IPS - HTTP parsing error detected

[nabil_l]

Hello,

I am getting lots of log related to 

. Bypassing the request as defined in the Inspection Settings. in IPS Blage log. It is allowing the traffic.

Why its bypassing?

[the_rock]

How do you have geo policy defined? I see Nepal as dst country.

Andy

[nabil_l]

Hello,

I have implemented default Optimized cloned rule, all the setting are by default.

[the_rock]

That was not my question though. Im wondering how you have geo policy defined, ie are you using updatable objects for it? If not, what version is this and how is legacy geo policy defined? Can you send a screenshot?

Andy

[nabil_l]

I have not configured any geo policy . This is R81.10 version.

[nabil_l]

I have not define any geo policy for now, all coutry name is shown in IPS Blade log with their public IPs.

[nabil_l]

Above screenshot is from Server to One of the public client, IPS is detecting but is not taking any action and allowing to pass the traffic.

[the_rock]

I would see what remediation options it gives and follow that. Usually, inspection settings ALWAYS show as default, UNLESS you really want to protect further against ddos, then you set it to recommended. But again, this is DIFFERENT than optimized profile for IPS.

Andy

[nabil_l]

No any remediation available for this result as it has not detected any Attack Name, Protection Type, Protection Details. Is there is any way to block or inspect this type of Traffic i case any Event is detected by IPS Blade.

[the_rock]

 

[nabil_l]

Even after doing this still i am getting same bypass log.

[nabil_l]

When i click on Add Exception, it say This protection Doesnot support Exception.

[the_rock]

Then it has to be done via inspection settings.

[Timothy_Hall]

It is bypassing because you have fail-open (the default) set under Manage & Settings...Blades...Threat Prevention...Advanced Settings...General Settings...Fail Mode.  This setting still controls the Inspections Settings protections too even though they are part of the Access Control policy now (but didn't used to be). 

A situation occurred in which the inspection engine could not properly scan the traffic due to it being out of state, and the default behavior is to let it through.  Be careful about setting fail-close here since any traffic that cannot be properly scanned will be denied.  There are many, many situations that this can apply to that you may not be expecting, such as a password-protected zip file or a file larger than 150MB being encountered with certain types of inspection set.  These will start getting denied if you change this setting.

This setting is covered in the new Check Point Threat Prevention Specialist 2-day course, which was released to ATCs worldwide last month.  I recently ran this class for the first time and it got rave reviews for its detailed coverage of IPS (including Inspection Settings), AV, and ABOT.

[nabil_l]

Thank you for this info

[the_rock]

Honestly though, if I were you, I would still open TAC case about it.

Andy

[nabil_l]

Hello, I have opened TAC. Thank you for your sugessation.

[the_rock]

Well, thats default setting out of the box, but let @nabil_l confirm how its configured.

[nabil_l]

Hello, I have used default setting and not changed Fail Safe mode.  Failsafe mode is in bypass.

[the_rock]

You can try change it, but not sure it may make a difference, but worth a shot.

Andy

[nabil_l]

I cant try this, as it is production environment and cant take risk.

[emmap]

I've seen this before and it started with Chrome browsers enabled that hybridised kyber thing. We enabled some support for it in JHF take 150 but I've not been able to validate if this stops those IPS accepts. What JHF take do you have on that gateway?

[nabil_l]

JHF 130

[emmap]

If you can, it would be good to update to the current recommended JHF and see if that has an effect.