IPS exceptions

[carl_t]

Hi All

Can anyone talk to me about the IPS exceptions on the R80 Firewall.

If you want to create an exception, you generally apply it to whatever policy you have on applied to the Firewall.

What are the Core exceptions?

Also if we bypass certain things, I am guessing this doesn't get scanned at all?

Many thanks

[PhoneBoy]

For R80+ gateways, apply the exceptions as part of the Threat Prevention policy applied to the gateway.
Because of where they are enforced in the product, there are ~40 protections that are considered "Core Protections" and must be handled differently.
See: https://community.checkpoint.com/t5/IPS-Anti-Virus-Anti-Bot-Anti/Exceptions-on-IPS-Core-Protections/...

For Core Protections, an Exception means "don't look for or block on this traffic."
For all other IPS protections, it depends on what you set the override to.