McAfee UTILITIES 4.0 Guia do Utilizador descarregar pdf (Página 54)

Connection isolation on the corporate network

Connection rules are processed until the Connection-Aware Group with corporate LAN connection

rules is encounterd. This CAG contains these settings:

• Connection type=LAN

• DNS suffix=mycompany.com

• Isolate this Connection =yes

The computer has both LAN and wireless network adapters and connects to the corporate

network with a wired connection, but the wireless interface is still active, so it connects to a

hotspot outside the office. The computer connects to both networks because the rules for basic

access are at the top of the firewall rules list. The wired LAN connection is active and meets

the criteria of the corporate LAN CAG. The firewall processes the traffic through the LAN but

because connection isolation is enabled, all other traffic not through the LAN is blocked.

Connection isolation at a hotel

Connection rules are processed until the Connection-Aware Group with VPN connection rules

is encounterd. This CAG contains these settings:

• Connection type=Any

• DNS suffix=vpn.mycompany.com

• IP Address=an address in a range specific to the VPN concentrator

• Isolate this Connection =yes

General connection rules allow the set-up of a timed account at the hotel to gain internet access.

The VPN connection rules allow connection and use of the VPN tunnel. After the tunnel is

established, the VPN client creates a virtual adapter that matches the criteria of the VPN CAG.

The only traffic the firewall allows is inside the VPN tunnel and the basic traffic on the actual

adapter. Attempts by other hotel guests to access the computer over the network, either wired

or wireless, are blocked.

How learn and adaptive modes affect the firewall

When you enable the firewall, Host Intrusion Prevention continually monitors the network traffic

that a computer sends and receives. It allows or blocks traffic based on the Firewall Rules policy.

If the traffic cannot be matched against an existing rule, it is automatically blocked unless the

firewall is operating in learn mode or adaptive mode.

In learn mode, Host Intrusion Prevention displays a learn mode alert when it intercepts unknown

network traffic. This alert prompts the user to allow or block any traffic that does not match an

existing rule, and automatically creates corresponding dynamic rules for the non-matching

traffic. You can enable learn mode for incoming communication only, for outgoing communication

only, or both.

In adaptive mode, Host Intrusion Prevention automatically creates an allow rule to allow all

traffic that does not match any existing bock rule, and automatically creates dynamic allow

rules for non-matching traffic.

For security reasons, when the learn mode or adaptive mode is applied, incoming pings are

blocked unless an explicit allow rule is created for incoming ICMP traffic. In addition, incoming

traffic to a port that is not open on the host will be blocked unless an explicit allow rule is

created for the traffic. For example, if the host has not started telnet service, incoming TCP

traffic to port 23 (telnet) is blocked even when there is no explicit rule to block this traffic. You

can create an explicit allow rule for any desired traffic.

Configuring Firewall Policies

Overview of Firewall policies

McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.054

1 2 ... 49 50 51 52 53 54 55 56 57 58 59 ... 111 112

Comentários a estes Manuais

Sem comentários

McAfee UTILITIES 4.0 Guia do Utilizador Página 54

Comentários a estes Manuais

Manuais e produtos relacionados com Software McAfee UTILITIES 4.0