WEB-IPS is already on HTTP-WEB, in prevention mode, yet a SQL injection against the search page reaches SRV. Before you write any rule, check what the policy actually turns on: the base policy decides which built-in rules run.
The simulator ticks each one as soon as the network meets it.
On LAP1, send a normal search and the injection. Both arrive: traffic tcp 203.0.113.10 80 payload "GET /search?q=shoes", then traffic tcp 203.0.113.10 80 payload "GET /search?q=' or 1=1--".
Read WEB-IPS (show ips-policy WEB-IPS, or the Intrusion screen): rule 1000104, SQL injection, is disabled in base Connectivity. Change the base to Balanced Security and Connectivity, keeping prevention mode.
Deploy. On LAP1, the injection is dropped by rule 1000104, and the normal search still arrives.
