IPS/ThreatProtection SK hunt

[Jerry]

hi mates

can you give me some more details on the settings ... IT Sec guys want to know what "Block SIP Early Media " or "Block Unrecoverable H.323 Inspections Errors " means ...

some of them are self explanatory ... but not all ... do you know if there is a list describing this more in detail?

Cheers and thanks in advance 🙂

[G_W_Albrecht]

If it is VoIP look into this one: sk95369: ATRG: VoIP

Also very deep: sk103766: List of IPS Protections removed in R80.x

[Jerry]

not only voip, my customer wants to know if CP has an SK which outline in detail all the features of the IPS/TP (Recommended Protection) in general, like a full guide of what is what 🙂 I know it is a lot but I've lost a plot where I can find that SK ...

[Jerry]

ATRG: IPS sk95193

Threat Prevention Administration Guide
https://sc1.checkpoint.com/documents/R80.30/WebAdminGuides/EN/CP_R80.30_ThreatPrevention_AdminGuide/...

[G_W_Albrecht]

A lot of explanations can be found here: sk103657: Best Practices - IPS

If you want an inside peek into current IPS, you have to copy the SQL IPS database and open it with a tool...