- CheckMates
- :
- Products
- :
- Quantum
- :
- Threat Prevention
- :
- Re: Is there any tool or script to trigger IPS sig...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there any tool or script to trigger IPS signature directly from Checkpoint gateway to test IPS
Is there any tool or script to trigger IPS signature directly from Checkpoint gateway to test IPS functionality in a large scale environment.
I know Ping protection but it would be hard to find backend machine which will initiate a traffic towards machine behind FW to get the IPS trigger and allowing in access rule for that traffic and all which is too much time consuming.
Any other/alternative script / curl command or something suggestion which can trigger the IPS event from gateway itself without much changes ?
Please suggest.
Appreciate your input and suggestion.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Not sure if you are trying to test specific IPS Protection, but you can try using the below link to test effectiveness of your gateway and configuration:
https://pages.checkpoint.com/checkme-instant-security-check.html
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Per sk115236 CheckMe will attempt to trigger the following IPS protection.
"D-Link 850L Router Remote Unauthenticated Information Disclosure"
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am afraid as this will do test from a machine which is behind specific firewall only but i wanted to have some script or some ways which will trigger from firewall gateway it self without opening any communication flow and trigger some ips signature to validate the ips functionality on 200+ gateways (offcourse i ned to login to individual firewall/gateway but still ok instead of finding machine behind 200 gateways. Hope i defined the requirement clearly.
By the way thank for your input 🙂
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do you do any testing with the URLs in that SK via curl or similar?
Note there is also a cross-site scripting protection test listed there.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So, let me get this straight: you want to trigger an IPS protection...any protection...from the gateway itself?
Did you try, e.g. a large ping from the gateway itself?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes thats right. thats the requirement.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I would like to perform test on multiple lets say 200+ firewalls directly from firewall/gateway for IPS funtionality test if there is no events.
