Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Dznman
Participant

R80.30 Activating Anti-Bot/Anti-Virus detect only

Jump to solution

Hi,

I'm trying to activate Anti-Bot and Anti-Virus in Detect Only.
We already have IPS activated with Medium-/High-Confidance in Prevent Mode. To check what Traffic (AB/AV) would be prevented if activated in the same Policy, we've created a second Policy where only AB/AV are activ and all Confidance Levels set to Detect.

Sadly this does not work, as Threat Prevention only seems to use the first Policy or whichever Policy is highest. If the Policies are switched, then AV/AB works but IPS does'nt.

To summarize: Top Policy with IPS activated, Second/Bottom with AV/AB only. See Screenshot attached.

Thanks!

0 Kudos
1 Solution

Accepted Solutions
yalmog
Employee
Employee

Hi. Currently you use two rules. In this setup only the first rule will be matched / activated. To get the action you described, create a new layer (right-click on the policy on the left) and move the second rule to this new layer. Now both rules will be matched.

View solution in original post

7 Replies
yalmog
Employee
Employee

Hi. Currently you use two rules. In this setup only the first rule will be matched / activated. To get the action you described, create a new layer (right-click on the policy on the left) and move the second rule to this new layer. Now both rules will be matched.

the_rock
Champion
Champion

I believe what @yalmog said is actually correct. These rules don't work quite the same way as regular policy, so his suggestion makes sense.

0 Kudos
Timothy_Hall
Champion
Champion

What @yalmog said is correct, only one Threat Prevention rule per TP layer can be matched.  Here is some extra background on having more than one TP layer present from my IPS/AV/ABOT video course; this situation is not too common in my experience primarily because there could only be one TP layer prior to R80:

 tplayer1.pngtplayer2.pngtplayer3.png

 

"Max Capture: Know Your Packets" Self-Guided Video Series
available at http://www.maxpowerfirewalls.com
Dznman
Participant

Thank you for the Insight! We actually solved the Problem by just inserting AV/AB into the main policy, because it was able to activate AV/AB as detect only in the Cluster Properties.

0 Kudos
the_rock
Champion
Champion

What do you mean exactly by inserting av/ab into main policy? You cant really do that, as its threat prevention blade(s), so it would only work as per screenshot @Timothy_Hall posted.

0 Kudos
Dznman
Participant

My inital request was much simpler, it was to use AV/AB and IPS in the same policy, but have AV/AB detect only. Since it's possible to change the cluster Properties use: "Detect only" or "As Profile Settings", we didn't have to worry about AB/AV activated according to Profile Settings and preventing False Positives.

0 Kudos
the_rock
Champion
Champion

O yes, you have to make sure those settings are correct, agreed. I was more referring to the fact that you cannot use AV/AB blades in the main access control policy, as those are threat prevention blades.

0 Kudos