how does CheckPoint R65/R70 handle IPS violations of outbound traffic from hosts that are NAT'ed? Is it necessary to include the NAT'ed IP in the exceptions list or is it sufficient to include the private IP address?
Assuming that you are running IPS and FW-1 blade on a single system, rather than as standalones. Also assuming that the NAT rules are part of the same FW-1 enforcement module that the IPS is running on.
The packet will enter the firewall kernel, be processed for SecureXL/ClusterXL/CoreXL, state table check, blah blah blah, go up the chain, be evaluated against security rulebase, which would determine if IPS inspection is neccessary, then processed down the chain outbound ... NATS applied, encrypt/log, and send to the OS for routing. So the IPS would check on the untranslated IP.
I'm going to double check my SE materials when I get home but I'm 99% sure on this.
For sure 'fw ctl chain' will show you the processing order of all your FW-1 components. what you would be looking for is that it is passed to IPS before it leaves "FW VM Outbound" (which would be with NAT rulebase applied).
Footnote: The IPS architecture is actually different in R65 and R70. R65 is the old SmartDefense and R70 IPS comes from the acquisition of Network Flight Recorder and the integration of that technology. The <=R65 method of determining if a packet requires NAT is with rules (service definitions) in the security rulebase. With R70, you have your own IPS rulebase.