Host Intrusion Prevention 7.0.0 for ePO 4.0 Product Guide - McAfee

Configuring Firewall Policies
Working with Firewall Rules policies
Creating firewall connection-aware groups
Use this task to create a connection-aware group. These groups let you manage a set of rules
that apply only when connecting to a network using a wired, wireless, or non-specific connection
with particular parameters. Groups appear in the rule list in blue preceded by an arrow. Click
the arrow to show or hide the rules within the group
Task
For option definitions, click ? on the page displaying the options.
1 On the Firewall Rules policy page, click Add Connection Aware Group.
2 Type a name for the group in the Name field.
3 Under Connection type, select the type of connection (LAN, Wireless, Any) to which
to apply the rules in this group.
4 Select Isolate this connection to block traffic coming from sources other than from a
single specified connection.
5 Under New Criterion, select a category of criterion to apply to the rule. Click Add Criterion
to display an additional field in which to type the new matching criterion.
NOTE: If you select Any as the connection type, you are required to select either IP
Address or DNS Suffix and edit the corresponding list. Specify a DHCP server MAC
address only for DHCP servers on the same subnet as the client. Identify remote DHCP
servers only by their IP address.
6 Click the Add button to append more criteria in the same category. Click the Remove button
or Remove All to eliminate one or all of the previously added criteria in the selected
category.
7 Click OK.
Adding predefined firewall rules
Use this task to add predefined firewall rules that match your needs immediately or after you
have edited them.
Task
For option definitions, click ? on the page displaying the options.
1 On the Firewall Rules policy page, click Predefined Rules.
2 Select one or more predefined groups, or one or more predefined rules within a group.
3 Click Add to Policy to add the selected groups and rules; click View to view details of a
selected group or rule.
4 Click Cancel to return to the Firewall Rulespolicy page.
Managing Firewall client rules
Use this task to analyze Firewall client rules created either automatically in adaptive or learn
mode or manually for a group of clients, then determine which if any client rules to move to a
Firewall Rules policy.
NOTE:
62
McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.0