Threat protection on a specific VLAN

[Mr-cook]

Hi,

Could we enable Threat protection on a specific VLAN instead of all Vlans please ?

regards,

[Nash]

Unfortunately, by default this is applied across everything the MX sees. If you need more granularity than that, you'll need an additional device.

You can try asking support if they can disable it for only one vlan. No idea what their answer would be.

[SoCalRacer]

Threat protection includes AMP, which can be turned off by VLAN, you can use a Group Policy and apply the group policy to a specific VLAN.

I don't think there is a way to turn off IDS though.

[Nash]

I should have specified, I was thinking of the IDS/IPS. I think of AMP as AMP. 

Didn't realize you could disable AMP by vlan via group policy. That could be useful.

[SoCalRacer]

We use it a lot for client either blaming AMP if they know what it is or saying they can't get to something (Software updates seems to be the most frequent). We use a group policy to turn AMP off and then apply it to their device. If it fixes the issue and is able to be reproduced then we add AMP whitelist to main settings and remove device from that policy.