Access policy matching and IPS autonomous

[Stephan_Lache]

Hey Checkmates,

i have a question regarding access policy matching in conjunction with IPS ( autonomous mode)

I have blocked traffic from an known malicious IP in an access policy.

I can see that the relevant traffic is dropped but nevertheless the traffic hits the IPS blade.

Is this a expected behavior?

I thought that no further inspection is going on, when the traffic is dropped by the access rule.

Thanks in advance

Stephan

[Chris_Atkinson]

Are you able to share a copy of the redacted log card for review, which protection is matched?

[Stephan_Lache]

I just found that transit traffic is dropped like expected and not hitting the IPS blade.

Traffic to the gateways seems to be handled different , as this is inspected by IPS.

[Chris_Atkinson · Accepted solution]

Yes most likely due to some implied rules.

[Stephan_Lache]

Thank you.