Difference between "Protected Scope" and "Destination"

[Ruben_Starkovsk]

Whats the difference between "Destination" and "Protected Scope" in the Threat Prevention policy and Global Exception rules and when would you use either?

[Daniel_Taney · Accepted solution]

I believe "Protected Scope" is used in the Threat Prevention policy to designate an entity that you want protected (i.e. a single host, group of hosts, network, etc...). It is my understanding that this applies the protections in the policy to those nodes whether the malicious traffic is inbound or outbound. 

Whereas "Destination" would only apply the rule to traffic headed outbound. 

[cosmos]

I would like to know what the official answer is from Check Point.... anyone?

[Timothy_Hall · Accepted solution]

Protected Scope means match/scan all traffic going to/from this object regardless of which way the connection was originally initiated, as generally we don't care about "directionality" for the process of Threat Prevention.  We most certainly do care about that in Access Control policies.

If however the hidden Threat Prevention Source/Destination policy fields are exposed then populated (they both default to Any), you are implying directionality for what you want to scan.  So if in your TP policy Source is "net1", Destination is Any, and Protected Scope is Any, only connections initiated from net1 and the replies will match that rule and be scanned via the associated profile.  Connections initiated from outside net1 into it will not match that TP rule at all for traffic in both directions.

I got this question a lot in various classes so here is the coverage of this topic from my 2021 IPS/AV/ABOT Video Series class:

[Thomas_Eichelbu]

Hello Team!

iam not sure if it best practice to open follow up question to very old posts, anyway.

Protected Scope vs SRC and DST in the TP Rulebase.
Does it have any Peformance implications?

currently iam working on a performace issue, CIFS traffic over 100Mbit line.
mostly we achieve 100Mbits throughout, sometimes not.


we have enabled all blades.

enabled_blades
fw vpn cvpn urlf av appi ips SSL_INSPECT anti_bot content_awareness mon zero_phishing

ISP redundancy is enabled
-> kills SXL

Zones are enabled on all interfaces
-> Kills SXL Templating

TP Profile with AV Deep and and even Archive Scan.
This are all settings which negatively affects SXL
ISP Redundancy sets all my traffic in slow path, but i think VPN is not affected by ISP Redundacy, at least i dont see any  VPN connections is slow path (checked with fw tab -t connections -z) 

we need to test more, but i think settings a policy with Protected Scope does alot harm for performance instead of using SRC & DST. Of Course when using SRC and DST and can narrow down on true use case.

so what is your performance related experiance Protected Scope VS SRC & DST policies?
second:
Protected Scope in the profile:
(Yes we enabled all blades and all functions, because We Secure The Internet and pay for it!)
setting Inspect incoming files from the following interface to ALL and Inspect incoming and outgoing  file is almost equel expect the outgoing part. but i think this settings kicks our performace down, even compared to Deep & Archive Scan.
also our TP Policy is based on SRC & DST and not on Protected Scope. Does this mess up somehow with the profile?

my impression is, when using Protected Scope it is slower, SRC & DST makes it faster.
but we need more tests to give it a clear picture.

Software is always the latest and greatest, R81.20 HFA84
3600 (100Mbit line)  and 3800 (300Mbit line) appliances

Any ideas?