Endpoint Protection

Hi everyone,

I'm having a hard time creating a policy to allow this specific application on SEP firewall. The only firewall policy that works properly was the contradiction to the default policy "Block all other IP traffic" (second to the last rule). Kindly see attached for the logs for my testing and for the squiggle client.

Thanks,

Attachment(s)

firewalllogs.txt   314 KB 1 version

Squiggle-3.3 Client.zip   3.07 MB 1 version

Squiggle.exe is allowed as per the logs

from rule 5 (outgoing)and its again blocked by rule 15 ( incoming)

can you move this rule 5 to the top, above the blue line and make it allowed for outgoing and incoming also

Hi Rafeeq,

Thanks for the reply, rule 5 is "Block ICMPV6" ?

Hi Rafeeq,

Still the same. The second to the last rule block it. I already created a rule to allow *squiggle* to any host, and IP service but still the second to the last rule block it.

These rules are processed in order, if it does not finds the match the second last is blocking it.

did you add the application or souce / dest ip , 

For incoming rule you might need to add TCP

Yes I already did. I'm just wondering why the firewall rule still afftect the squiggle when I specified the application and configure other to "any". Is it ok if you test on your side the scenario? the squiggle is just a folder base application, you just need 2 clients to check their connection.

Thanks

whats the version of SEP you are using? 

Its 12.1 ru3 sir.

As a workaround, create a new FW rule and try to allow port 9998 (TCP and UDP) for both incoming and outgoing traffic. Leave the application field blank.

Thanks greg. It works fine allowing only 9998 UDP for both incomung and outgoing traffic. But I dont want to leave the application on any. Any idea what applications should I only allow? Allowing only squiggle wont work.

If allowing only squiggle.exe doesn't work, I would use a program such as tcpview to see what other executable is trying to communicate out...

Hi Brian,

Thanks for some advise, can you check the logs I create using TCP view? Thanks

Attachment(s)

tcpviewlog.txt   6 KB 1 version

Are you defining it as "squiggle.exe" in the rule?