Advanced Settings
Quantum Spark 1500, 1600 and 1800 Appliance Series R80.20.40 Locally Managed Administration Guide | 145
Streaming
Engine Settings
Attribute
Description
TCP SYN
Modified
Retransmission
A TCP SYN packet may be retransmitted with a changed sequence
number in an attempt to initiate a connection that IPS does not inspect.
This blocks a SYN retransmission where the sequence number has
been modified. When set to detect, such retransmissions cause the
traffic to bypass deep inspection blades.
TCP Urgent Data
Enforcement
Some TCP protocols, such as Telnet, send out-of-band data using the
TCP URG bit as part of the protocol syntax, whereas most protocols
don't use the TCP out-of-band functionality. Allowing packets with the
URG bit may prevent the gateway from determining what data would be
processed by the receiving application. This could lead to a situation
where the data inspected by the gateway is not what the receiving
application processes, thus allowing IPS protections to be bypassed.
When a packet with the URG bit is received in a protocol that does not
support out-of-band functionality, the gateway cannot determine
whether the receiving application processes the data. This removes the
URG bit from TCP segments with the URG bit set in protocols which do
not support the TCP out-of-band functionality. When set to detect, usage
of the URG bit causes the traffic to bypass deep inspection blades.
Stream Inspection
Timeout
A connection being inspected by a dedicated process may be delayed
until inspection is completed. If inspection is not completed within a time
limit, the connection is dropped so that resources are not kept open.
This blocks connections whose inspection timeout has expired. When
set to detect, exceeding the timeout causes the traffic to bypass deep
inspection blades.
Table: Streaming Engine Setting Attributes (continued)
Threat
Prevention
Anti-Bot Policy
Attribute
Description
Resource
classification
mode
Indicates the mode used by the Anti-Bot engine for resource classification:
n
Hold
- Connections are blocked until classification is complete.
When a connection cannot be classified with the cached responses,
it remains blocked until the Check Point Online Web Service
completes classification.
n
Background
- Connections are allowed until classification is
complete. When a connection cannot be classified with a cached
response, an uncategorized response is received. The connection is
allowed. In the background, the Check Point Online Web Service
continues the classification procedure. The response is then cached
locally for future requests. This option reduces latency in the
classification process.
Table: Threat Prevention Anti-Bot Policy Attributes
