29 June 2016

IPS

Tuning - Best Practices

Classification: [Protected]
© 2016 Check Point Software Technologies Ltd.
All rights reserved. This product and related documentation are protected by copyright and
distributed under licensing restricting their use, copying, distribution, and decompilation. No part
of this product or related documentation may be reproduced in any form or by any means without
prior written authorization of Check Point. While every precaution has been taken in the
preparation of this book, Check Point assumes no responsibility for errors or omissions. This
publication and features described herein are subject to change without notice.
RESTRICTED RIGHTS LEGEND:
Use, duplication, or disclosure by the government is subject to restrictions as set forth in
subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS
252.227-7013 and FAR 52.227-19.
TRADEMARKS:
Refer to the Copyright page http://www.checkpoint.com/copyright.html for a list of our
trademarks.
Refer to the Third Party copyright notices http://www.checkpoint.com/3rd_party_copyright.html
for a list of relevant copyrights and third-party licenses.
Important Information
Latest Software
We recommend that you install the most recent software release to stay up-to-date
with the latest functional improvements, stability fixes, security enhancements and
protection against new and evolving attacks.

Latest Version of this Document

Download the latest version of this document
http://supportcontent.checkpoint.com/documentation_download?ID=35901.
To learn more, visit the Check Point Support Center
http://supportcenter.checkpoint.com.

Feedback
Check Point is engaged in a continuous effort to improve its documentation.
Please help us by sending your comments
mailto:[email protected]?subject=Feedback on IPS Tuning - Best
Practices .

Revision History
Date Description
29 June 2016 Updated CPU Load in Overview (on page 18)
Improved formatting

6 January 2015 General updates

Added Overview of the Tuning Process (on page 6)

17 September 2014 First release of this document

Contents
Important Information................................................................................................... 3
Introduction ................................................................................................................... 5
Choosing IPS Protections .......................................................................................... 5
Overview of the Tuning Process ................................................................................ 6
Implementing IPS .......................................................................................................... 8
Initial Installation ...................................................................................................... 8
Updating Protections ...................................................................................................... 8
Cloning the Profile.......................................................................................................... 8
Configuring the Profile ................................................................................................... 9
Scheduling IPS Updates.................................................................................................. 9
Configuring the Security Gateway Performance Settings ..............................................10
Installing the Policy .......................................................................................................10
Collecting IPS Logs ................................................................................................. 11
Analyzing the Initial Logs ........................................................................................ 11
Configuring IPS to Protect the Network .................................................................. 12
Ongoing IPS Maintenance Tuning ................................................................................ 13
Overview.................................................................................................................. 13
Analyzing New Protections ............................................................................................13
Running Maintenance on Existing Protections ...............................................................13
General Recommendations ..................................................................................... 14
IPS Updates ...................................................................................................................14
Software Upgrades ........................................................................................................14
Separate Profiles...........................................................................................................14
IPS Management Tips.............................................................................................. 14
Enhancing the Recommended Profile............................................................................14
Configuring Individual Protections.......................................................................... 15
Email Protections ..........................................................................................................15
Optimizing Web Security Protections.............................................................................17
Performance Tuning ................................................................................................... 18
Overview.................................................................................................................. 18
Changing IPS Protection Scope ............................................................................... 18
Excluding Protections ............................................................................................. 19
Exclude a Protection Category.......................................................................................19
Exclude a Specified Protection ......................................................................................19
Gradually Activating Protections............................................................................. 20
Monitoring Performance Impact ............................................................................. 21
Optimizing the Rule Base ........................................................................................ 21
Monitoring Security Gateway Performance ............................................................ 21
CHAPTE R 1

Introduction
In This Section:
Choosing IPS Protections ...............................................................................................5
Overview of the Tuning Process.....................................................................................6

nd performance,
configure it to best-fit the unique traffic of each organization. The world of cyber-threats and your
network are dynamic. Therefore, it is necessary to consistently tune and maintain IPS.
The goal of this guide is to assist you in the initial and ongoing tuning of your IPS Software Blade.

