Optimizing Threat Prevention best practice on Inspection Setting

[Ihenock1011]

Hi All,

We have a Check Point R81.10 Security Gateway, and we aim to fine-tune our Threat Prevention to ensure optimal configuration and adhere to best practices. We seek guidance on which features to activate in the inspection settings, located under Manage & Settings > Blades > Inspection Settings.

Thanks,

[AkosBakos]

Hi @Ihenock1011 

There are two way's, I think:

1: https://support.checkpoint.com/results/sk/sk95193

2: https://community.checkpoint.com/t5/Security-Gateways/Announcement-Max-Power-2020-Check-Point-Firewa...

@Timothy_Hall's book is really worth the money. This book helped me a lot!

Akos

[the_rock]

Absolutely, book is fantastic!

Andy

[Chris_Atkinson]

Optimize for performance or protection a balance?

The Threat Prevention guide has sections on "Optimizing IPS" e.g. https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_ThreatPrevention_AdminGuide/...

For some environments adopting Autonomous Threat Prevention might be a good approach.

HCP also has specific Threat Prevention tests that you can enable.

[the_rock]

Hey bro,

Nice to see you here again! Btw, I would make sure you have this configured as per below screenshot. Having recommended protection for inspection setting is better for ddos protection, BUT, it could cause other issues, so maybe better dont change it.

Andy