Re: Which R80.20 IPS defauld profile is equal to ...

Geomix7 · ‎2019-05-28

From R80.20 IPS default profiles (Basic,Optimized & strict) which is equal to IPS R77.30 "Recommended" profile?

Timothy_Hall · ‎2019-05-28

The closest equivalent to the R77.30 "Recommended_Protection" IPS profile in R80+ is the "Strict" profile with some slight differences. Here is a handy summary taken from my IPS Immersion class for version R80.10, note that for fresh installations of R80.20+ the default IPS Updates Policy is to automatically set new Protections to Prevent:

Click to Expand

An IPS Profile contains a policy which specifies whether all the ThreatCloud and Core Activations within it will be set to
Inactive, Prevent, or Detect. For each IPS Profile, the default IPS Policy for Protections to enable is as follows:

▪ Basic – IPS Updates Policy: Set new Protections to Detect/Staging
• Performance Impact: Medium or Lower
• Severity: High or above
• Confidence: High – Prevent, Medium – Inactive, Low – Inactive

▪ Optimized – IPS Updates Policy: Set new Protections to Detect/Staging
• Performance Impact: Medium or Lower
• Severity: Medium or above
• Confidence: High – Prevent, Medium – Prevent, Low – Inactive

▪ Strict – IPS Updates Policy: Set new Protections to Detect/Staging
• Performance Impact: High or Lower
• Severity: Low or above
• Confidence: High – Prevent, Medium – Prevent, Low – Detect

▪ Default_Protection (R77.30 upgrades only) – IPS Updates Policy: Set new Protections to Prevent
• Performance Impact: Very Low only
• Severity: Medium or above
• Confidence: High – Prevent, Medium – Prevent, Low – Inactive

▪ Recommended_Protection (R77.30 upgrades only) – IPS Updates Policy: Set new Protections to Detect/Staging
• Performance Impact: High or lower
• Severity: Medium or above
• Confidence: High – Prevent, Medium – Prevent, Low – Inactive

An IPS Profile contains a policy which specifies whether all the ThreatCloud and Core Activations within it will be set toInactive, Prevent, or Detect. For each IPS Profile, the default IPS Policy for Protections to enable is as follows: ▪ Basic – IPS Updates Policy: Set new Protections to Detect/Staging• Performance Impact: Medium or Lower• Severity: High or above• Confidence: High – Prevent, Medium – Inactive, Low – Inactive ▪ Optimized – IPS Updates Policy: Set new Protections to Detect/Staging• Performance Impact: Medium or Lower• Severity: Medium or above• Confidence: High – Prevent, Medium – Prevent, Low – Inactive ▪ Strict – IPS Updates Policy: Set new Protections to Detect/Staging• Performance Impact: High or Lower• Severity: Low or above• Confidence: High – Prevent, Medium – Prevent, Low – Detect ▪ Default_Protection (R77.30 upgrades only) – IPS Updates Policy: Set new Protections to Prevent• Performance Impact: Very Low only• Severity: Medium or above• Confidence: High – Prevent, Medium – Prevent, Low – Inactive ▪ Recommended_Protection (R77.30 upgrades only) – IPS Updates Policy: Set new Protections to Detect/Staging• Performance Impact: High or lower• Severity: Medium or above• Confidence: High – Prevent, Medium – Prevent, Low – Inactive

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com

Geomix7 · ‎2019-05-28

Based on Check Point R80.10 IPS best practice :"Check Point recommends using the out of the box Optimized profile which provides the balance
between excellent protection for common network products and protocols against recent or
popular attacks and performance impact." Thus i understand optimized is equal to recommended?

PhoneBoy · ‎2019-05-28

The R80.x Optimized profile is less "strict" than the R77.x Recommended profile, but not as strict as the R80.x Strict profile.

Are you a member of CheckMates?

Which R80.20 IPS default profile is equal to IPS R77.30 "Recommended" profile?