R77.30 IPS policy to R80.10

[Raymondn]

Hi there,

I just upgrade my Smart Center to R80.10.  The gateway is still R77.30.

My next step is to upgrade the gateway to R80.10.

My question is if there is something I need to do with the IPS policy.

My perception is that the current "IPS" under the "Threat Prevention - Policy" is for R77.30 gateway.

I should start to use the "Threat Prevention" screen for IPS policy on R80.10 gateway. 

Is this correct?

If so, does this mean once I upgrade my GW to R80, I should somehow ensure my IPS policy is in Threat Prevention screen, and disable the IPS rule under the "IPS" screen?  (see attached screen print for reference).

This may sound confusion.  The bottom line I want to know is if there is step I should do once I upgrade my GW to R80.10.

Thanks.

p.s.

In R77.30, I build individual IPS Protection profile for each of my gateway (e.g. DMZ-FW-Protection / VPN-FW-Protection / REMOTE-SITE-FW-Protection).  And now all these protection are listed in the IPS screen.  I suppose this is normal, right?  I expect that as I migrate the GW to R80, I will start deleting them, right?

[PhoneBoy]

What you should change for sure (or at least review) is the IPS Profile.

IPS Profiles are defined a little differently if you have customized it.

Otherwise you can start with the Optimized profile and customize.

You can change the Threat Prevention layer to include IPS once all R77.x gateways in your management have been upgraded to R80.x.

However it is not immediately required to do so.

[Daniel_Kavan]

I'm on R80.10 on both the manager and the gateway.   I have the IPS, AV, and AB in Threat Prevention and nothing in IPS.  I'm planning to add TE there as well.   So, it seems like the IPS policy doesn't have to be used at all in R80.10 (it can all be in Threat Prevention), correct?

Which one overrides if you have IPS AV and AB checked in both IPS and Threat Prevention profiles?

[PhoneBoy]

The IPS layer is for pre-R80 gateways.

If you have no pre-R80 gateways, then you don't need the IPS layer.

The layers are treated like ordered layers in the Access Policy (I.e. evaluated in the listed order).

[Tomer_Sole]

Hi, see:

What is the roadmap for Threat Prevention Policy management? 

https://community.checkpoint.com/message/8722-re-threat-prevention-policies-after-r7730-to-r8010-mig...