IPS Bypass and VSX

[Niels_van_Sluis]

Secure Knowledge Solution ID sk107334 says:

"IPS Bypass Under Load mechanism looks at the indiviual core utilization rather than the average core utilization. As a result, spikes in individual core usage may pass the treshold and subsequently trigger the IPS Bypass Under Load mechanism, even if overall CPU utilization is still under the threshold for activation."

How does this relate to VSX virtual systems? For example, could a CPU under load that has it's affinity set to a NIC that is only used in VS X, trigger an IPS Bypass for VS Y and VS Z that are on the same VSX host? 

[PhoneBoy]

Moving this to https://community.checkpoint.com/community/threat-prevention?sr=search&searchId=16c6bda3-76e3-42a4-8...‌

[Zolo]

@PhoneBoyI do not find the thread on that link 😕

[PhoneBoy]

That link is quite old and when we were on a different platform...not relevant anymore.
In any case, the SK is not relevant after R77.30 as Dynamic Dispatcher should handle this situation (as I understand it).

[Henrik_Noerr1]

We are running r80.40 take 125+ and a fully loaded SND will enable bypass on all Virtual Systems.

in my opinion the IPS Bypass is a broken feature on VSX and by extension the IPS blade itself.

That or don't run with bypass enabled, which most organisations will not accept.

/Henrik