Choosing IPS Protections

The IPS tuning best practices set forth in this guide are based on the knowledge from Check
continuously monitors and manages of
hundreds of IPS gateways for Check Point customers.
The continuous challenge in tuning IPS is to decide which protections to enable, and for each
enabled protection, do I run the protection in Prevent or Detect mode. In addition, network
environments and the threat landscape are very dynamic and the IPS security policy must adapt
accordingly to ensure maximum protection. IPS tuning must be a continual process to address the
changing threat landscape, changing network configuration, newly released and updated
protections as well as new gateway capabilities, and more. The bottom line is that IPS tuning is a
continuous task that needs to be managed professionally at all times.
This guide explains best practice guidelines to help you manage the Check Point IPS Software
Blade. One of the key elements to maintain an effective IPS policy is to monitor IPS events in
real-time:
 Understand better how IPS protections process traffic and protocols across the network
 Identify where it is necessary to tune IPS and exclude unique traffic protocols
This guide does not explain how to mitigate malware attacks that you discover.
When you are tuning the IPS policy, these are the measures that you must consider:
1. Coverage Does the IPS policy cover all critical network assets and services, vulnerabilities
and threats?
2. Accuracy Do all the protections in the IPS policy alert only on real threats in your
environment, and not on legitimate traffic?
3. Performance Adding IPS inspection to an existing gateway (and adding protections to an
existing policy) requires additional CPU and memory. Is the Security Gateway hardware (CPU
and memory) strong enough to run the new IPS policy?
IPS tuning is the science (and art) of balancing the trade-offs between these three measures and
the corporate security, compliance and operational requirements.
To simplify the discussion, most of this guide focuses on optimizing security coverage and
accuracy. Performance tuning, is discussed in a separate section ("Performance Tuning" on page
18).

IPS Tuning - Best Practices | 5

 Introduction

Overview of the Tuning Process

The IPS policy tuning process takes approximately one to two weeks. We recommend that you
follow this check-list during the tuning process, and refer to additional information and
instructions ("Implementing IPS" on page 8) as necessary for each step.
1. Update the IPS package. Make sure that the Security Gateway is up-to-date with the most
recent protection signatures.
2. Set the default IPS action to Prevent. This action gives maximum network protection.
3. Set the default IPS action for newly downloaded protections to Prevent.
4. Clone the Recommended Profile. Create a backup copy and make sure that all changes are
only on the cloned profile.
The security requirements for the different segments in your network often depend on the
specified traffic types and network objects for each segment. For deployments with a
Multi-Domain Server, or several gateways, consider creating separate IPS policies and
perform these steps for each segment.
5. Enable Troubleshooting mode. During the initial tuning process, the IPS Software Blade

Troubleshooting mode, even though all protections are set to Prevent, the gateway only
detects possible threats and generates logs for the traffic.
6. Click the Follow Up marker. Select the option Mark newly downloaded protections for Follow
Up to help the analysis and tuning of new protections in the future.
7. Configure the gateway. Assign the active profile to the applicable gateways.
To make sure that IPS analysis does not have a negative impact on network traffic, enable the
Bypass IPS inspection when gateway is under heavy load is a consideration option.
8. Install the policy on the gateways. New IPS updates and changes in the active profile are not
automatically deployed. It is necessary to install the policy and push it to the gateways.
9. Collect the logs. After you install the policy, IPS starts to inspect the traffic and generate logs.
We recommend that you collect logs for at least a week, and ideally for two weeks.
Note - The IPS Software Blade does not block malicious traffic because Troubleshooting mode
is enabled.
10. Initial IPS tuning. Review the logs and decide which protections to run in Protect or Detect
mode, and which ones require more fine-tuning and analysis.
11. Disable Troubleshooting mode. The IPS Software Blade is now protecting the network.
12. Change the settings for Updates policy. Configure updates to Newly downloaded protections
will be set to Detect. When new IPS protections are deployed, they are set to Detect mode.
13. Clear the Follow up, or the Newly downloaded flag, for all protections that were reviewed
during the tuning process.

