Found some traffic prevented by optimized profile although didn't use it as firewall IPS profile

[LeeBingKang]

Hi Guys,

Recently, i found out a weird symptom whereby there are some logs mentioned prevented because of using "Optimized" profile although my firewall is using a custom profile. Meanwhile, the firewall version is R81.20 latest recommended Jumbo Hotfix.

Hence, I'm here seek for you suggestion on this matter.

Thank you.

[Timothy_Hall]

That IPS protection/signature is a Core Activation (shield w/ firewall icon) instead of a ThreatCloud protection (shield icon).  Core Activations have their own separate profile not set by the Threat Prevention policy, the default one is "Optimized".  See here: https://community.checkpoint.com/t5/Threat-Prevention/Inspection-Settings/m-p/47720/highlight/true#M...

[LeeBingKang]

Hi Timothy Hall,

Thanks for your kind reply on my post. I got what you mean and below are some references for others to have a look in future.

[the_rock]

Maybe just as a quick check, under tab for ips profiles once in smart console, right click on each profile and see "where used"

Andy