How to Tune the IPS

[Prashan_Attanay]

Hi Team,

Can anyone share the knowledge of how to fine-tune the IPS. Currently our IPS in recommended protection. And most of the signatures are in Detect mode. 

How you fine-tune the IPS based on Critical, High, Medium ? 

Can anyone guide me to fine-tune the IPS ? 

Cause we are getting this messages regularly 

Oct 26 09:45:52 2017 DC-IRDOFW2 kernel: [fw4_1];FW-1: [cul_load_freeze_on_remote][CUL - Cluster] CUL state is ON for 0 seconds, remote Member 0 reporting high kernel CPU usage (100%), threshold=80%, local kernel CPU usage is 0%

Oct 26 09:45:52 2017 DC-IRDOFW2 last message repeated 6 times

Oct 26 09:45:53 2017 DC-IRDOFW2 kernel: [fw4_1];FW-1: [cul_load_freeze_on_remote][CUL - Cluster] CUL state is ON for 1 seconds, remote Member 0 reporting high kernel CPU usage (100%), threshold=80%, local kernel CPU usage is 1%

Oct 26 09:45:53 2017 DC-IRDOFW2 last message repeated 6 times

Oct 26 09:45:53 2017 DC-IRDOFW2 kernel: [fw4_1];FW-1: [cul_load_freeze_on_remote][CUL - Cluster] Changing CUL state to ON due to high CPU usage (100%) on remote Member 0, threshold = 80%, local kernel CPU usage is 1%

Oct 26 09:45:54 2017 DC-IRDOFW2 kernel: [fw4_1];FW-1: [cul_load_freeze_on_remote][CUL - Cluster] CUL state is ON for 2 seconds, remote Member 0 reporting high kernel CPU usage (100%), threshold=80%, local kernel CPU usage is 0%

Oct 26 09:45:54 2017 DC-IRDOFW2 last message repeated 6 times

Oct 26 09:46:02 2017 DC-IRDOFW2 kernel: [fw4_1];FW-1: [cul_load_freeze][CUL - Cluster] CUL should be OFF (short timeout of 10 seconds expired) but at least one member reported high CPU usage 5 seconds ago

Oct 26 09:46:03 2017 DC-IRDOFW2 kernel: [fw4_1];FW-1: [cul_load_freeze][CUL - Cluster] CUL should be OFF (short timeout of 10 seconds expired) but at least one member reported high CPU usage 6 seconds ago

Oct 26 09:46:04 2017 DC-IRDOFW2 kernel: [fw4_1];FW-1: [cul_load_freeze][CUL - Cluster] CUL should be OFF (short timeout of 10 seconds expired) but at least one memb

[KennyManrique]

The message of CUL (Cluster Under Load) means a high resource usage on the firewall, in this case it seems to be because of high CPU. You can use the following sk articles to troubleshoot high cpu issues:

Performance analysis for Security Gateway NGX R65 / R7x 

Best Practices - Security Gateway Performance 

If you are sure about the problem is IPS blade, to start you can follow the document IPS Tuning - Best Practices

Regards.

[Jason_Dance]

To see if it is indeed the IPS causing the high load, you can temporarily switch off the IPS with "ips off".  You can use tools like cpview (clish), top and nmon (expert mode) to track your CPU usage (Kenny mentioned sk33781 which is very useful in interpreting the output).

[Tomer_Sole]

Please see the following https://community.checkpoint.com/message/13840-r8010-ips-best-practices-guide 

[EdesLC]

There are tree documents that can help, take a look:

IPS Tuning Document (PDF). - http://dl3.checkpoint.com/paid/35/35b0b702d1728500b54c04da5ee05b96/CP_IPS_BestPractices.pdf?HashKey=... 

How to measure CPU time consumed by IPS protections 

How to tune the "Bypass under Load" IPS settings