McAfee UTILITIES 4.0 Uživatelská příručka stáhnout pdf (Strana 55)

Host Intrusion Prevention displays all the rules created on clients through learn mode or adaptive

mode, and allows these rules to be saved and migrated to administrative rules.

Stateful filtering with adaptive and learn mode

When adaptive or learn mode is applied with the stateful firewall, the filtering process creates

a new rule to handle the incoming packet. This filtering process proceeds as follows:

1 The firewall compares an incoming packet against entries in the state table and finds no

match, then examines the static rule list and finds no match.

2 No entry is made in the state table, but if this is a TCP packet, it is put in a pending list. If

not, the packet is dropped.

3 If new rules are permitted, a unidirectional static allow rule is created. If this is s a TCP

packet, an entry is made in the state table.

4 If a new rule is not permitted, the packet is dropped.

Firewall client rules

A client in adaptive or learn mode can create Firewall client rules to allow blocked activity. In

addition, rules can be created manually on the client computer. You can track the client rules

and view them in a filtered or aggregated view. Use these client rules to create new policies or

add them to existing policies.

Filtering and aggregating rules

Applying filters generates a list of rules that satisfies all of the variables defined in the filter

criteria. The result is a list of rules that includes all of the criteria. Aggregating rules generates

a list of rules grouped by the value associated with each of the variables selected in the Select

columns to aggregate dialog box. The result is a list of rules displayed in groups and sorted

by the value associated with the selected variables.

Quarantine policies and rules

When a client returns to the network after a prolonged absence, the quarantine policies restrict

a client’s ability to communicate with the network until ePolicy Orchestrator verifies that the

client has all the latest policies, software updates, and DAT files.

NOTE: Host Intrusion Prevention enforces quarantine rules for

all

ePolicy Orchestrator-managed

applications. If you use ePolicy Orchestrator to manage clients with VirusScan Enterprise, Host

Intrusion Prevention will quarantine any returning client where VirusScan Enterprise tasks fail

to run; for example, if an update task fails to deliver the latest DAT files.

Out-of-date policies and files can create security holes and leave systems vulnerable to attack.

By quarantining users until ePolicy Orchestrator updates them, unnecessary security risks are

avoided. For example, a quarantine policy is useful for laptops whose policies and files may

become out of date when they are away from the corporate network for a few days.

When you enable the Quarantine Options policy, both ePolicy Orchestrator and Host Intrusion

Prevention participate. ePolicy Orchestrator detects whether a user has all the latest information

they need. Host Intrusion Prevention enforces the quarantine until the client has all the necessary

policies and files.

NOTE: If a user connects to the network using VPN software, set quarantine rules to allow any

traffic required to both connect and authenticate over the VPN.

Configuring Firewall Policies

Overview of Firewall policies

55McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.0

1 2 ... 50 51 52 53 54 55 56 57 58 59 60 ... 111 112

Komentáře k této Příručce

Žádné komentáře

McAfee UTILITIES 4.0 Uživatelská příručka Strana 55

Komentáře k této Příručce

Související produkty a manuály pro Software McAfee UTILITIES 4.0