McAfee UTILITIES 4.0 Betriebsanweisung PDF herunterladen (Seite 47)

computer’s connection state. Access to the application level commands provides error-free

inspection and securing of the FTP protocol.

State table

A stateful firewall includes a state table that dynamically stores information about active

connections created by allow rules. Each entry in the table defines a connection based on:

• Protocol — The predefined way one service talks with another; includes TCP, UDP and

ICMP protocols.

• Local and remote computer IP addresses — Each computer is assigned a unique IP

address. IPv4, the current standard for IP addresses permits addresses 32 bits long, whereas

IPv6, a newer standard, permits addresses 128 bits long. IPv6 is already supported by some

operating systems, such as Windows Vista and several Linux distributions. Host Intrusion

Preventions supports both standards.

• Local and remote computer port numbers — A computer sends and receives services

using numbered ports. For example, HTTP service typically is available on port 80, and FTP

services on port 21. Port numbers range from 0 to 65535.

• Process ID (PID) — A unique identifier for the process associated with a connection’s

traffic.

• Timestamp — The time of the last incoming or outgoing packet associated with the

connection.

• Timeout: — The time limit (in seconds), set with the Firewall Options policy, after which

the entry is removed from the table if no packet matching the connection is received. The

timeout for TCP connections is enforced only when the connection is not established.

• Direction — The direction (incoming or outgoing) of the traffic that triggered the entry.

After a connection is established, bidirectional traffic is allowed even with unidirectional

rules, provided the entry matches the connection’s parameters in the state table.

State table functionality

Note the following about the state table:

• If firewall rule sets change, all active connections are checked against the new rule set. If

no matching rule is found, the connection entry is discarded from the state table.

• If an adapter obtains a new IP address, the firewall recognizes the new IP configuration and

drops all entries in the state table with an invalid local IP address.

• When the process ends all entries in the state table associated with a process are deleted.

How firewall rules work

Firewall rules determine how to handle network traffic. Each rule provides a set of conditions

that traffic has to meet and has an action associated with it: allow or block traffic. When Host

Intrusion Prevention finds traffic that matches a rule’s conditions, it performs the associated

action.

Host Intrusion Prevention uses precedence to apply rules: the rule at the top of the firewall

rules list is applied first.

If the traffic meets this rule’s conditions, Host Intrusion Prevention allows or blocks the traffic.

It does not try to apply any other rules in the list.

Configuring Firewall Policies

Overview of Firewall policies

47McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.0

1 2 ... 42 43 44 45 46 47 48 49 50 51 52 ... 111 112

Kommentare zu diesen Handbüchern

Keine Kommentare

McAfee UTILITIES 4.0 Betriebsanweisung Seite 47

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für Software McAfee UTILITIES 4.0