IPS Tuning - Best Practices | 6

 Introduction

14. Ongoing maintenance and tuning. We recommend that twice a month you tune the new IPS
protections that you downloaded, and look for changes in the behavior of the ones that you
already tuned.
15. Performance tuning. Monitor the gateway performance and configure the applicable settings
to give the best network security and performance.

IPS Tuning - Best Practices | 7

CHAPTE R 2

Implementing IPS
In This Section:
Initial Installation ............................................................................................................8
Collecting IPS Logs .......................................................................................................11
Analyzing the Initial Logs .............................................................................................11
Configuring IPS to Protect the Network ......................................................................12

Initial Installation
The Check Point IPS Software Blade uses thousands of protections to keep your network safe.
When you are setting up IPS for the first time, it is impossible to run a signature analysis for each
protection. During the time that you are implementing IPS, you can use a mirror port or TAP
server or appliance to run an analysis on the traffic. We recommend that when you enable Protect
mode, you deploy IPS in-line.
Check Point defined the Recommended Profile to give excellent security with good performance
for the gateway. This profile enables all protections that:
 Protect against important threats
 Have an attack confidence level of at least good
 Do not have a critical effect on performance

Updating Protections
The IPS Software Blade includes the protections that were available when the software was first
released. The first time that you enable IPS, it is important to update and download the most
recent protections.

To update the IPS protections:

1. Log in to SmartDashboard.
2. From the navigation tree in the IPS tab, click Download Updates.
The Download Updates window opens.
3. Click Update Now.
4. If necessary, enter the UserCenter credentials.

Cloning the Profile

Make a copy of the Recommended Profile before you start the initial IPS tuning, and make sure
that all changes are only on the cloned profile. For a Multi-Domain Server deployment, we
recommend that you create a separate IPS policy and perform these steps for each segment.

IPS Tuning - Best Practices | 8

 Implementing IPS

To clone the Recommended Profile:

1. From the navigation tree in the IPS tab, click Profiles.
The Profiles window opens.
2. Right-click the Recommended_Profile and select Clone selected profile.
The new profile is added to the list of profiles.

Configuring the Profile

Configure the settings of the profile to help the initial analysis of the IPS inspection with
Troubleshooting mode enabled. The default action for the protections is Prevent, but with
Troubleshooting mode they actually run in Detect. During this initial analysis, you are detecting
security events and generating logs. IPS blocks malicious traffic only after the initial analysis and
tuning is completed.
 Set the default action of the profile to Prevent, because the majority of the protections are
finally deployed in Prevent mode
 While you are initially implementing IPS, configure the blade to run in Troubleshooting
Detect-only mode
 Configure new protections that are added to the profile to run in Prevent mode (during the
initial analysis, these protections are set to Detect)

To configure the profile:

1. From the navigation tree in the IPS tab, click Profiles.
The Profiles window opens.
2. Double-click the profile.
The General page of the Profile Properties window opens.
3. In the IPS Mode section, select Prevent.
4. From the navigation tree, click IPS Policy > Updates Policy.
5. From Newly downloaded protections will be set to, select Prevent.
6. From the navigation tree, click Troubleshooting.
7. Click the Detect-only button.
The window shows this message: Detect-Only for Troubleshooting is enabled.
8. Click OK.

