See
“About the firewall rule, firewall setting, and intrusion prevention processing
order”
on page 213.
See
“Editing a policy”
on page 122.
How the firewall uses stateful inspection
Firewall protection uses stateful inspection to track current connections. Stateful
inspection tracks source and destination IP addresses, ports, applications, and
other connection information. Before the client inspects the firewall rules, it
makes the traffic flow decisions that are based on the connection information.
For example, if a firewall rule allows a computer to connect to a Web server, the
firewall logs the connection information. When the server replies, the firewall
discovers that a response from the Web server to the computer is expected. It
permits the Web server traffic to flow to the initiating computer without inspecting
the rule base. A rule must permit the initial outbound traffic before the firewall
logs the connection.
Stateful inspection eliminates the need to create new rules. For the traffic that is
initiated in one direction, you do not have to create the rules that permit the traffic
in both directions. The client traffic that is initiated in one direction includes
Telnet (port 23), HTTP (port 80), and HTTPS (port 443). The client computers
initiate this outbound traffic; you create a rule that permits the outbound traffic
for these protocols. Stateful inspection automatically permits the return traffic
that responds to the outbound traffic. Because the firewall is stateful in nature,
you only need to create the rules that initiate a connection, not the characteristics
of a particular packet. All packets that belong to an allowed connection are
implicitly allowed as being an integral part of that same connection.
Stateful inspection supports all rules that direct TCP traffic.
Stateful inspection does not support the rules that filter ICMP traffic. For ICMP
traffic, you must create the rules that permit the traffic in both directions. For
example, for the clients to use the ping command and receive replies, you must
create a rule that permits ICMP traffic in both directions.
See
“How a firewall works”
on page 206.
About firewall rule application triggers
When the application is the only trigger you define in a rule that allows traffic,
the firewall allows the application to perform any network operation. The
application is the significant value, not the network operations that the application
performs. For example, suppose you allow Internet Explorer and you define no
other triggers. Users can access the remote sites that use HTTP, HTTPS, FTP,
Gopher, and any other protocol that the Web browser supports. You can define
Managing firewall protection
About firewall rules
214
Summary of Contents for 20032623 - Endpoint Protection Small Business Edition
Page 1: ...Symantec Endpoint Protection Small Business Edition Implementation Guide...
Page 3: ...Symantec Corporation 350 Ellis Street Mountain View CA 94043 http www symantec com...
Page 34: ...34...
Page 54: ...Installing Symantec Endpoint Protection Manager What you can do from the console 54...
Page 70: ...Managing product licenses Licensing an unmanaged client 70...
Page 74: ...Preparing for client installation Preparing Windows operating systems for remote deployment 74...
Page 204: ...Managing Tamper Protection Changing Tamper Protection settings 204...
Page 236: ...Managing intrusion prevention Creating exceptions for IPS signatures 236...
Page 303: ...Maintaining your security environment Chapter 22 Preparing for disaster recovery 3 Section...
Page 304: ...304...
Page 308: ...Preparing for disaster recovery Backing up the database and logs 308...
Page 310: ...310...
