> Source: [sk179706](https://support.checkpoint.com/results/sk/sk179706)

# sk179706 - Security Gateway enforces policy for traffic on internal interface when enforcement is disabled

| Property | Value |
|----------|-------|
| Solution ID | sk179706 |
| Date Created | 2022-07-20 |
| Last Modified | 2022-07-28 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R81.10 (EOS), R81 (EOS) |

## Symptoms

- * After users disables policy enforcement for traffic at an internal interface, enforcement is enabled automatically:


  ```
  
  [Expert@GW:0]# date
  Wed Jul 20 14:25:36 CEST 2022
  [Expert@GW:0]# fwaccel dos config set --disable-internal
  [Expert@GW:0]# fwaccel dos config get |grep internal
  internal: disabled
  [Expert@GW:0]# date
  Wed Jul 20 14:26:35 CEST 2022
  [Expert@GW:0]# fwaccel dos config get |grep internal
  internal: enabled
  ```

  <br />

* IOC - Custom Intelligence Feeds is enabled.

## Cause

This behavior is caused by Custom Intelligence Feeds.  

When external custom intelligence feeds are enabled, the threat prevention logic runs this command every few minutes: `fwaccel dos config set --enable-internal`  

For more information about Custom Intelligence Feeds, see:  

* [Threat Prevention Administration Guide](https://supportcenter.checkpoint.com/supportcenter/portal?model=&version=&os=&productTab=documents&product=426&eventSubmit_doShowproductpage=) for the relevant version \> Chapter "Configuring Advanced Threat Prevention" section "Settings" \> Section "Configuring Threat Indicators" \> Section "Importing External Custom Intelligence Feeds"
* [sk132193 - What is the "Custom Intelligence Feeds" feature?](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk132193)

<br />

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content