Endpoint Protection

Hi All

I have been tasked with creating firewall rules for remote sites within endpoint protection. As I have only learned basics and there is no training budget for me to learn this via symantec I am wondering if there is any videos or content out there that I could reference.

Any advice/ resources would be fantastic.

Kamikaze_worm

Hi,

The Symantec Endpoint Protection firewall uses firewall policies and rules to allow or block network traffic. The Symantec Endpoint Protection includes a default Firewall policy with default firewall rules and firewall settings for the office environment. The office environment is normally under the protection of corporate firewalls, boundary packet filters, or antivirus servers. Therefore, it is normally more secure than most home environments, where limited boundary protection is available. 

About the Symantec Endpoint Protection firewall

http://www.symantec.com/docs/HOWTO55247 

Available Videos:

Allow & Block websites using SEP firewall

https://www-secure.symantec.com/connect/videos/allow-and-block-websites-using-symantec-endpoint-protection-firewall

How To Block Internet addres via Sep Manager Firweall Rule

https://www-secure.symantec.com/connect/articles/how-block-internet-address-sep-manager-firewall-rule

Hello Kamikaze_worm\

Some links that may help:-

https://www-secure.symantec.com/connect/ideas/make-it-optional-hide-view-firewall-rules-clients

https://www-secure.symantec.com/connect/forums/sep-121-firewall-rules

https://www-secure.symantec.com/connect/ideas/new-action-continue-firewall-rule

https://www-secure.symantec.com/connect/search/apachesolr_search/firewall%20rules?page=1&filters=tid%3A1403

Hello,

Here are the Articles which would explain, more on the default Firewall rules in SEP 12.1

About firewall rules

http://www.symantec.com/docs/HOWTO55261

Default Symantec Endpoint Protection 12.1 RU1 Firewall Policy explanation

http://www.symantec.com/docs/TECH180569

Default Symantec Endpoint Protection 12.1 RU1 Firewall Rules explanation:

Please check the attached file: Default_FW_Rules.xls

Hope that helps!!

Attachment(s)

Default_FW_Rules_0.xls   31 KB 1 version

Thankyou for the replies. Does anyone know if I need to create rules to allow SEP to talk and communicate with SEP Manager or does it do that automatically?

I seam to remember last time when I had this problem it blocked traffic and then couldnt get the policy off because it could'nt communicate with the manager.

by default there is no rule to block communication.

Hello,

There are no Issues with SEP clients communicating with SEPM.

Hi All

Sorry for the late reply. Due to other more critical tasks I have just got back into looking at this. Does anyone know what the firewalls does by default? By this I mean if it has not rules does it Block all or Allow all?

Thanks

Hi,

Default firewall has two rules at the end " Block all other IP traffic" & " Block all other traffic"

It means if default rule conditions aren't matched then block all other traffic.

If you withdraw the firewall policy then all other traffic will be allowed.

How firewall works

http://www.symantec.com/docs/HOWTO55054