Firewall Flashcards
Give a high level overview of Firewall
protects systems, network resources, and applications from external and internal attacks.
Firewall scans all incoming and outgoing traffic and compares it to its list of firewall rules, which is a set of
criteria with associated actions. If a packet matches all criteria in a rule, the firewall acts according to the rule,
blocking or allowing the packet through the firewall.
What features make up the “Protect” section of Firewall?
Rules, Rule Groups, Stateful Packet Filtering and inspection, Reputation Based Control
What features make up the “Detect” section of Firewall?
Dashboards and Monitors, Queries and Reports, Alerts, Log Traffic
What features make up the “Correct” section of Firewall?
Adaptive Mode, Defined Networks, Trusted Executables, Firewall Catalog, Client Options, Dashboards and monitors
Give a High Level Explanation of Firewall “Rules”
A way to define the criteria Firewall uses to determine whether to block or allow incoming and outgoing traffic.
Give a High Level Explanation of Firewall “Rule Groups”
Organize firewall rules for easy management, enabling you to apply rules manually or on a schedule, and to only process traffic based on connection type.
Give a High Level Explanation of “Stateful packet filtering and inspection”
Track network connection state and characteristics in a state table, allowing only packets that match a known open connection.
Give a High Level Explanation of Firewall “Reputation-based control”
Block untrusted executables, or all traffic from an untrusted network, based on reputation
Give a High Level Explanation of Adaptive mode
Create rules automatically on the client system to allow legitimate activity.
Once created, analyze client rules to decide which to convert to server-mandated policies.
Give a High Level Explanation of “Defined Networks”
Define trusted networks to allow traffic from networks that your organization considers safe
Give a High Level Explanation of “Firewall Catalog”
Define rules and groups to add to multiple policies, or networks and applications to add to firewall rules
How does Firewall work?
It scans all incoming and outgoing traffic at the packet level and compares packets to the configured firewall rules to determine whether to allow or block the traffic
1 The administrator configures firewall rules in McAfee ePO and enforces the policy to the client system.
2 The user performs a task that initiates network activity and generates traffic.
3 Firewall scans all incoming and outgoing traffic and compares packets to configured rules. If the traffic
matches a rule, Firewall blocks or allows it, based on the rule criteria.
4 Firewall logs the details, then generates and sends an event to McAfee ePO.
How do firewall rules work?
- Determine how to handle network traffic
- Each rule provides a set of conditions that traffic must meet, and an action to allow or block traffic
- When firewall finds traffic that matches a rule’s conditions, it performs the associated action
How does the order of firewall rules affect the way they’re used?
Firewall uses precedence to apply rules:
1 Firewall applies the rule at the top of the firewall rules list. If the traffic meets this rule’s conditions, Firewall allows or blocks the traffic. It doesn’t try to apply any other rules in the list.
2 If the traffic doesn’t meet the first rule’s conditions, Firewall continues to the next rule in the list until it finds
a rule that the traffic matches.
3 If no rule matches, the firewall automatically blocks the traffic.
What happens if all of the configured Firewall rules are applied and none match the sample?
It’s automatically blocked
What happens if all of the configured Firewall rules are applied and none match the sample, and adaptive mode is active?
an Allow rule is created for the traffic
What happens if intercepted traffic matches more than one rule in the list?
Firewall applies only the first matching rule in the list
What is the best practice in regards to rule order?
The more specific rules should be placed at the top of the list, and the more general rules at the bottom, which ensures that Firewall filters traffic appropriately
How do firewall rule groups work?
Firewall rule groups organize firewall rules for easy management. They do not affect the way Firewall handles rules; the software processes rules from top to bottom
Does FIrewall prioritize the settings of a rule group first in processing, or the settings for the individual rules it contains?
It processes the settings for the group first.
If a conflict exists between the settings of a firewall group, and the rules it contains, what happens?
The group settings take precedence
What are Timed Groups?
Timed groups are Firewall rule groups that are active for a set time.
For example, a timed group can be enabled to allow a client system to connect to a public network and establish a VPN connection
Groups can be activated either: on a specified schedule, or manually by selecting options from the McAfee system tray icon
What are Connection Isolation Groups?
Process only traffic that matches a defined connection type and group criteria
What are the predefined firewall rule groups in ePO
McAfee core networking - Contains the core networking rules provided by McAfee and includes rules to allow
McAfee applications and DNS.
ePO Server - Contains rules to allow McAfee ePO services to run.
Basic Networking - Contains rules to allow basic networking services, such as DNS, to run.
VPN - Contains rules to allow VPN services to run.
ICMP - Contains rules to allow all ICMP traffic.
Windows AD Authentication - Contains rules to allow Windows Active Directory authentication.
NetBIOS - Contains rules to allow inbound and outbound NetBIOS services and sessions, and
block untrusted NetBIOS services.
Web/FTP - Contains rules to allow outbound HTTPS and FTP services.
Mail clients - Contains rules to allow outbound mail services, such as POP.
Network tools - Contains rules to allow Remote Desktop (RDP) connections.
