R80.10 IPS By Protocol

[Neil_Davey]

When using R77.30 I use to have an IPS Profile that only protected the following IPS settings:

Protections, By Protocol, Application Intelligence, Peer to Peer & Malware Traffic Categories.

On a regular basis I would check both of these categories and if any new protections were downloaded, then I would manually enable these protections.

On R80.10, it looks at though this search topology has been removed so I am wondering how I would create a new IPS Profile but only enable these same categories?

Thanks

[Tomer_Sole]

see this page: https://community.checkpoint.com/thread/5159-where-did-all-my-ips-protections-go 

[Neil_Davey]

Thanks for the link Tomer Sole.

I have tried to create an IPS Profile but get a load of protections enabled that I do not want.

Have you any steps on how to prevent only the specific protections that I used to use under R77.30?

[PhoneBoy · Accepted solution]

In the Threat Prevention profile, you can define specific categories of protections to activate.

[Neil_Davey]

Would you know what tag links to each one from R77.30 then as I can't find the eaact one that only enables the ones I want?

Peer to Peer Tag = ?

Malware Traffic Tag = ?

[PhoneBoy]

These tags still exist if you're managing pre-R80 gateways.

I don't believe they were propagated forward to R80 because they can be handled by:

• P2P: Application Control (there's a P2P tag there)
• Malware: Anti-Bot and/or Anti-Virus.