Filtering network traffic on multiple computers

Article:HOWTO47567  |  Created: 2011-03-29  |  Updated: 2011-04-18  |  Article URL http://www.symantec.com/docs/HOWTO47567
Article Type
How To


Subject


Filtering network traffic on multiple computers

(Intel AMT only)

The Intel AMT network filtering (Circuit Breaker) functionality lets you block network traffic from and to the target computers' operating systems. For example, you can use this feature to isolate infected computers from the network.

Note:

Network Filtering works only if both client operating system and Intel AMT network settings are configured to use Dynamic Host Configuration Protocol (DHCP).

Some ports stay open when network filtering is active. You can customize the ports that you want to stay open.

See About network filtering ports and settings.

You can also perform this task on a single computer in real time.

See Filtering network traffic .

See Modifying the list of open network filtering ports.

To apply the network filtering settings

  1. In the Symantec Management Console, on the Manage menu, click Jobs and Tasks.

  2. In the left pane, click System Jobs and Tasks > Real-Time System Manager.

  3. Click Network Filtering.

  4. If you want to block network traffic to and from the operating system, do the following steps:

    • Click Filter network traffic other than to and from the Notification Server.

    • Choose if you want to use the solution default filtering settings or browse for a custom .xml file.

      See Network Filters page.

    • If you want to prevent the target computer from sending malicious packets, check Enable anti-spoofing filter. This feature forces the identity verification of outgoing network traffic and drops packets if the computer is suspected of originating malicious attacks that are known as IP spoofing.

  5. If you want to protect the target computer from network flooding, click Limit the number of PING packets to and type the number of packets per second allowed to pass through the Intel AMT network filter.

    Default: 10 packets per second.

  6. If you want to disable network filtering, click Allow all network traffic.

  7. Click Save changes.

  8. Run the task one time or on a schedule.

    For information on how to run tasks, see the Symantec Management Platform Help.


Legacy ID



v12761822_v56975590


Article URL http://www.symantec.com/docs/HOWTO47567


Terms of use for this information are found in Legal Notices