Threat Prevention as shared layer

[Henrik_Noerr1]

Hey,

We are using MDS with 10 domains and some 200 Virtual Systems spread out on some 40 VSX clusters. 

Many of VS use IPS and have their own Threat Prevention policy using the same profile. 

the TP policy is mostly identical across all firewalls. 
I am wondering if there are any benefits in converting all these policies to simply work as a shared TP layer. 

will we gain any benefits from this on the MDS side, maybe even on the VSX clusters?

I am thinking update size and time would be better? 

/Henrik

[the_rock]

I would also think for those reasons you mentioned as well, makes sense. I have not worked with any customers who use MDS since R77.xx days , so cant really speak on that front, so let others chime in with their opinions 🙂

Andy

[Henrik_Noerr1]

Hmm, it doesn't seem to be an option.

 

[the_rock]

Hey @Henrik_Noerr1 

That has been by design since base R80 that default threat prevention layer cannot be shared. I attached screenshot of my lab example:

 Andy

[PhoneBoy]

I don't see how having a shared TP layer would change anything in terms of update size and time.

[Henrik_Noerr1]

I must be misunderstanding something.

Each VS has it's own directory like; /opt/CPsuite-R81.10/fw1/CTX/CTX00004/ips/

With it's own dedicated directory, I am guessing with identical TP policies, all these directories contain redundant information?

Each directory needs to be updated and pushed to each gateway. Why not have a shared layer so the IPS layer is maintained once.

even sk176665 acknowledges the issue.

[the_rock]

Thats my logic as well @Henrik_Noerr1 

[PhoneBoy]

A shared Threat Prevention layer won't change how the information is pushed to each VS.