With R80.10, it looks like the "Internal hosts only" option is gone. I was told by an SE that it is now the default, and that to go back to protecting all with IPS requires using it in legacy mode...