HI,

The firewall component needs to be installed on the client machines so that the Firewall policy will be effective.

You have 2 options.

1. Create an install package with Firewall enabled, and deploy it to the workstations.

2. Assign an upgrade package to the group using Upgrade Groups with package. and when it asks you to keep the same settings, you can choose the approproate feature set so that firewall component will be installed.

After doing this, you can enable the firewall policy and see the results.

Best,
Aniket

hi,

for upgrade groups with package option, If I uncheck Maintain existing client features when updating, can I just select only network threat protection as I already have installed av and antispyware components? or should i select Antivirus, Antispyware, and TruScan Proactive Threat Scan?

also..issit possible to monitor the upgrade status from sepm?

Faizal

No , you should select all the packages what you want to get installed.
Yes, you can monitor the upgrade status from sepm 
open sepm
reports
report type: Report type
select a report: Select a report:
this will give you the migration report.

so..in this case..only network threat protection?

if you uncheck maintain exisiting feautuers you will get these options
If you want to install AV /AS , PTP, NTP ---------select all features will install all the components
If you want to install Only ntp -----------will uninstall whatever you have earlier and will install only NTP
If you want to installAV and PTP ---select AV and PTP only  

this should help

How to add or remove features to existing Symantec Endpoint Protection client installations

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008111808135348
 

You can use the article mentioned by Rafeeq to create a Feature Set. And choose that feature set in the upgrade wizard.

Aniket

thanks...

by the way...can the upgrade be done with the GUP? also, if i select download source from url, where do i find the existing upgrade files so that I can put it on the 2nd / 3rd server?

Upgrade cannot be done through GUP

Upgrade cannot be done through GUP

what about the upgrade source? where is it located? so that i can distribute it to other servers and make clients download from them

It is present in your SEPM itself.While installing the SEPM it is getting added to the SEPM.Otherwise while upgrading the SEPM new package will get added or you can add it manually also.I think in your case only default package is req

you can export a package from sepm ( client install package)
put it in a shared drive and ask clients to run the setup from there.