Unable to remove IPS Shared Layer

[Dayaana]

Hi everyone! I am trying to investigate an environment that was upgraded from version 77.30 to version 81.10 some time ago. The environment is using MDS.

On one of the domains, I have encountered a problem that there is an IPS Shared Layer in Threat Prevention that cannot be removed.

I saw an article that relates to this case https://support.checkpoint.com/results/sk/sk129232, however there are no 77.30 devices in the environment right now.

Does anyone know how to resolve this issue? Any help would be appreciated!

[Amir_Senn]

What values do you have in the global assignments?

Is it similar to other domains?

[Dayaana]

Thank you very much for your answer! I will check it out

[the_rock]

If that does not work, I would say log in guidbedit and then search there and see if it can be removed that way.

Andy

[Dayaana]

Thank you very much for the advice!
Could you tell me in which section of GuiDBedit I can find information related to IPS shared layer? I tried to search for information about the layer by layer name, rule name in the layer and the word "IPS" and did not find any suitable objects. I even added a layer with a custom name (like ips_aaa) and added some rules to see if I'll be able to find them, but to no avail.

If I manage to find them, then simply deleting them and installing policy will be enough?

I would be very grateful for recommendations!

[the_rock]

Let me check it in the lab, after I create another test IPS layer.

Andy

[the_rock]

Hey,

So I tested in R81.20 lab and when I created new TP layer, installed policy, it did not find it in guidbedit, but it let me delete it from smart console. What happens if you try remove it from smart dashboard?

Andy

[Dayaana · Accepted solution]

Thank you very much for your reply! The problem was solved by clearing the IPS Shared Layer rules settings in Smartconsole, after which the layer was removed.

[the_rock]

Great job!