- Products
- Learn
- Local User Groups
- Partners
- More
Welcome to Maestro Masters!
Talk to Masters, Engage with Masters, Be a Maestro Master!
Join our TechTalk: Malware 2021 to Present Day
Building a Preventative Cyber Program
Be a CloudMate!
Check out our cloud security exclusive space!
Check Point's Cyber Park is Now Open
Let the Games Begin!
As YOU DESERVE THE BEST SECURITY
Upgrade to our latest GA Jumbo
CheckFlix!
All Videos In One Space
Hi , I have 3 cluster gateways managed by Gaia R77.30(complex network with 300 site-site VPNs and multiple server ) and I want to update IPS on each gateway and these are my questions:
1- what pre-requisite needed before starting update?
2- what potential impact should I expect?
3-and how to troubleshoot if any impact happen ?
4-is there any backout plan ?
appreciate if you can share your experiences?
I would suggest a manual IPS Update to the SMS, followed by a policy install. If the GWs have experienced no issues during policy install in the past and the load during it is not high, this is the way to go.
1. Check Point User Center credentials and Internet access from the SmartConsole machine needed in R77.30 (for manual IPS update). In R80.20 you can specify whether you want to run the manual update from SC-machine, management server or gateway. SmartEvent is highly recommended for IPS reporting and visibility.
2.To minimize impact and false positives it's recommended that when you first deploy IPS you enable it in detect-mode for a couple of weeks period. After this you analyze all possible IPS events using SmartEvent and tune the protections accordingly.
3. R77.30 has a special troubleshooting mode that will change all (most) protections into detect-mode. If you see that some legitimate traffic is dropping add an exception for it.
4. Backout plan is to enable troubleshooting (R77.x) or detect mode (in R80.x) and install policy.
About CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY