IPS action "Bypass Session" making confusion

Hi Deepak,

The action will be taken considering the order of the added rules in the IPS Policy. The scanning will be done in TOP to BOTTOM direction, if there is a drop action rule on the top of bypass action rule then, the signature connection will be dropped.

Thanks,

Hi,

I agree with you that scanning will be done from TOP to BOTTOM direction and If any signature will match, applied the action and skip for more testing. 

My Question is based on below picture-

Now, I have selected the bypass session in the action menu. Then what will difference in the action between Recommended and Bypass Session?

Regards,

Deepak Kumar

Recommended actions are shown in the right column of the configuration window of the screenshot. If you select the action as Bypass Session, then this custom setting will override the Default recommended action and bypass, i.e., allow the signature. 

Thanks,

Hi,

Thanks for your update.

If it will allow the signatures then why I will configure IPS? 

It will same as I will not configure the IPS under the firewall policy or I will change the default action to Bypass. Why will I increase latency and system resource uses on the hardware?

Regards,

Deepak Kumar

Hi Deepak,

In case of false positives, it will be helpful to bypass one signature than to disable the whole policy.

Thanks