# Threat Prevention: when IPS kills a vendor tool Source: https://ai.techclick.in/blog_checkpoint_threat_prevention_vendor_tool Markdown: https://ai.techclick.in/blog_checkpoint_threat_prevention_vendor_tool.md Publisher: Techclick Infosec Pvt Ltd IPS / Anti-Bot / AV / SandBlast overblock. Prove with fw ctl zdebug drop and TP logs, then exception — not disable the blade. Dummy vendor updater. ## The ticket Vendor tool upd.vendor.example to 10.20.30.41 is Accept in Access. Still reset. SmartLog Threat Prevention: IPS protection “Suspicious File Download” Prevent. Someone wants IPS Detect globally. Quick interview answer Threat Prevention is a separate policy (IPS, Anti-Bot, Anti-Virus, Threat Emulation/Extraction). Access Accept does not bind TP. Prove the protection name, then add an exception for that source/dest/protection. Global Detect is how companies get ransomware. Lab data · dummy only SMS sms-lab 10.10.10.5 · cluster VIP 10.10.10.1 ( cp-gw-01 10.10.10.2 / cp-gw-02 10.10.10.3 ) · external 203.0.113.25 · internal LAN 10.20.30.0/24 · HR PC 10.20.30.80 TECHCLICK\priya.hr · HR app 10.20.30.41 hr.techclick-lab.in . Not a live customer. ## What TP is R81.20 Security Management: install Threat Prevention separately from Access Control. Profiles (Optimized / Strict / custom) set Prevent vs Detect per protection. The packet can be allowed by Access and still dropped by TP in the inspect path (often after HTTPS Inspection if decrypted). ## Prevent vs Detect vs exception Move When Risk Exception: this host + this protection Known good vendor tool Low if scoped Detect for one protection You need telemetry while vendors fix Medium Profile Detect globally Almost never High Uninstall TP Never as a “fix” Extreme smartconsole://sms-lab/policy/tp Training mock · not live SmartConsole · lab Gateways & Servers Security Policies Logs & Monitor Manage & Settings Security Policies → Threat Prevention → Exceptions ### New exception Protected scope host_hr_pc (10.20.30.80) Protection Suspicious File Download Action Inactive / Detect (lab: Inactive) Install on cp-cluster Cancel OK R81.20 Installing the Threat Prevention Policy; exception workflow in TP admin guide. Training mock. ## How you exception - #### Side A — reproduce Run the vendor tool once. Do not click Disable IPS. - #### Side B — identify Logs & Monitor → Threat Prevention. Note protection, severity, source, dest, action Prevent. - #### Side C — exception + install TP TP policy → Exceptions. Scope the host or updater URL. Publish. Install Threat Prevention . Re-test. Confirm Access still Accept and TP no longer Prevents that flow. Drop reason · short window · dummy # expert on active member — HIGH CPU, stop with Ctrl+C fw ctl zdebug + drop | grep 10.20.30.80 # Example line (shape, not a live dump): # dropped by ... ips ... reason: protection Suspicious File Download # Turn it off when you have the name. This is not a monitoring tool. ## Four TP failures ### 1 · Access Accept, TP Prevent Two policies. Two install buttons. People only installed Access. ### 2 · Exception not installed You added it. Forgot Install Threat Prevention. ### 3 · Exception too wide Any-Any Inactive on IPS. You “fixed” the updater and opened the LAN. ### 4 · zdebug left running CPU spikes. Always stop debug. ## How to prove it Close the ticket only when 1) Protection name recorded. 2) Exception scoped. 3) TP policy installed. 4) Updater works. 5) A second random EXE still hits TP. 6) zdebug off. ## Traps Symptom TP story First proof Wrong fix Access accept, reset TP Prevent TP log Any-Any Access Exception “there,” still prevent Did not install TP Install Policy checkboxes fwaccel off Everything allowed now Global Detect Profile action Leave it ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 Access Accept, transfer still killed. Where do you look first? Threat Prevention log / protection name Gaia hostname Default route only SmartConsole version Correct: a . Two policies. Q2 Safest fix for one vendor updater? Scoped exception IPS Detect for the company Uninstall TP Delete cleanup Correct: a . Choose table. Q3 After adding a TP exception you must… Install Threat Prevention Only save Gaia config Reset SIC Reboot both members always Correct: a . Failure 2. Q4 fw ctl zdebug + drop is… A short live debug you turn off A 24×7 monitor A NAT command A SmartConsole button Correct: a . Runbook warning. Q5 TP blades include… IPS, Anti-Bot, Anti-Virus, Threat Emulation Only ClusterXL Only Gaia Portal Only Hide NAT Correct: a . R81.20 TP install topic. Q6 Why not set the whole profile to Detect? You stop blocking real malware to please one tool Detect is unsupported It breaks SIC It disables logs Correct: a . Quick answer. Check answers Reset Check Point class series: Architecture · Gaia first day · SIC reset · Objects + first match · Policy layers · Hide vs Static NAT · Identity Awareness · HTTPS Inspection · Threat Prevention · Find the drop · fw monitor · SecureXL · ClusterXL · VPN Community · Policy install lock · vs PA vs Forti · CCSA / CCSE interview ## Sources - R81.20 Security Management — Installing the Threat Prevention Policy (IPS / Anti-Bot / Anti-Virus / Emulation / Extraction). - Threat Prevention Admin Guide — exceptions, profiles, Prevent vs Detect. - CLI: fw ctl zdebug + drop (use briefly; official debug docs). Related: Check Point evidence desk · session factory · next lesson in the series above. --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt