IPS profiles out-of-the-box will wreck legacy SCADA/ICS protocols. Default threat prevention is too aggressive for older industrial systems that don't follow modern TCP/IP norms.
Start by isolating this traffic with a dedicated rule. Then tune.
* Create a rule above your standard IPS policy.
* Use precise source/destination (controllers, HMIs, PLC networks).
* Set the action to "Accept" and enable "Track: Log".
* In the rule's IPS properties, attach a dedicated profile.
Your IPS profile should start with these adjustments:
```bash
# In SmartConsole, edit your IPS profile for this rule:
Protections > By Protocol > Industrial > Siemens S7
- Set "Performance Impact" to Low
- Set "Severity" to Low
- Action: Override to "Prevent" (not "Inactive")
# For the broader category:
Advanced Settings > Performance
- Set "Trigger Sensitivity" to Low
- Enable "Performance Optimization"
```
Key points:
* Do not set protections to "Inactive". You lose logging.
* "Low" severity/impact settings still block critical known exploits but ignore anomalous padding or retransmissions.
* Monitor logs for 48 hours. Correlate blocks with operator reports. Add false positives to the profile's Exceptions list with a source/destination scope.
* This is a band-aid. Real fix is network segmentation and protocol-specific gateways.
-dk
Trust but verify, then don't trust.
Great start on the granular IPS adjustments. One thing I always add to the monitoring phase is a quick cross-check with your asset management system. If a flagged device isn't in the CMDB as a critical controller, it's a strong candidate for a false positive you can safely suppress.
Also, consider setting up a separate log server just for that rule's traffic during your 48-hour watch. It makes correlating those blocks with operator tickets much cleaner.
And a small caveat on "Prevent" vs. "Inactive" - you're right to keep logging, but double-check that your SIEM or logging tool is actually ingesting those "Prevent" logs for the tuned profile. Sometimes they get filtered out by default if you're only alerting on "Medium" and above.
Ask me about my RFP template
Good baseline config, but your profile edits are incomplete. The key is in the exception list for each protection.
After you set Performance Impact to Low, go into the specific S7plus variant protection. The default signature catches malformed packets that old controllers send normally. Add an exception for your source PLC IPs. Use the comment field to tag it as a legacy device.
Logging "Prevent" actions only works if your logging profile for that rule has "Log Implicit Drops" enabled. Otherwise you see nothing. Check that first.
Benchmarks don't lie.
That's a good point about the exceptions list. I always forget that step after changing the base settings.
When you add an exception for the PLC IPs, does the source need to be just the specific PLC, or should I also include the engineering workstation that talks to it? I'm thinking both might generate similar malformed traffic.
Trying to figure it out.