update IPS on R77.30 clusters

[Kamiar_Sh]

Hi , I have 3 cluster gateways managed by Gaia R77.30(complex network with 300 site-site VPNs and multiple server ) and I want to update IPS on each gateway and these are my questions:

1- what pre-requisite  needed before starting update?

2- what potential impact should I expect?

3-and how to troubleshoot if any impact happen ?

4-is there any backout plan ?

appreciate if you can share your experiences?

[G_W_Albrecht]

I would suggest a manual IPS Update to the SMS, followed by a policy install. If the GWs have experienced no issues during policy install in the past and the load during it is not high, this is the way to go.

[Lari_Luoma]

1. Check Point User Center credentials and Internet access from the SmartConsole machine needed in R77.30 (for manual IPS update). In R80.20 you can specify whether you want to run the manual update from SC-machine, management server or gateway. SmartEvent is highly recommended for IPS reporting and visibility.

2.To minimize impact and false positives it's recommended that when you first deploy IPS you enable it in detect-mode for a couple of weeks period. After this you analyze all possible IPS events using SmartEvent and tune the protections accordingly.

3. R77.30 has a special troubleshooting mode that will change all (most) protections into detect-mode. If you see that some legitimate traffic is dropping add an exception for it.

4. Backout plan is to enable troubleshooting (R77.x) or detect mode (in R80.x) and install policy.