Prevent Port scan

[SubZer0]

Atm my IPS settings are as follows:

But in log Port scan is still Detect is not Prevent.

Few years ago in Pfseance I drop all port scan. What should I do to drop/prevent in CP.

[Chris_Atkinson]

Please provide further details of the TP profile configuration and current Gateway settings for IPS

[Lesley]

This SK's will maybe help you out:

https://support.checkpoint.com/results/sk/sk110873

This one is mostly about DDOS but it also speaks regarding port scans

https://support.checkpoint.com/results/sk/sk112241

[Zolocofxp]

If you have SmartEvent, you can configure reactions accordingly.

If not, you can always configure a Suspicious Activity Monitoring (SAM) rule. This works by sending an alert to SmartView Monitor.

 

This is just a heads up... You can search SKs for SAM rules-

[JoSec]

As Zolocofxp indicated, you can use SmartEvent and it does work well. You can also take a look at Checkpoint's Playblocks.