you guys should really check the IPS features of R80.20 (sorry for plugging CheckMates): auto updates, tagging, auto prevent, picking countries in the access control policy (not IPS but still), ...