Firewall settings

The Firewall module provides bidirectional stateful firewall protection. It prevents denial of service attacks and provides coverage for all IP-based protocols and frame types as well as filtering for ports and IP and MAC addresses.

The Firewall section of the Computer or Policy editorYou can change these settings for a policy or for a specific computer. To change the settings for a policy, go to the Polices page and double-click the policy that you want to edit (or select the policy and click Details). To change the settings for a computer, go to the Computers page and double-click the computer that you want to edit (or select the computer and click Details). has the following tabbed sections:

General
Interface Isolation
Reconnaissance
Advanced
Firewall events

General

Firewall

You can configure this policy or computer to inherit its firewall On/Off state from its parent policy or you can lock the setting locally.

Firewall Stateful Configurations

Select which firewall stateful configuration to apply to this policy. If you have defined multiple Interfaces for this policy (above), you can specify independent configurations for each interface. For more information on creating a stateful configuration see Define stateful firewall configurations.

Port Scan (Computer Editor only)

Last Port Scan: The last time that the Deep Security manager ran a port scan on this computer.

Scanned Ports: The ports that were scanned during the most recent port scan.

Open Ports: Listed beneath the IP address of the local computer will be a list of ports that were found to be open.

The Scan For Open Ports and the Cancel Port Scan buttons let you initiate or cancel a port scan on this computer. Deep Security Manager will scan the range of ports defined in Computer or Policy editorYou can change these settings for a policy or for a specific computer. To change the settings for a policy, go to the Polices page and double-click the policy that you want to edit (or select the policy and click Details). To change the settings for a computer, go to the Computers page and double-click the computer that you want to edit (or select the computer and click Details). > Settings > General > Open Ports > Ports to Scan.

Regardless of the ports configured to be scanned, Deep Security Manager will always scan the agent or appliance's listening port number for heartbeat connections from the Manager.

Assigned Firewall Rules

Displays the firewall rules that are in effect for this policy or computer. To add or remove firewall rules, click Assign/Unassign This will display a window showing all available firewall rules from which you can select or deselect rules.

From a Computer or Policy editorYou can change these settings for a policy or for a specific computer. To change the settings for a policy, go to the Polices page and double-click the policy that you want to edit (or select the policy and click Details). To change the settings for a computer, go to the Computers page and double-click the computer that you want to edit (or select the computer and click Details). window, you can edit a firewall rule so that your changes apply only locally in the context of your editor, or you can edit the rule so that the changes apply globally to all other policies and computers that are using the rule.

To edit the Rule locally, right-click the rule and click Properties.

To edit the Rule globally, right-click the rule and click Properties (Global).

For more information on creating firewall rules, see Create a firewall rule.

Interface Isolation

You can configure this policy or computer to inherit its Interface Isolation enabled or disabled state from its parent policy or you can lock the setting locally.

Before you enable Interface Isolation make sure that you have configured the interface patterns in the proper order and that you have removed or added all necessary string patterns. Only interfaces matching the highest priority pattern will be permitted to transmit traffic. Other interfaces (which match any of the remaining patterns on the list) will be "restricted". Restricted Interfaces will block all traffic unless an Allow Firewall Rule is used to allow specific traffic to pass through.

To configure the Interface Isolation policy:

On the Interface Isolation tab, select Enable interface isolation.
Configure the Interface Patterns. (See below)
Click Save.

Interface Patterns

When Interface Isolation is enabled, the firewall will try to match the regular expression patterns to interface names on the local computer.

Deep Security uses POSIX basic regular expressions to match interface names. For information on basic POSIX regular expressions, see
https://pubs.opengroup.org/onlinepubs/009695399/basedefs/xbd_chap09.html#tag_09_03

Only interfaces matching the highest priority pattern will be permitted to transmit traffic. Other interfaces (which match any of the remaining patterns on the list) will be "restricted". Restricted Interfaces will block all traffic unless an Allow firewall rule is used to allow specific traffic to pass through.

