Endpoint Protection

 View Only
  • 1.  Blocking Site USing SEPm rules

    Posted Feb 27, 2012 01:07 AM

    Hi,

     

    I want to blocke perticular site using Firewall or custom IPS signature...I tried it using following

    http://www.symantec.com/connect/articles/how-block-internet-address-sep-manager-firewall-rule

    also created a custom IPs signature

    rule tcp, dest=(80,8080), msg="Accessing Google Website", content=www.google.com

    rule tcp, dest=(80,8080), msg="Accessing Google Website", content=www.google.*

     

    But not succeeded...

    Please help me out...



  • 2.  RE: Blocking Site USing SEPm rules

    Broadcom Employee
    Posted Feb 27, 2012 01:16 AM

    can you check the links

    Block certain websites

    http://www.symantec.com/business/support/index?page=content&id=TECH95248

                               

    Blocking a Website using Symantec Endpoint Protection

    http://www.symantec.com/docs/TECH92405



  • 3.  RE: Blocking Site USing SEPm rules

    Broadcom Employee
    Posted Feb 27, 2012 01:17 AM

    also verify the policy has been applied on the client. Have you enabled logging? do you see entry?



  • 4.  RE: Blocking Site USing SEPm rules

    Posted Feb 27, 2012 02:37 AM
      |   view attached

    Hi,

     

    Followed the following document

    http://www.symantec.com/docs/TECH92405

     but Not succeeded...

     

    Please find attached policy...

    Attachment(s)

    zip
    New Folder_1.zip   2 KB 1 version


  • 5.  RE: Blocking Site USing SEPm rules

    Trusted Advisor
    Posted Feb 27, 2012 06:06 AM


  • 6.  RE: Blocking Site USing SEPm rules

    Posted Feb 27, 2012 11:32 AM

    Your IPS signatures have errors:

    rule tcp, dest=(80,8080), msg="Accessing Google Website", content=www.google.com

    rule tcp, dest=(80,8080), msg="Accessing Google Website", content=www.google.*

    The content part must be surrounded by "", e.g. content="www.google.com". Asterisks don't work with the content keyword, you have to use the regexp keyword. See the SEPM online help for its dreadful syntax.

    I would not use custom IPS signatures for blocking web sites. With your approach, you are blocking all data packages with the content "www.google.de" (including this very site blush).

    Your firewall rule is perfectly fine and working in my test environment.

    Please check your User Control Level (Clients > [Group] > Policies > Location-specific settings > Client User Interface Control Settings):

    • Client Control means your SEP client ignores the SEPM firewall rule and uses its own one.
    • Mixed control means your SEP client uses firewall rules in following order: SEPM rules above blue line in firewall rules form,  SEP client rules, SEPM rules below blue line.
    • Server Control means that your SEP client only uses SEPM firewall rules.

    If required, switch to Server Control and try again.

    And as Pete says, check if SEPM policy is applied on the client. Compare the policy serial numbers of the SEPM and the client (Help > Troubleshooting).



  • 7.  RE: Blocking Site USing SEPm rules

    Posted Feb 27, 2012 11:37 AM

    I forgot that you can check the client system log (View Logs > Client Management/View Logs > System Log) for syntax errors in your custom IPS signature. A red symbol makes these entries easy to recognize.



  • 8.  RE: Blocking Site USing SEPm rules

    Posted Feb 27, 2012 06:30 PM

    Domain name blocking is configurable in firewall policy.