topic Re: updating IPS rules and applying them on fmc risks in Network Security

updating IPS rules and applying them on fmc risks

baselzind — Tue, 03 Nov 2020 09:48:17 GMT

i have a fmc with 2 years old ips rules , is there a risk if update the ips rules and applied them to a production environment?

Re: updating IPS rules and applying them on fmc risks

Mohammed al Baqari — Tue, 03 Nov 2020 12:11:13 GMT

Hi,

Try to update IPS rules then run recommendation task. Once recommendation
is completed, try to apply the IPS rules. This is safer approach.

After couple of days of monitoring, you can tweak rules as needed.

**** please remember to rate useful posts

Re: updating IPS rules and applying them on fmc risks

Marius Gunnerud — Tue, 03 Nov 2020 12:24:36 GMT

I agree with Mohammed here.

1. Disable inline drop

2. Run the generate recommended rules

3. Monitor for a few days to identify if there are any false positives

4. Activate inline drop

Once the rules are updated, I would suggest setting a scheduled task that updates the IPS rules on a regular basis.