Video Screencast Help
Search Video Help Close Back
to help

Blocking websites

Created: 26 Dec 2012 | Updated: 31 Dec 2012 | 5 comments
jamesdsilva's picture
jamesdsilva
0 0 Votes
Login to vote
This issue has been solved. See solution.

Hello frinds,

Please help me in this issue and share ur valuable guide.

How to block/allow website access using the Symantec Endpoint Protection Manager

custom Intrusion Prevention Signature policy.

 

 

Best Regards,

J.Dsilva

Discussion Filed Under:
, ,

Comments 5 Comments • Jump to latest comment

Ambesh_444's picture
Ambesh_444 Partner Accredited
Blocking websites - Comment:26 Dec 2012 : Link

Hi Dsilva,

 

Please go through the below  link 
 
https://www-secure.symantec.com/connect/forums/it-...
 
There is a document for creating IDS too, check that..
 
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008070803545448
 
http://service1.symantec.com/SUPPORT/ent-security.nsf/2326c6a13572aeb788257363002b62aa/9c561a4628b3c9a44925747f007b19cd?OpenDocument
 
 
I hope this will help yuo.

 

Thank& Regards,

Ambesh

Please mark your thread as 'SOLVED' with the answer that helps you.

SOLUTION
+1
Login to vote
  • Actions
Ashish-Sharma's picture
Ashish-Sharma
Blocking websites - Comment:26 Dec 2012 : Link

Hi,

Check this 

 

Allow & Block websites using SEP firewall

https://www-secure.symantec.com/connect/videos/allow-and-block-websites-using-symantec-endpoint-protection-firewall

How To Block Internet addres via Sep Manager Firweall Rule

Thanks In Advance

Ashish Sharma

SEPM Knowledgebase Documents  

 

0
Login to vote
  • Actions
Ajit Jha's picture
Ajit Jha Partner
Blocking websites - Comment:26 Dec 2012 : Link

You can Block websites using SEP Firewall. Follow the steps below:

  1. Click on Policies button
  2. Under view Policies > Select Firewall
  3. Edit the existing Firewall Policy
  4. Click Rules
  5. Right Click Rule Number 2 and Select Add a Blank Rule
  6. Right Click Under the Action and Set it to Block
  7. Right Click on the Host Select Edit
  8. Under Specify host names or addresses of computers that trigger the rule Select : Local /Remote
  9. Under Remote Click Add Under Type Select DNS domain
  10. Under DNS Domain type the name of the Website e.g. : *.symantec.com
  11. Click OK and close the Host List Window
  12. Click OK and close the Firewall Policy Window
  13. Assign the policy to the desired group

Regard's

Ajit Jha

Technical Consultant

ASC & STS

+1
Login to vote
  • Actions
Brian81's picture
Brian81 Trusted Advisor
Blocking websites - Comment:26 Dec 2012 : Link

To use custom IPS, use the following syntax:

rule tcp, dest=(0), saddr=&LOCALHOST, msg="Website Blocked", content="example.com"

You may need to change the dest=(0) to whatever port such as 80 or 443, assuming you use the standard web browsing port.

SEP Knowledge Base

Endpoint SWAT

0
Login to vote
  • Actions
Mithun Sanghavi's picture
Mithun Sanghavi Symantec Employee Technical Support Accredited
Blocking websites - Comment:26 Dec 2012 : Link

 

Hello,

Follow these steps as You do not want the users to visit to any website except for certain sites no matter what browser they use.

Solution

The above configuration can be done by creating only 2 firewall rules. Please follow the below steps to configure the rules.

1. Go to Firewall policy > Rules.

2. Click on Add Rule button. Select Host > Next > From Address Type drop down menu select DNS domain.

3. Select DNS Domain as *.* then Click Next > Click Finish.

4. Once the rule is created, highlight the New Rule. Go to Service column, right click and edit, then select Add. The rule will be TCP, Source/destination with remote port 80,443 click ok and ok again. Then go to Action column and make it set to "Block".

The above rule is to block all the websites. To create a rule to allow only selected websites, please follow the steps below.

1. Go to firewall policy> Rules.

2. Click on Add Rule. Select Host > Next > From Address Type drop down menu select DNS domain.

3. Enter DNS Domain as *.*symantec*.* This is an example which means all the urls related to symantec will be allowed.

4. Click Next > Click Finish. Multiple websites can be added to the same rule.

5. Once the rule is created, highlight the new rule. Go to Action column and make it to Allow.

Note: Place the "Allow" rule on top of "Block" rule.

Assign the policy to the required group. This will allow only the selected website and block all other website.

Caution: If the above rule is applied to the SEPM itself, we need to allow Symantec domain in order to run the liveupdate. This should be applicable to all the machine where Liveupdate will run.

 

Plaese find the article and let me know.

https://www-secure.symantec.com/connect/articles/how-block-internet-address-sep-manager-firewall-rule

1) How to block/allow website access using the Symantec Endpoint Protection Manager custom Intrusion Prevention Signature policy

http://bit.ly/uLiS84

2) Video: Allow and Block websites using Symantec Endpoint Protection Firewall

https://www-secure.symantec.com/connect/videos/allow-and-block-websites-using-symantec-endpoint-protection-firewall

3) Article: How To Block Internet address via Sep Manager Firewall Rule

https://www-secure.symantec.com/connect/articles/how-block-internet-address-sep-manager-firewall-rule

 

Hope that helps!!

Mithun Sanghavi
Symantec Technical Support Engineer, SEP
MIM | MCSA | MCTS | STS | ITIL v3

Twitter: @mithun_sanghavi

Don't forget to mark your thread as 'SOLVED' with the answer that best helps you.<&a

+1
Login to vote
  • Actions