> Source: [sk181590](https://support.checkpoint.com/results/sk/sk181590)

# sk181590 - IPS Failover Behavior "Prefer security" and "Prefer connectivity" Options 

| Property | Value |
|----------|-------|
| Solution ID | sk181590 |
| Date Created | 2023-10-26 |
| Last Modified | 2024-02-22 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |

## Symptoms

- A failure of a Security Gateway results in an immediate loss of active connections in and out of the organization. Many of these connections, such as financial transactions, may be mission critical, and losing them will result in the loss of critical data. ClusterXL supplies an infrastructure for resilience, where the platform is synchronizing connections, security information, traffic flows and inspection statuses from the Firewall and Threat Prevention blades, such as IPS, Application Control, Anti-Bot, and others, to other Security Gateway states between the Cluster Members. The synchronization information is mostly related to parsed information from the traffic flows, protocol flags and additional information. These are used to maintain the inspection flow and the security levels in a failover scenario. Some limitations apply to such scenarios. For example, in case of the re-assembly of traffic or DPI (Deep Packet Inspection,) where the data portion information from the traffic was not synchronized across cluster members.

## Cause

To address the situation, the IPS blade has two failover settings which are designed within the main engine flow in an event of a failover (when one member in a cluster fails and another member takes over.)  

Upon failover in cluster:  
**Prefer security**- Close connections for which IPS inspection cannot be guaranteed:  

* This mode is more secure.
* All active connections for IPS which do not have the full required data to continue the inspection will be dropped:
  * UDP packets are always dropped because they are stateless
  * ICMP connections are not dropped
  * Fully accelerated TCP connections are not rejected
  * All other TCP connections are rejected

Example of this use-case:  
An attack took place on a certain connection that was divided into 4 packets, and 3 packets were accepted on the former Active member.  
At this point a cluster failover occurs.  
The new Active member does not have the data of the first 3 packets, but only received the 4th packet.  
It is more secure to terminate the connection rather than to keep the connection alive.  

**Prefer Connectivity**(default) - Keep connections alive even if IPS inspection cannot be guaranteed:  

* Active connections will continue to flow after the failover, however the inspection engines will not inspect all elements -- meaning missing items will be skipped. This is related to the DPI parts of the specific session.
* Once a new session is established, all inspection elements will continue to function as usual
* In this use-case, the impact on failover will be minimal, however the inspection for the specific cutoff will be reduced.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content