McAfee HISCDE-AB-IA Product Guide - Page 55

How firewall rule groups work, Common Unsupported Protocols, Making groups location-aware

Get McAfee HISCDE-AB-IA - Host Intrusion Prevention PDF manuals and user guides View all McAfee HISCDE-AB-IA manuals
Add to My Manuals
Save this manual to your list of manuals

Page 55 highlights

Configuring Firewall Policies Overview of Firewall policies ICMPv6 is additionally important in an IPv6 network, as it is used for several critical tasks, such as neighbor discovery (which ARP handles in an IPv4 network). Users are strongly discouraged from blocking ICMPv6 traffic if IPv6 is supported on their network. Instead of port numbers, both versions of ICMP define a handful of "message types." "Echo Request" and "Echo Reply" are used for ping. "Destination Unreachable" messages indicate routing failures. ICMP also implements a Traceroute facility, though UDP and TCP can be used for this purpose as well. Other transport protocols IP supports well over a hundred other transport protocols, but most are rarely used. Nevertheless, the complete list of IANA-recognized protocols is at least minimally supported. Rules can be created to block or allow traffic over all IP transport protocols, though the firewall does not support any multiplexing mechanism these protocols might use. Several are used to overlay other types of networks on top of an IP network (network tunneling). Some of these (notably GRE, AH, and ESP) are used for IP encryption and VPNs. IP protocol numbers are listed at www.iana.org/assignments/protocol-numbers. Common Unsupported Protocols There are several network protocols that the Host IPS firewall does not support. Traffic belonging to these protocols, usually with an unparsible EtherType, is either always blocked, or always allowed, depending on whether the option "Allow traffic for unsupported protocols" in the Firewall Options policy is selected. How firewall rule groups work Group firewall rules for easier management. Rule groups do not affect the way Host Intrusion Prevention handles the rules within them; they are still processed from top to bottom. Groups are associated with many of the items associated with rules, including network options, transport options, applications, and schedules. In addition to these, groups have location settings, which allow you to make groups location-aware and create connection isolation. The settings for the group are processed before the settings for the rules it contains. If there is any conflict between these, the settings of the group take precedence. NOTE: If connection isolation on the Location tab is enabled, a group cannot have associated transport options and applications. Making groups location-aware Host Intrusion Prevention allows you to make a group and the rules it contains location-aware. The Location tab and the Network Options tab of the group allows you to make the groups network adapter-aware, so that computers with multiple network interfaces can have rules apply that are adapter-specific. After enabling location status and naming the location, parameters for allowed connections can include any or all of the following for each network adapter: On the Location tab: • Connection-specific DNS suffix • Gateway IP • DHCP IP • DNS server queried to resolve URLs • WINS server used McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5 55

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
ICMPv6 is additionally important in an IPv6 network, as it is used for several critical tasks, such
as neighbor discovery (which ARP handles in an IPv4 network). Users are strongly discouraged
from blocking ICMPv6 traffic if IPv6 is supported on their network.
Instead of port numbers, both versions of ICMP define a handful of “message types.” "Echo
Request" and "Echo Reply" are used for ping. "Destination Unreachable" messages indicate
routing failures. ICMP also implements a Traceroute facility, though UDP and TCP can be used
for this purpose as well.
Other transport protocols
IP supports well over a hundred other transport protocols, but most are rarely used. Nevertheless,
the complete list of IANA-recognized protocols is at least minimally supported. Rules can be
created to block or allow traffic over all IP transport protocols, though the firewall does not
support any multiplexing mechanism these protocols might use.
Several are used to overlay other types of networks on top of an IP network (network tunneling).
Some of these (notably GRE, AH, and ESP) are used for IP encryption and VPNs.
IP protocol numbers are listed at
www.iana.org/assignments/protocol-numbers
.
Common Unsupported Protocols
There are several network protocols that the Host IPS firewall does not support. Traffic belonging
to these protocols, usually with an unparsible EtherType, is either always blocked, or always
allowed, depending on whether the option "Allow traffic for unsupported protocols" in the
Firewall Options policy is selected.
How firewall rule groups work
Group firewall rules for easier management. Rule groups do not affect the way Host Intrusion
Prevention handles the rules within them; they are still processed from top to bottom.
Groups are associated with many of the items associated with rules, including network options,
transport options, applications, and schedules. In addition to these, groups have location settings,
which allow you to make groups location-aware and create connection isolation. The settings
for the group are processed before the settings for the rules it contains. If there is any conflict
between these, the settings of the group take precedence.
NOTE:
If connection isolation on the Location tab is enabled, a group cannot have associated
transport options and applications.
Making groups location-aware
Host Intrusion Prevention allows you to make a group and the rules it contains location-aware.
The Location tab and the Network Options tab of the group allows you to make the groups
network adapter-aware, so that computers with multiple network interfaces can have rules
apply that are adapter-specific. After enabling location status and naming the location, parameters
for allowed connections can include any or all of the following for each network adapter:
On the Location tab:
•
Connection-specific DNS suffix
•
Gateway IP
•
DHCP IP
•
DNS server queried to resolve URLs
•
WINS server used
Configuring Firewall Policies
Overview of Firewall policies
55
McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5