Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Rabindra_Khadka
Contributor

Why is the traffic accept by IPS blade where as there is no any accept policy of IPS blade

 

Dear Team,

 

I am very surprise by this log, In my threat prevention policy there is either prevent, detect or inactive action define but i am getting accept log by IPS blade, i was not expecting this kinds of logs. Can anyone please tell me about this issue.

 

What can be the reason that the traffic inspection by IPS comes with accept action.

Please look on the screenshot attachment.

0 Kudos
1 Reply
Timothy_Hall
Champion
Champion

You have something set to fail open in the event of an internal error (HTTP parsing error in your case), check these screens in the SmartConsole:

  • Manage & Settings...Blades...Threat Prevention...Advanced Settings...Fail Mode (most likely candidate due to the IPS blade reference)
  • Manage & Settings...Blades...Application Control & URL Filtering...Fail Mode
  • Manage & Settings...Blades...Content Awareness...Fail Mode
  • HTTPS Inspection Configuration (in SmartDashboard): HTTPS Inspection...HTTPS Validation...Fail Mode

Despite what the message says, I don't see any "Fail Mode" options in any of the Inspection Settings visible in the SmartConsole, unless it is referring to some kind of kernel variable that is not exposed in the SmartConsole.

 

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events