AnsweredAssumed Answered

What are IPS Staging Protections? And how do we clear them?

Question asked by Tomer Sole Expert on Sep 13, 2016
Latest reply on Jun 6, 2017 by Tomer Sole

In R80, following an IPS Update, newly downloaded protections are marked in "staging". This means that if their state according to the profile is Prevent or Detect, as long as the user doesn't clear the flag, it's marked as "Detect (staging)" with a little clock icon on top of it. Protections that should be inactive remain inactive.

 

The plan is that you can keep them in staging until you decide whether they should behave according the profile's settings, or override them with a different action, for example based on traffic after policy installation.

 

From the IPS Protections view, you can filter protections to only show the ones that are in Staging.

staging.png

 

 

You can control this setting from the Profile Editor:

profile-staging.png

 

 

Clearing protections from Staging can be done from the IPS Protections view.

Please note that in order to change the staging counter, you have to clear a protection from staging in all IPS profiles, not just the ones that are seen on the screen. So either change the visible profiles to “all”:

 

show-all-profiles.png

 

or make sure you clear the staging status from all profiles by right-clicking the protection and selecting “restore to profile settings”.

restore-to-profile-settings.png

Outcomes