The ticket
Vendor tool upd.vendor.example to 10.20.30.41 is Accept in Access. Still reset. SmartLog Threat Prevention: IPS protection “Suspicious File Download” Prevent. Someone wants IPS Detect globally.
Threat Prevention is a separate policy (IPS, Anti-Bot, Anti-Virus, Threat Emulation/Extraction). Access Accept does not bind TP. Prove the protection name, then add an exception for that source/dest/protection. Global Detect is how companies get ransomware.
SMS sms-lab 10.10.10.5 · cluster VIP 10.10.10.1 (cp-gw-01 10.10.10.2 / cp-gw-02 10.10.10.3) · external 203.0.113.25 · internal LAN 10.20.30.0/24 · HR PC 10.20.30.80 TECHCLICK\priya.hr · HR app 10.20.30.41 hr.techclick-lab.in. Not a live customer.
What TP is
R81.20 Security Management: install Threat Prevention separately from Access Control. Profiles (Optimized / Strict / custom) set Prevent vs Detect per protection.
The packet can be allowed by Access and still dropped by TP in the inspect path (often after HTTPS Inspection if decrypted).
Prevent vs Detect vs exception
| Move | When | Risk |
|---|---|---|
| Exception: this host + this protection | Known good vendor tool | Low if scoped |
| Detect for one protection | You need telemetry while vendors fix | Medium |
| Profile Detect globally | Almost never | High |
| Uninstall TP | Never as a “fix” | Extreme |
New exception
How you exception
Side A — reproduce
Run the vendor tool once. Do not click Disable IPS.
Side B — identify
Logs & Monitor → Threat Prevention. Note protection, severity, source, dest, action Prevent.
Side C — exception + install TP
TP policy → Exceptions. Scope the host or updater URL. Publish. Install Threat Prevention. Re-test. Confirm Access still Accept and TP no longer Prevents that flow.
# expert on active member — HIGH CPU, stop with Ctrl+C fw ctl zdebug + drop | grep 10.20.30.80 # Example line (shape, not a live dump): # dropped by ... ips ... reason: protection Suspicious File Download # Turn it off when you have the name. This is not a monitoring tool.
Four TP failures
1 · Access Accept, TP Prevent
Two policies. Two install buttons. People only installed Access.
2 · Exception not installed
You added it. Forgot Install Threat Prevention.
3 · Exception too wide
Any-Any Inactive on IPS. You “fixed” the updater and opened the LAN.
4 · zdebug left running
CPU spikes. Always stop debug.
How to prove it
1) Protection name recorded. 2) Exception scoped. 3) TP policy installed. 4) Updater works. 5) A second random EXE still hits TP. 6) zdebug off.
Traps
| Symptom | TP story | First proof | Wrong fix |
|---|---|---|---|
| Access accept, reset | TP Prevent | TP log | Any-Any Access |
| Exception “there,” still prevent | Did not install TP | Install Policy checkboxes | fwaccel off |
| Everything allowed now | Global Detect | Profile action | Leave it |
Knowledge check
Judgment items. One best answer. Reasons send you back to the matching section.
Check Point class series: Architecture · Gaia first day · SIC reset · Objects + first match · Policy layers · Hide vs Static NAT · Identity Awareness · HTTPS Inspection · Threat Prevention · Find the drop · fw monitor · SecureXL · ClusterXL · VPN Community · Policy install lock · vs PA vs Forti · CCSA / CCSE interview
Sources
- R81.20 Security Management — Installing the Threat Prevention Policy (IPS / Anti-Bot / Anti-Virus / Emulation / Extraction).
- Threat Prevention Admin Guide — exceptions, profiles, Prevent vs Detect.
- CLI:
fw ctl zdebug + drop(use briefly; official debug docs).
Related: Check Point evidence desk · session factory · next lesson in the series above.