Scheduling IPS Updates

Configure the regular IPS updates for the profile. We recommend that you use all of these
settings:
 Daily updates of IPS protections
 Enable Apply Revision Control to help you revert to earlier versions if necessary
 Configure IPS to update the protections each time SmartDashboard is opened

IPS Tuning - Best Practices | 9

 Implementing IPS

To schedule IPS updates:

1. From the navigation tree in the IPS tab, click Download Updates.
The Download Updates window opens.
2. Click Apply Revision Control.
3. Click Check for new updates while SmartDashboard is active.
4. Click Scheduled Update.
The Scheduled Update window opens.
5. Click Enable IPS scheduled update.
6. Click Edit Schedule
7. Configure a daily IPS update.
8. Click OK.
9. If necessary, click UserCenter credentials, and enter the UserCenter username and
password.
10. Click OK.

Configuring the Security Gateway Performance Settings

When the IPS Software Blade is enabled on a Security Gateway, it can have an effect on network
performance. We recommend that you configure the gateway to bypass IPS inspection when there
is a heavy load on the server or appliance.

To configure bypass under load on the gateway:

1. From the navigation tree in the IPS tab, click Enforcing Gateways.
The Enforcing Gateways window opens.
2. Double-click the gateway that runs IPS analysis on the traffic.
The IPS page of the gateway window opens.
3. In the Bypass Under Load section, click Bypass IPS inspection when gateway is under heavy
load.
4. Click Advanced.
5. Change the settings for the CPU and Memory Usage:
 Low - 50%
 High - 75%
6. Click OK.

Installing the Policy

Install the policy to push the IPS profile to the gateway.

IPS Tuning - Best Practices | 10

 Implementing IPS

Collecting IPS Logs

Install the policy with the new profile and let it run IPS analysis and generate logs for at least a
week. We recommend that you wait two weeks before you disable Troubleshooting mode and
enable the Prevent protections.

Note - During the time that you run IPS analysis, the gateway cannot block IPS attacks,
because all the protections are running in Detect mode (Troubleshooting).

Analyzing the Initial Logs

After you finish collecting the IPS logs, investigate them to determine for each IPS protection
which is the applicable mode:
 Prevent mode - Blocks the traffic
 Detect mode - Allows the traffic and generates a log

Protections that will Run in Prevent Mode

There are protections that it is not necessary to configure, because when you disable
Troubleshooting mode, these protections automatically run in Prevent mode.
The protections that did not generate any events during the initial tuning will remain in Protect
mode. They maintain a high level of security and do not impact network performance.
Protections that generated events only for malicious traffic will also remain in Protect mode. You
can identify events as malicious based on:
 Country and reputation of the source IP address (for example, use ipvoid.com)
 URLs
 Packet capture analysis

Protections to Configure to Run in Detect Mode

We recommend that you configure protections that generate events for a wide range of legitimate
traffic to run in Detect mode. In addition, report these protections to Check Point for additional
analysis and classification.

Protections that Require More Analysis

Some protections generate events for both legitimate and malicious traffic. One possible reason is
that legacy applications often use non-standard traffic and generate an IPS event. We recommend
that you look for patterns in the events of the legitimate traffic and create IPS network exceptions.
For example, there can be a small set of Source or Destination IP addresses, services, or ports.
 If you can identify a pattern for the types of traffic:
a) Create network exceptions for each type of traffic.
b) Then set the protection to Prevent.
 If you cannot identify a pattern, set the protection to Detect and report the protection to Check
Point.

IPS Tuning - Best Practices | 11

 Implementing IPS

Configuring IPS to Protect the Network

When you complete the initial IPS tuning, disable Troubleshooting mode and configure the IPS
Software Blade for regular operation. The profile is now configured to maximize performance and
security for your network. It is necessary to continue to regularly run maintenance tuning
("Ongoing IPS Maintenance Tuning" on page 13) for the IPS protections.

To configure IPS to protect the network:

1. From the navigation tree in the IPS tab, click Profiles.
The Profiles window opens.
2. Double-click the profile.
The General page of the Profile Properties window opens.
3. From the navigation tree, click Troubleshooting.
4. Click the Detect-only button.
The window shows this message: Detect-Only for Troubleshooting is disabled.
5. Click OK.
6. Install the policy.
The IPS Software Blade is now protecting the network.

