Threat Prevention Policy - Protected Scope - Not working?

[Michael_Horne]

Hello All,

We have an issue with some traffic triggering an IPS Block for some traffic.

The FW Blade log:

This is triggering a IPS Blade Log:

We tried to bypass the Zscaler traffic from the IPS. We do this generally as Zscaler should in theory already be doing security checks.

This did not have any effect. We were still getting the same log messages.   As a test I implemented a Threat Protection rule which used "Destination" instead of "Protected Scope":

When we use this test rule, then the logs stop.  Why understanding was (and other articles on the Community back this up) that "Protected Scope" is for matching "Source or Destination", but in this case it does not seem to work.

Is there any other difference between "Protected Scope" and using "Source" and "Destination", that we should be aware of that might explain this behaviour?

Many thanks,

Michael