Optional: Disabling or forcing blocking for all IPS rules (CLI)

This topic is relevant only if your appliance is deployed inline and the monitoring interface is configured for inline blocking.

When an IPS rule matches a traffic flow, the action taken on the traffic flow is determined by the IPS blocking mode setting on the appliance and the blocking action specified by the matched IPS rule. By default, IPS appliances operate with IPS blocking mode set to enabled. When a traffic flow matches an IPS rule, the system blocks or allows the traffic as specified by the blocking action of the rule. For a detailed description of IPS blocking mode, see Action Overrides to All IPS Rules.

During the initial baselining phase of your IPS deployment, you will likely use the two non-default settings for IPS blocking mode.

Observing IPS in a Production Environment

If you are already running a standard Network Security appliance in a production environment, then initially you might want to evaluate IPS by operating the feature in monitoring mode. If you set IPS blocking mode to disabled), the system generates IPS events, IPS alerts, and IPS notifications, but no traffic is blocked.

Validating IPS Policies and Custom IPS Rules in an Acceptance Testing Environment

To test the accuracy of an IPS policy and custom IPS rules (if you have them), you apply the policy to an interface that carries known test traffic. For this type of testing, all IPS rules must block traffic regardless of the action specified by the matched rules. To configure this behavior, you set IPS blocking mode to all.

After you complete these types of tests, be sure to re‑enable the platform to block or allow matched traffic as specified by the IPS rules. Otherwise, your system will continue to pass all matched traffic or block all matched traffic.