Endpoint Protection

hello,

I need an answer.

SEPM server is in different VLAN then clients.

I have created a firewall rule where are only 2 rules:

1 Allow all outgoing

2 Block all

These rules should block any incoming packets. It works but not from the subnet where is the SEPM server located. From this subnet, I can ping, telnet...everything.

Is this a feature, or bug?

Rudolf

What is the Traffic log showing?

I mean allow all .

It is a Feature of Firewall however check the ports and rules which says allow .

I don't see the traffic from the SEPM subnet. Only traffic other then SEPM subnet.

strange

Allow all is only for outgoing traffic.

Everything else should be blocked

Follow the instruction here for enabling TSE debugging

How to debug the Symantec Endpoint Protection client

Should give us a better idea of what is going on

problem solved.

I have exported the policy profile as xml. There was a unregulated_host_group in the HostGroupZones

It was the IPS policy, where an subnet exclude was set

Rudolf