IPS Tuning - Best Practices | 12

CHAPTE R 3

Ongoing IPS Maintenance Tuning

In This Section:
Overview ........................................................................................................................13
General Recommendations .........................................................................................14
IPS Management Tips ...................................................................................................14
Configuring Individual Protections ..............................................................................15

Overview
After you successfully configure the initial IPS installation, most protections are deployed in
Prevent mode and there are a few that remain in Detect mode for additional analysis. However,
new threats continuously emerge and the internal network changes with new applications,
services and protocols. It is necessary to regularly run an analysis on the IPS logs for
maintenance tuning of the policy.
We recommend that you run an IPS analysis twice a month and review IPS updates (on page 14)
for new attacks and other issues.

Analyzing New Protections

We recommend that you deploy new Protections in Detect mode ("Configuring the Profile" on page
9). As you did when you performed the initial installation, run an analysis on the new Protections
("Analyzing the Initial Logs" on page 11) and determine if they can run in Prevent mode.

Running Maintenance on Existing Protections

Run an analysis on the logs that are generated by the IPS protections.

Protections in Prevent Mode

 Make sure that most of the events are generated by malicious traffic
Analyze these events according to the source IP address, URLs, and packet capture
 If events are generated by legitimate traffic:
a) Try to identify the pattern and create an exception for the traffic
b) If you cannot identify the pattern, configure the protection to Detect mode
Note - If this protection generates a small number of logs, we recommend that you continue to
run it in Prevent mode.

Protections in Detect Mode

 Make sure that events continue to be generated for legitimate traffic
 If legitimate traffic no longer generates events, change the protection to Prevent mode

IPS Tuning - Best Practices | 13

 Ongoing IPS Maintenance Tuning

General Recommendations
This section contains general advice to help you manage the IPS Software Blade.

IPS Updates
Check Point releases new IPS protections packages as necessary, usually at least once a week. It
is important to review the published Check Point IPS update. The update shows new protections
against zero-day vulnerabilities. If the protections are crucial for your network, immediately
deploy them in Prevent mode. There is a risk that a new protection can disrupt legitimate traffic,
but there is a greater benefit in preventing active malware attacks.

Software Upgrades
It is important to review the Release Notes for new software versions, and regularly install
software updates. Check Point IPS combines the features of the IPS engine and new protections
that are continually added. The engine is the core code that parses and inspects the traffic, and it
is often improved as part of software upgrades for Security Gateways. These upgrades give better
IPS protection and performance. For example:
 R75.40 improved the Non-Compliant HTTP inspection protection
 R76 improved the Non-Compliant DNS protection

Separate Profiles
The initial performance tuning focuses on a single IPS profile that is recommended for many
situations. However, it can be necessary to create different profiles for the specified gateways in
an organization to improve security or performance. Examples of separate profiles:
 gateways on the perimeter frequently use a different profile than gateways that protect data
centers
 gateways that use different versions of Check Point software can use different profiles

IPS Management Tips

Enhancing the Recommended Profile
The initial tuning process uses only protections that are included in the Recommended IPS profile.
We recommend that you add other protections to the active IPS profile. Make sure that you run the
performance-tuning procedure ("Analyzing the Initial Logs" on page 11) before you enable Prevent
mode for a protection.
These are some common additional protections for a profile:
Application Control: These protections identify and can control specific applications and protocols.
For example: VNC, BitTorrent, Google Talk, and TeamViewer. Review Application Control
protections, and enable the ones that help protect the network. However, the optimal way to
manage how applications are used is with the Check Point Application Control Software Blade.

IPS Tuning - Best Practices | 14

 Ongoing IPS Maintenance Tuning

DoS (Denial of Service): There are several protections that look for massive use of Web Server
protocols (UDP, HTTP, SSL). They can detect and protect the network from DoS attacks. Enable
the DoS protections to give additional security to the network. For more about defending the
network from DoS attacks, see DDoS Protection on the Security Gateway Best Practices Guide
http://supportcontent.checkpoint.com/documentation_download?ID=35013.

