Why is the traffic accept by IPS blade where as there is no any accept policy of IPS blade

[Rabindra_Khadka]

Dear Team,

I am very surprise by this log, In my threat prevention policy there is either prevent, detect or inactive action define but i am getting accept log by IPS blade, i was not expecting this kinds of logs. Can anyone please tell me about this issue.

What can be the reason that the traffic inspection by IPS comes with accept action.

Please look on the screenshot attachment.

[Timothy_Hall]

You have something set to fail open in the event of an internal error (HTTP parsing error in your case), check these screens in the SmartConsole:

• Manage & Settings...Blades...Threat Prevention...Advanced Settings...Fail Mode (most likely candidate due to the IPS blade reference)
• Manage & Settings...Blades...Application Control & URL Filtering...Fail Mode
• Manage & Settings...Blades...Content Awareness...Fail Mode
• HTTPS Inspection Configuration (in SmartDashboard): HTTPS Inspection...HTTPS Validation...Fail Mode

Despite what the message says, I don't see any "Fail Mode" options in any of the Inspection Settings visible in the SmartConsole, unless it is referring to some kind of kernel variable that is not exposed in the SmartConsole.