Managing Gateways

IPS protections are enforced by Security Gateways with the IPS Software Blade enabled and by IPS-1 Sensors. The Enforcing Gateways page shows the list of all gateways enforcing IPS protections and the profile that is assigned to each gateway.

On the Enforcing Gateways page, you can select whether the IPS profiles will manage only IPS Software Blade protections or if they will also manage IPS-1 Sensor protections. If you choose to manage IPS-1 Sensor protections, you can add IPS-1 Sensors to your list of enforcing gateways and assign profiles to the sensors.

If you choose to manage IPS-1 Sensors as well, the IPS-1_Recommended_Protection profile will be available in the list of Profiles. The Recommended_IPS-1_Protection profile contains recommended settings for both IPS Software Blade protections and IPS-1 Sensor protections. It can also be imported at a later time from the command line with the ips_export_import command.

Adding IPS Security Gateways - SmartDashboard

When you enable the IPS Software Blade on a Security Gateway object, the gateway is automatically added to the list of Enforcing Gateways and it is assigned the Default Protection profile.

To create a new Security Gateway object with IPS enforcement:

1. In SmartDashboard > IPS tab, select Enforcing Gateways.
2. Click Add and choose Security Gateway.
3. Select IPS Enter the properties of the Security Gateway, including selecting IPS.
   • In Classic mode, select IPS in the Network Security tab.
   • In Simple mode, select a Check Point products option that includes IPS.

The Firewall Software Blade must be enabled to enable the IPS Software Blade.

Adding IPS-1 Sensors

When you add a new IPS-1 Sensor object, the sensor is automatically added to the list of Enforcing Gateways and it is assigned the IPS-1 Recommended Protection profile. By default, the sensor is configured as IPS-Inline with fail-open bypass mode.

When adding an IPS-1 Sensor, you can also define these settings which are unique to IPS-1 Sensors:

Working Mode

• IDS - Passive: The IPS-1 Sensor is not placed in the path of traffic. Packets are processed for attack detection without any impact on the flow of network traffic.
• IPS - Inline, Detect only: Inline intrusion detection. Packets are forwarded through to the network before processing for attack detection. In fault conditions, all packets are allowed. Detect only mode is also useful for checking whether an IPS-mode Sensor is responsible for dropped traffic.
• IPS - Inline, fail-open: Inline intrusion prevention. Packets are processed for attack detection and are forwarded to the network only in accordance with protection settings. In fault conditions, all packets are allowed.
• IPS - Inline, fail-closed: Inline intrusion prevention. Packets are processed for attack detection and are forwarded to the network only in accordance with protection settings. In fault conditions, all packets are dropped.

Topology

By default, the IPS-1 Sensor inspects all traffic that passes through its interfaces. We recommend that you manually define the protected networks in the IPS-1 Sensor's Topology page. The Topology options are:

• All IPs lets the IPS-1 Sensor protections react to all traffic with the highest level of inspection. Most organizations will choose not to use this setting because it requires a high level of inspection of traffic even of traffic that does not impact the organization's security.
• Manually defined lets you specify the group of hosts or networks that the IPS-1 Sensor protects. This reduces the load on the sensor by focusing the sensor's resources on traffic that relates to internal networks.
• None does not specify a group of hosts or networks for protection. When no topology is configured, the IPS-1 Sensor inspects all traffic with a lower level of intensity. The IPS-1 Sensor will inspect traffic faster but without the high level of inspection provided by the All IPs and Manually defined settings.

Latency Threshold

The Latency Threshold suspends IPS inspection when the average latency of traffic passing through the sensor exceeds a specified threshold. The specified latency level will be treated as a Fail State. Then, traffic will be passed or dropped based on the Sensor bypass mode of the IPS-1 Sensor's General Properties. By default, this setting is off, but you can enable it from the IPS-1 Sensor's IPS page.

To create an IPS-1 Sensor object:

1. If there is a Security Gateway between the management server and the IPS-1 Sensor, make sure Accept IPS-1 management connections is selected in the Global Properties > Firewall page.
2. In the IPS tab, select Enforcing Gateways.
3. Click Add and choose IPS-1 Sensor.
4. Enter the properties of the IPS-1 Sensor.
5. If there is a Security Gateway between the management server and the IPS-1 Sensor, install the policy on the gateway.
6. Open the IPS-1 Sensor object and click Communication to initiate SIC.
7. Once SIC is initialized, click Close.
8. Click OK.

The IPS-1 Sensor object is created and you can now include the IPS-1 Sensor in policy installation.

Managing IPS gateways - CLI

You can use these CLI commands to manage IPS on your ~sgws. You must be in expert mode to use the commands.

To see all available commands:

1. On the gateway, go to the expert mode.
2. Type ips and press Enter.