Configuring Individual Protections

Some IPS protections require more in-depth customization to give a network the best security.
SQL Injection: This protection runs a scan on traffic to a user-defined list of specified web servers.
The protection is active only when the network objects for these servers are created correctly. Do
not apply the protections for SQL injection to all HTTP traffic, or unnecessary false-positives will
disrupt network traffic.
Geo Protection: Control network traffic for specified countries. An IP-to-country database
connects packet IP addresses to the countries. Configure one set of policies for each Profile to
block or allow traffic for one or more countries. If your company has no business and network
traffic with certain countries, you can use Geo Protection to block the traffic. When you block
traffic, you increase overall security and are well protected against targeted and DDoS attacks.
You can track traffic to or from other countries and after some time determine if you can also
block the traffic.

Note - Do not track traffic for all countries, or IPS generates too many logs.

General HTTP/CIFS Worm Catcher and Header Rejection: These protections let you add and edit
regular expressions so that the Firewall can block the specified HTTP requests. Check Point
occasionally advises customers to add a pattern to these protections as an immediate pre-emptive
action against a new threat. The IPS protections are updated when the new protections package is
available from Check Point.
SNORT Conversion: Gateways that are version R76 and higher can import and convert SNORT
signatures to IPS protections. You can use public-domain and custom signatures to help protect
the network. For more about how to use SNORT signatures for IPS, go to the IPS Administration
Guide for your version.

Email Protections
Activate protections for the protocols that your environment uses for emails and add customized
security to the mail servers.

Setting POP3/IMAP Scope

By default, when you configure the POP3/IMAP Security settings in Protections > By Protocol >
IPS Software Blade > Application Intelligence > Mail, they apply to all hosts that are defined as
mail servers according to the Action settings of each IPS profile. You can also limit the scope of
this protection to only the specified mail servers.

IPS Tuning - Best Practices | 15

 Ongoing IPS Maintenance Tuning

To specify which hosts get the POP3/IMAP protection settings:

1. In the IPS tab, go to Protections > By Protocol > IPS Software Blade > Application Intelligence
> Mail.
2. In the Look for field, enter POP3/IMAP Security.
3. In the search results that show, double-click POP3/IMAP Security.
The Protection Details - POP3/IMAP Security configuration window opens.
4. Select the profile and click Edit.
5. In the Protection Scope area, click Apply to selected mail servers.
6. Click Customize.
The Select Servers window opens, and all mail servers are selected by default.
7. Change selection of servers on which POP3 and IMAP protections should not be enforced:
 To remove servers from the list - clear the servers
 To add servers to this list - click Add, select the servers, and click OK
 To edit server settings - select a server, click Edit, edit settings in the Host Node
configuration window that opens, and click OK
8. Click OK.
The POP3/IMAP Security protection has a list of commands that IPS recognizes and inspects. The
definitions of the POP3 commands apply to all IPS profiles. In the Protection Details - POP3/IMAP
Security configuration window, you can edit the list of POP3 commands that apply to all profiles or
edit the list of POP3 commands that apply to specific profiles.

To edit the list of POP3 commands that apply to all profiles:

1. In the Protection Details - POP3/IMAP Security configuration window, click Edit for the POP 3
Commands Definitions.
The Add custom POP3 command window opens.
2. Edit the list as necessary:
 To add a new command - click Add and enter the new command
 To change an existing command - select the command, click Edit, and edit the command
 To delete a command - select the command, click Remove, and in the window that opens,
click Yes to confirm
3. Click OK.

To block or allow a POP3 command for a profile:

1. In the Protection Details - POP3/IMAP Security configuration window, select the profile for
which you want to edit the settings.
2. Click Edit.
The Protection Settings window opens.
3. In the list of Known POP3 commands, clear any command that you do not want blocked.
When you finish editing POP3/IMAP Security settings, click OK to save them and exit the
Protection Details - POP3/IMAP Security configuration window.

