IPS disabled however rules still seem to be being applied

Hi,

the IPS is used whether you have it in rules or not, it is part of the packet/application classification function.

Also please see this thread on the same subject.

https://community.sophos.com/products/xg-firewall/f/intrusion-prevention/113843/ips-log-data-sent-on-stream-after-tcp-reset-received

Ian

What Firmware are you running?

That KBA only applied to:

Sophos Firewall XG Software v17.1.3 MR3 and earlier as it was Disabled by default after that.

17.5.6

It seems to have worked though

Hi,

How strange though - I am on MR-6 and if I run that command I get "Already Configured" back as a message so Sophos must have changed it in MR-6 as I have never configured this before.