check this link, and download evaluation_guide.pdf for demo and the article will give best practices and pointers to suggest SEP

http://www.symantec.com/business/support/documentation.jsp?language=english&view=manuals&pid=54619

check this link as well posted bvy Symantec employee

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2010020308592948

Security Response recommendations for Symantec Endpoint Protection settings

Have a look in this thread also

SEP secret sauce for better protection

How can i implement through SEP this point of security recommendation

Use a firewall to block all incoming connections from the Internet to services that should not be publicly available. By default, you should deny all incoming connections and only allow services you explicitly want to offer to the outside world

https://www-secure.symantec.com/connect/forums/best-practices-dealing-threat-outbreak-when-using-symantec-endpoint-protection

For firewall..I would recommend. take a Unmanaged Client and create a block all Rule.
Monitor the traffic logs.
Whatever you feel should be allowed create a rule for it to allow.
After much fine tuning your Policy you will get what you need.
Ports/Services required for your org will be allowed and rest will be blocked.

Thanks Prachand, your posting is what I've been looking for to implement and read.

Cheers.

AWT

Please note the default maximum security policies already in SEP, ARE NOT ENOUGH.  The policies do not take into account many of the newer threats.

Also, if users are Local Admin's to their computer, and/or you dont have any web protection devices on your perimeter, there is nothing SEP can do for you.

Problem is solved i got it