How to setup a new IPS sensor with 77.30?

[oliver99]

Hi There

Is it still possible using CPT R77.30 as IPS sensor only?

If no, how could you achieve the same functionality?
We used mirrored ports to detect only traffic.

So it looks like you have to install now a fully Features Firewall with IPDS blade on top, can you define a detect ONLY Interface so something like that?

Any input is welcome.

Thanks Oliver

[mcnallym]

Last Version of IPS-1 was R71, since then is only IPS Blade on the Check Point Firewall.

For R77.30 Read Security Gateway Tech Admin Guide Chapter 6 - Monitor Mode
sk88980 says how to configure a Security Policy for Monitor Mode
sk101670 expands on Monitor Mode

Interfaces can be set to Monitor Mode via the WebUI or CLI

Should give you enough to go through and configure the interface and security policy.

You will still have the Firewall Policy but basically set to Any, Any, Any in the Firewall Policy.

[cciesec2006]

Last Version of IPS-1 was R71, since then is only IPS Blade on the Check Point Firewall.

For R77.30 Read Security Gateway Tech Admin Guide Chapter 6 - Monitor Mode
sk88980 says how to configure a Security Policy for Monitor Mode
sk101670 expands on Monitor Mode

Interfaces can be set to Monitor Mode via the WebUI or CLI

Should give you enough to go through and configure the interface and security policy.

You will still have the Firewall Policy but basically set to Any, Any, Any in the Firewall Policy.

I am currently testing IPS on the Power-1 11065 with R77.30 in monitor mode and it is very slow. Furthermore, the IPS has not caught anything yet.