IPS Tuning - Best Practices | 16

 Ongoing IPS Maintenance Tuning

Optimizing Web Security Protections

You can manage Web Intelligence to configure the Web server settings to maximize security and
reduce the Security Gateway performance, or the opposite.

Improving Connectivity by Setting Scope

Some inspection settings that are too severe can have a negative impact on connectivity to and
from valid Web servers.
 The HTTP Format sizes protection restricts URL lengths, header lengths or the number of
headers. This is good practice because these elements can be used to perform a Denial of
Service attack on a Web server.
 The ASCII Only Request protection can block connectivity to Web pages that have non-ASCII
characters in URLs. This is good practice because non-ASCII headers or form fields open
vulnerabilities to certain attacks, such as Code Injection.
 The HTTP Methods protection can block certain HTTP methods, known to be unsafe, because
they can be used to exploit vulnerabilities on a Web server.
Although applying these restrictions (activating these protections) is in general good practice, they
may potentially block valid sites or important applications. Applying these protections to specific
Web servers can solve the connectivity problems, and may enhance CPU performance. This
exclusion of a Web server from a particular protection is global to all profiles.

To configure Web Protection scope:

1. Scroll down on a Web Intelligence protection page, to see the Protection Scope area.
2. To apply this protection only to a defined set of Web servers, select Apply to selected web
servers.
3. Click Customize.
 To exclude a Web server from the protection, clear the server checkbox.
 To add a gateway object to the list of Web servers, click Add. From the Set Hosts as Web
Servers window, select the hosts that you want and click OK.
4. To edit a Web server, select the Web server in the list and click Edit.
The Check Point Host window opens, displaying the Web Server category, which is added to a host
that is defined as a Web server.
You can configure connectivity-security balance for each type of Web Intelligence protection in the
Web Server > Protections window, but enforcement of these configurations always depends on
whether they are activated by the Web server's IPS profile.

IPS Tuning - Best Practices | 17

CHAPTE R 4

Performance Tuning
In This Section:
Overview ........................................................................................................................18
Changing IPS Protection Scope ...................................................................................18
Excluding Protections ..................................................................................................19
Gradually Activating Protections .................................................................................20
Monitoring Performance Impact .................................................................................21
Optimizing the Rule Base .............................................................................................21
Monitoring Security Gateway Performance ................................................................21

Overview
When a gateway CPU consistently runs at a high load, it is possible that the active profile is too
heavy for the hardware. We recommend that you change the profile and IPS settings to optimize
IPS for the network.
Use SNMP or SmartView Monitor to monitor CPU load and memory usage for a few days. Make
sure that the gateway meets these hardware statistics to continue to deploy the active profile:
 CPU Load - average load is lower than 30% of the number of cores
 CPU Peaks - short interval peaks (1 - 2 minutes) lower than 50%
 Free RAM - at least 20%
If the gateway does not meet the previous requirements:
 Upgrade to an appliance or server with more powerful hardware
 Run fewer IPS protections in the network
The following sections show different methods to reduce IPS protections and improve gateway
performance.

Note - The performance impact of a protection is almost the same for Prevent and Detect
modes. Prevent mode sometimes drops traffic and does not inspect it.

Changing IPS Protection Scope

You can configure IPS for a gateway to inspect the traffic from the external to internal network
only. Change the IPS protection scope to protect only the internal network. IPS does not run scans
on traffic from the internal to the external network.

To change the IPS Protection Scope:

1. From the navigation tree in the IPS tab, click Enforcing Gateways.
The Enforcing Gateways window opens.
2. Double-click the gateway.
The IPS page of the gateway window opens.

IPS Tuning - Best Practices | 18

 Performance Tuning

3. From the Protection Scope section, click Protect internal hosts only.
4. Click OK.
5. Install the policy on the gateway.

