IPS Exception not working

What happens if you create a second exception list for the other subnet (to destination)?

ThorstenSult said:

What happens if you create a second exception list for the other subnet (to destination)?

 

Hi Martin,

If this is a specific rule that is always triggered (48814 given this log), you could try to modify this rule to either disable it or change it to alert in the advanced tab. 

Regards,

Karl-Heinz

Hi Karl-heinz,

Thanks for pointing out ;-)

Only thing is, that if another host/server behind the UTM, get's the SAMSAM attack, then it would just ignore it, therefore I hoped for the host exception to work, but there is a problem with UTM in that matter I see.

Tried to change from IPSEC to RED Site-2-site, just for fun, but of course, the issue remains :-)

Hi  

I assume the network definition is not bound to any interface. With that in mind, would you please try changing the condition from AND to OR and see if that helps? (I know it sounds funny).

Hi Jaydeep 

Just tried, but still an issue, this one helps, but will drop the ID's permanently for all networks...

Not working:

Hello Martin,

Just a silly thought... does VEEAM backup keep connections open all the time or does it start new connections everytime? IPS exceptions are applied to new connections, not existing ones.

If not sure, I think you can force it by disabling one of the interfaces, then re-enable.

Regards,

Karl-Heinz

Hi,

Sorry the delay :-)

No unfortunately it's still the same. I rebooted veeam server also, with no effect, only thing that do work it the "advanced" pane and change the way it should report. 

I will commit to support ticket :-)

Hi Twister,

I'm experiencing the same issue at the moment.

Did you open a support ticket and find out anything?

Thanks in advance.

Hi Hermann0,

Yes, support tried a lot, but finally found out, that when making IPS exceptions, I could not choose the service,but only the device, and to be sure with my traffic, we had to add them as here:

It did not look that it was something they would fix, as this works as designed, I was told :-)

I just needed to know it first:-)