McAfee HISCDE-AB-IA Product Guide - Page 52

Configuring Firewall Policies, Overview of Firewall policies

Get McAfee HISCDE-AB-IA - Host Intrusion Prevention PDF manuals and user guides View all McAfee HISCDE-AB-IA manuals
Add to My Manuals
Save this manual to your list of manuals

Page 52 highlights

Configuring Firewall Policies The Host Intrusion Prevention firewall policies turn protection on and off and provide rules to stop network intrusions that could compromise data, applications, or the operating system. Contents Overview of Firewall policies Enable firewall protection Define firewall protection Overview of Firewall policies The Host Intrusion Prevention firewall feature provides security by filtering traffic into and out of networked systems running Windows. Stateful filtering and packet inspection identify packets for different types of connections, and hold in memory the attributes of network connections from start-to-finish of transmission. A Host IPS catalog simplifies rule creation by allowing you to add existing rules, groups, network options, applications, executables, and locations from the catalog to new and existing firewall rules and groups. It also allows the addition of these elements to the catalog either on an item-by-item basis or by batch process. Available policies There are three Firewall policies: Firewall Options - Enables firewall protection. It turns firewall protection on and off, defines stateful firewall settings, and enables special firewall-specific protection such as allowing outgoing traffic only until the firewall service has started, and blocking IP spoofing and malicious traffic. Firewall Rules - Defines firewall protection. It consists of a set of rules that defines what traffic is allowed and what is blocked. You can define rules broadly (for example, all IP traffic) or narrowly (for example, identifying a specific application or service), with various network, transport, application, and schedule options. You can group rules according to a work function, service, or application for easier management. Like rules, rule groups can be defined by network, transport, application, schedule, and location options. Firewall DNS Blocking - Defines a set of domain name patterns, which can include wildcards, that are to be blocked. When applied, this policy dynamically adds a rule near the top of the firewall rules list that prevents resolving the IP address of the specified domain. 52 McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
Configuring Firewall Policies
The Host Intrusion Prevention firewall policies turn protection on and off and provide rules to
stop network intrusions that could compromise data, applications, or the operating system.
Contents
Overview of Firewall policies
Enable firewall protection
Define firewall protection
Overview of Firewall policies
The Host Intrusion Prevention firewall feature provides security by filtering traffic into and out
of networked systems running Windows. Stateful filtering and packet inspection identify packets
for different types of connections, and hold in memory the attributes of network connections
from start-to-finish of transmission.
A Host IPS catalog simplifies rule creation by allowing you to add existing rules, groups, network
options, applications, executables, and locations from the catalog to new and existing firewall
rules and groups. It also allows the addition of these elements to the catalog either on an
item-by-item basis or by batch process.
Available policies
There are three Firewall policies:
Firewall Options
— Enables firewall protection. It turns firewall protection on and off, defines
stateful firewall settings, and enables special firewall-specific protection such as allowing outgoing
traffic only until the firewall service has started, and blocking IP spoofing and malicious traffic.
Firewall Rules
— Defines firewall protection. It consists of a set of rules that defines what
traffic is allowed and what is blocked. You can define rules broadly (for example, all IP traffic)
or narrowly (for example, identifying a specific application or service), with various network,
transport, application, and schedule options. You can group rules according to a work function,
service, or application for easier management. Like rules, rule groups can be defined by network,
transport, application, schedule, and location options.
Firewall DNS Blocking
— Defines a set of domain name patterns, which can include wildcards,
that are to be blocked. When applied, this policy dynamically adds a rule near the top of the
firewall rules list that prevents resolving the IP address of the specified domain.
McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5
52