FTP Bounce prevent instead of inactive ?

[Arthur_DENIS1]

Hi,

I get an issue with an IPS on the customer environment.

We have a global rule with parameters with Prevent mode.

I would like to make an exception on smtp flow to Exchange server, and put this exception to Detect mode.

However, instead of the Detect mode configuration, I get a prevent...

If I put the same rule in inactive mode, this is inactive.

Someone can explain me this behavior ?

I have already open a ticket to TAC, but nothing for now....

Thanks for your help guys!

Arthur

[Stefane_LE_CALL]

Hello

same issue for me (but not tested the "inactive" mode yet), in R80.10

Did yo get a solution ? what version do you have ?

Thanks,

Stefane

[Arthur_DENIS1]

Hello,

Unfortunately the only solution for me is to use inactive mode...

Same issue in R77.30 and R80.10, and Checkpoint is not able to reproduce or investigate the issue without a loooott of logs/packet capture from customer infrastructure... So ticket closed /: