Bypass Under Load: IPS can be configured to bypass traffic during high load to prevent bottlenecks, but this should be used cautiously.

Best Practices for Managing Signature Versions

1. Test in Staging: Always test new V2 signatures in a non-production environment.
2. Monitor Updates: Review IPS update notes and apply urgent protections as needed.
3. Separate Profiles: Use different IPS profiles for different gateway roles (e.g., perimeter vs. datacenter).
4. Monitor Logs: Watch for false positives/negatives and adjust protections accordingly.
5. Gradual Rollout: Deploy V2 signatures in "Detect" mode before moving to "Prevent."

Summary

• Normal signatures ensure compatibility and stability.
• V2 signatures provide enhanced detection and future-proofing.
• Maintaining both allows for a safe, flexible, and comprehensive security posture during transitions and upgrades.

References

• ATRG: IPS (sk95193)
• Threat Prevention Administration Guide (R81+)

[PedroMacena24]

Crushed it!

[WiliRGasparetto]

thk's bro

[the_rock]

So good, as always.

[WiliRGasparetto]

I had a good teacher who taught me how to make good posts.

[the_rock]

Im 100% sure it was NOT me 😂

[WiliRGasparetto]

Reconsider your concepts because it is indeed true, hehe.

[Timothy_Hall]

Thanks @WiliRGasparetto, the recommendation to keep both versions of a signature active did make it into the Check Point Threat Prevention Specialist class, but there wasn't a clear explanation for why.

[WiliRGasparetto]

Is the material already released? Is it version 81.20? If it hasn't been released, you can take the text and use it.

[ccsjnw]

Does anything need to be done to enable the V2 variant of IPS ?

We're running R82 with Jumbo Hot Fix Accumulator Take 60.

[the_rock]

I dont believe so. As long as blade is enabled and updated, you should be good to go.

[WiliRGasparetto]

exactly

[the_rock]

I wondered at one point if it had to be enabled, but since I could not find it anywhere, logically assumed it was enabled by default.

[WiliRGasparetto]

yes

[WiliRGasparetto]

Starting with Check Point version R82, the IPS Engine 2.0 (also called IPS version 2) is natively enabled in the system. In other words, it is not necessary to install any specific Jumbo Hotfix (such as Take 60) to activate or use the IPS Engine 2.0 in this version.

[asafebelo]

Congrats, Wili!! Excellent post

[WiliRGasparetto]

thank's bro 

[constant69]

Hello,

In the best practices for Managing Signature Versions, it is recommended to test V2 signatures in a non-production environment or to deploy them in Detect Mode.

I have a question that may sound a bit silly: how can a “V2 UP signature” be identified in SmartConsole?

In SmartConsole, I could not find any filters that allow sorting by IPS signature version.

And when I view the details of an IPS signature (as in the screenshot below of a recent signature), I cannot find any information indicating whether it is a Normal or V2 signature

Thank you in advance for your insights.

[WiliRGasparetto]

Your question is not silly at all! @constant69  Most people I know don't know how to see that.

A step-by-step guide on how to find version 2 in an IP signature.

You need to open the SmartConsole.

Go to Security Policies.

Then go to Threat Prevention.

Open Custom Policy.

In the lower-right corner, go to IPS Protections.

In the lower-left corner, go to ThreatCloud and select the checkbox.

At that point, you will need to look for the signature where you want to check version 2, or you can use the filter in the upper-left corner to filter by version 2, and you will see all available version 2 signatures.

From this stage, you can take whatever actions you prefer.

[constant69]

Hi @WiliRGasparetto 

Thank you very much for your detailed explanations on identifying new IPS signatures.

Regards

[WiliRGasparetto]

Yor Welcome

[WiliRGasparetto]

If you still have any questions, feel free to ask.

[Daniel_]

The link to "Threat Prevention Administration Guide (R81+)" is not working (for me). I get "Not found"

[WiliRGasparetto]

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_ThreatPrevention_AdminGuide/Topics...

[AlbertoThree]

Hi,

I have a question that is maybe a bit of topic, but maybe you have an answer to that.

I have some IPS Prevent logs, and some of them have a packet captures available, but not all of them, even though it is enabled.
My question is how can I find out which exact pattern triggered the IPS rule?

Kind regards,
Albert

[Timothy_Hall]

Only 1 packet capture per IPS protection is saved at any one time, unless you select the "Packet Capture" checkbox on the IPS protection itself (not just in the Track column of the TP policy).  You can examine exactly what pattern the IPS Protection is actually looking for by signing up here: sk182083: IPS Explorer

[AlbertoThree]

Hi,
I tried to 'apply' to get access to IPS Explorer, but I got this reaction:

My apologies, this is not an open feature, rather it is a legacy capability that exposes sensitive information and is therefore limited to a small number of customers under strict NDA agreements.

[Arthur_DENIS1]

Yep... same for me 😞

[WiliRGasparetto]

Yes. same for me

[AlbertoThree]

So if IPS Explorer is not available, what other means do we have to find out the exact pattern the IPS protection matched on?