McAfee UTILITIES 4.0 Betriebsanweisung PDF herunterladen (Seite 48)

If, however, the traffic does not meet the first rule’s conditions, Host Intrusion Prevention looks

at the next rule in the list. It works its way down through the firewall rules list until it finds a

rule that the traffic matches. If no rule matches, the firewall automatically blocks the traffic. If

learn mode is activated, the user is prompted for an action to be taken; if adaptive mode is

activated, an allow rule is created for the traffic.

Sometimes the intercepted traffic matches more than one rule in the list. In this case, precedence

means that Host Intrusion Prevention applies only the first matching rule in the list.

Ordering the firewall rules list

When you create or customize a firewall rules policy, place the most specific rules at the top of

the list, and more general rules at the bottom. This ensures that Host Intrusion Prevention

filters traffic appropriately.

For example, to block all HTTP requests except those from IP address 10.10.10.1, you need to

create two rules:

• Allow Rule: Allow HTTP traffic from IP address 10.10.10.1. This rule is more specific.

• Block Rule: Block all traffic using the HTTP service. This rule is more general.

You must place the more specific Allow Rule higher in the firewall rules list than the more

general Block Rule. This ensures that when the firewall intercepts an HTTP request from address

10.10.10.1, the first matching rule it finds is the one that allows this traffic through the firewall.

If you placed the more general Block Rule higher than the more specific Allow Rule, Host

Intrusion Prevention would match the HTTP request from 10.10.10.1 against the Block Rule

before it found the Allow Rule. It would block the traffic, even though you wanted to allow

HTTP requests from this address.

How stateful filtering works

Stateful filtering involves processing a packet against two rule sets, a configurable firewall rule

set and a dynamic firewall rule set or state table.

The configurable rules have two possible actions:

• Allow — The packet is permitted and an entry is made in the state table.

• Block — The packet is blocked and no entry is made in the state table.

The state table entries result from network activity and reflect the state of the network stack.

Each rule in the state table has only one action, Allow, so that any packet matched to a rule

in the state table is automatically permitted.

The filtering process includes these steps:

1 The firewall compares an incoming packet against entries in the state table. If the packet

matches any entry in the table, the packet is immediately allowed. If not, the configurable

firewall rules list is examined.

NOTE: A state table entry is considered a match if the Protocol, Local Address, Local Port,

Remote Address and Remote Port match those of the packet.

2 If the packet matches an allow rule, it is allowed and an entry is created in the state table.

3 If the packet matches a block rule, it is blocked.

Configuring Firewall Policies

Overview of Firewall policies

McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.048

1 2 ... 43 44 45 46 47 48 49 50 51 52 53 ... 111 112

Keine Kommentare

McAfee UTILITIES 4.0 Betriebsanweisung Seite 48