Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
supruzer1
Contributor
Jump to solution

Gateway properties - IPS - Does changing this setting take precedence over everything IPS related?

Hi Team,

Gateway Cluster Properties page: The IPS tab--> Activation Mode --> According to Threat Prevention policy or Detect only modes.

Does this setting take precedence to all the IPS configuration (inactive, detect, prevent) of signatures? Where is this setting described in the R80.30 Documentation?

Cheers!

0 Kudos
2 Solutions

Accepted Solutions
G_W_Albrecht
Legend
Legend

It uses the configuration as follows: inactive is still inactive, detect stays detect (and is no good anyway, as it costs the same resources as prevent, but without much gain), and prevent gets changed to detect.

CCSE CCTE CCSM SMB Specialist

View solution in original post

0 Kudos
Timothy_Hall
Legend Legend
Legend

As Gunter says setting "Detect Only" temporarily causes IPS protections set to Prevent to act like Detect.  As mentioned in my IPS Immersion series this function was called "Troubleshooting Mode" in R77.30 and earlier, and may still be referred to by that name in some places.

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com

View solution in original post

0 Kudos
5 Replies
Marcel_Gramalla
Advisor

Hi,

you can find the information here: Threat Prevention R80.30 Administration Guide (checkpoint.com)

It actually only mentiones Anti-Bot and Anti-Virus but it's the same with IPS. When choosing "Detect Only" nothing is blocked but only logged and according to policy is obviously blocking traffic if you have configured it properly. 

0 Kudos
supruzer1
Contributor

Yes that's the issue> I can't find any related info on the IPS settings. There are many settings on that page also

0 Kudos
Timothy_Hall
Legend Legend
Legend

As Gunter says setting "Detect Only" temporarily causes IPS protections set to Prevent to act like Detect.  As mentioned in my IPS Immersion series this function was called "Troubleshooting Mode" in R77.30 and earlier, and may still be referred to by that name in some places.

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
0 Kudos
G_W_Albrecht
Legend
Legend

It uses the configuration as follows: inactive is still inactive, detect stays detect (and is no good anyway, as it costs the same resources as prevent, but without much gain), and prevent gets changed to detect.

CCSE CCTE CCSM SMB Specialist
0 Kudos
supruzer1
Contributor

Thank you G_W. Sounds like Threat Emulation setting to Detect does the same thing here. 
@ Marcel - The settings for Anti-Virus and Anti-Bot aren't on this page and I per G_W what he mentions makes sense as far as the Firewall properties settings are concerned. CP has settings everywhere for everything and not very intuitional. I would say for majority common administrators this becomes a major headache unless you have a dedicated team of pros, tons of money for TAC and a forgiving workplace.

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events