Join the Conversation

To sign in, use your existing MySonicWall account. To create a free MySonicWall account click "Register".


IPS use Match Object to exclude Detection

Hello.. me again i know... :)

ok, i get two ICMP IPS detection which i wanted to exclude for a server.

So i created a Match Object. But i cannot find a place to put this into a policy to exclude it for one server.

I could exclude detection on IPS signature based level but just wanted to exclude it for one server.

Can you help me with that?

thank you!


Category: Entry Level Firewalls

Best Answer

  • Options
    ArminFArminF Newbie ✭
    Answer ✓

    OK, Exclude Range can also be a Single IP.....

    But what for the Match Object then?


  • Options
    BWCBWC Cybersecurity Overlord ✭✭✭

    @ArminF Match Objects are used for App Rules, there is a Policy Type of "IPS Content" where your Match Object would be selectable.


  • Options
    ArminFArminF Newbie ✭

    Thanks Michael

    Ok, i reverted the change on the signatures directly to exclude the server.

    Created a Match Object IPS added the two option i do not want to be logged.

    Added a App Policy IPS rule and used the match object to exclude it from being logged.

    lets keep fingers crossed :)

  • Options
    ArminFArminF Newbie ✭

    Well, this is strange....

    Even when i set the App IPS Policy Rule with its Adress Source (my server) it does not save it.

    So it would i assume exclude this for all ips on the network.

    Anything i miss here?

    In this case i would might be the better way to exclude it on the IPS signatures instead of using a exclusion policy.


  • Options
    BWCBWC Cybersecurity Overlord ✭✭✭

    @ArminF I would definitly go for excluding the IPS Signature instead of using an AppRule, because the amount of AppRules you can configure is limited, and maybe more performance hungry.

    Even Bypassing IPS in an AppRule does not hinder the IPS to log, I checked a couple ways on a Gen6 Appliance and it always got logged. Cannot say for sure if it really gets bypassed, because usually I do this on IPS itself, which works fine.


  • Options
    ArminFArminF Newbie ✭

    Michael you really rock!

    Understood Sir! 😀

    Ok, will change and use exclusion on the IPS signature tab.

    Maybe create a group instead of using single entries.

    " a group for every user" i leaned once ...

Sign In or Register to comment.