Excluding Protections
It is possible that the IPS profile includes protections that are not necessary for the network. You
can exclude the unnecessary IPS protections for the application or service and improve network
performance. For example, if an organization does not use VoIP services, exclude the IPS
protections for VoIP traffic.

Exclude a Protection Category

IPS Protections are classified into categories of applications and protocols that they protect. If
there are applications that are not used in the network, you can exclude the appropriate category
of IPS protections.

To exclude an IPS category:

1. From the navigation tree in the IPS tab, click Profiles.
The Profiles window opens.
2. Double-click the profile.
The General page of the Profile Properties window opens.
3. From the navigation tree, click IPS Policy.
4. From the Protections to Deactivate section, click Do not activate protections categories.
5. Click Configure.
The Non-Auto Activation window opens.
6. Click Add.
7. Select the category of IPS protections that you are excluding.
8. Click OK.
9. Install the policy.

Exclude a Specified Protection

Often it is not possible to exclude an entire category of IPS protections. However, you can still
exclude individual protections for:
 An application or a feature that you are not using
 An application that is non-vulnerable because it is a fully patched version
To safely exclude protections, make sure that you have all the data about the applications and
services that run in the network. It must be up-to-date, and include data about software versions
and patches.

IPS Tuning - Best Practices | 19

 Performance Tuning

To exclude a specified IPS protection:

1. From the navigation tree in the IPS tab, click Network Exceptions.
The Network Exceptions window opens.
2. Click New.
The Add/Edit Exception Rule window opens.
3. From Profile, select the active profile.
4. From Protection, click Single protection.
5. Click Select.
The Select Protection window opens.
6. Select the IPS protection that you are excluding.
7. Click OK.
8. From the Install On section, click Apply this exception.
9. From the drop-down menu, select the gateway.
10. Click OK.
11. Install the policy.

Gradually Activating Protections

The Recommended Profile does not include protections that have a critical impact on
performance. However, it is possible that you must disable additional protections with a lower
performance threshold to reduce the load on the gateway. If you do not have a detailed
performance analysis of the IPS protections, we recommend that you disable high Performance
Impact protections and then gradually activate them.

Sample Workflow
1. Disable all IPS protections with that are categorized as Critical or High Performance Impact.
2. Identify the protections that protect high-value assets.
a) Enable one protection.
b) Monitor the performance of the gateway.
c) Make sure that the gateway handles the IPS load.
d) Do the previous steps again for other High Performance Impact protections.

IPS Tuning - Best Practices | 20

 Performance Tuning

Monitoring Performance Impact

Check Point categorizes the performance impact of protections based on the industry standard
estimation of network traffic, and emphasizes protocols such as HTTP, DNS, and SMTP. In
addition, you can measure the actual performance impact of the protections and then disable the
ones that use too much CPU.
Use the applicable command in Expert mode to gather statistics about protections impact:
 For R77 and higher, run get_ips_statistics.sh
 For R76 and earlier, run fw ctl sdstat
Carefully review protections that use more than 1% load. If problems persist, send the pm_stats
data to your Check Point resources (Technical Support, Professional Services or Managed
Security Service) for additional analysis.
For more about monitoring performance impact, see sk43733
http://supportcontent.checkpoint.com/solutions?id=sk43733.

Optimizing the Rule Base

The Firewall Rule Base can have a big effect on gateway performance. We recommend that you
make sure that the rules that are used the most are at the top of the Rule Base. For more about
how to configure the Rule Base, see the Firewall Administration Guide for your version.

Monitoring Security Gateway Performance

sk33781 http://supportcontent.checkpoint.com/solutions?id=sk33781 explains how to monitor and
troubleshoot gateway performance and includes these topics:
 Review the CPU load
 Review logs that are related to gateway performance
 Review memory load

IPS Tuning - Best Practices | 21