Selecting Limit to one active interface will restrict traffic to only a single interface (even if more than one interface matches the highest priority pattern).

Reconnaissance

Reconnaissance Scans

The Reconnaissance page allows you to enable and configure traffic analysis settings on your computers. This feature can detect possible reconnaissance scans that attackers often use to discover weaknesses before beginning a targeted attack.

Reconnaissance scans do not work in TAP mode. Reconnaissance scans can only be detected on IPv4 traffic.

To enable reconnaissance protection, you must also enable the Firewall and Stateful Inspection on the Computer or Policy editorYou can change these settings for a policy or for a specific computer. To change the settings for a policy, go to the Polices page and double-click the policy that you want to edit (or select the policy and click Details). To change the settings for a computer, go to the Computers page and double-click the computer that you want to edit (or select the computer and click Details). > Firewall > General tab. You should also go to the Computer or Policy editorYou can change these settings for a policy or for a specific computer. To change the settings for a policy, go to the Polices page and double-click the policy that you want to edit (or select the policy and click Details). To change the settings for a computer, go to the Computers page and double-click the computer that you want to edit (or select the computer and click Details). > Firewall > Advanced tab and enable the Generate Firewall Events for packets that are 'Out of Allowed Policy' setting. This will generate firewall events that are required for reconnaissance.

When setting up Reconnaissance scans, you have the following options:

Reconnaissance Scan Detection Enabled: Turn the ability to detect reconnaissance scans on or off. The default is all scans are enabled in report mode with notifications. If you want to turn off the notifications or switch from report more to a temporary blocking mode, select Yes from the drop-list and make your changes.
Computers/Networks on which to perform detection: Choose from the list the IPs to protect. Choose from existing IP Lists. (You can use the Policies > Common Objects > Lists > IP Lists page to create an IP List specifically for this purpose.)
Do not perform detection on traffic coming from: Select from a set of IP Lists which computers and networks to ignore. (As above, you can use the Policies > Common Objects > Lists > IP Lists page to create an IP List specifically for this purpose.)

For each type of attack, the agent or appliance can be instructed to send the information to the Deep Security Manager where an alert will be triggered. You can configure the Deep Security Manager to send an email notification when the alerts are triggered. For more information, see Administration > System Settings > Alerts. Select Notify DSM Immediately for this option.

For the "Notify DSM Immediately" option to work, the agents and appliances must be configured for agent or appliance-initiated or bidirectional communication in Computer or Policy editorYou can change these settings for a policy or for a specific computer. To change the settings for a policy, go to the Polices page and double-click the policy that you want to edit (or select the policy and click Details). To change the settings for a computer, go to the Computers page and double-click the computer that you want to edit (or select the computer and click Details). > Settings > General.) If enabled, the agent or appliance will initiate a heartbeat to the Deep Security Manager immediately upon detecting the attack or probe.

Once an attack has been detected, you can instruct the agents and appliances to block traffic from the source IPs for a period of time. Use the Block Traffic drop-down lists to set the number of minutes.

The alerts are:

Computer OS Fingerprint Probe: The agent or appliance detects an attempt to discover the computers OS.
Network or Port Scan: The agent or appliance reports a network or port scan if it detects that a remote IP is visiting an abnormal ratio of IPs to ports. Normally, an agent or appliance computer will only see traffic destined for itself, so a port scan is the most common type of probe that will be detected. The statistical analysis method used in computer or port scan detection is derived from the "TAPS" algorithm proposed in the paper "Connectionless Port Scan Detection on the Backbone" presented at IPCCC in 2006.
TCP Null Scan: The agent or appliance detects packages with no flags set.
TCP SYNFIN Scan: The agent or appliance detects packets with only the SYN and FIN flags set.
TCP Xmas Scan: The agent or appliance detects packets with only the FIN, URG, and PSH flags set or a value of 0xFF (every possible flag set).

"Network or Port Scans" differs from the other types of reconnaissance in that it cannot be recognized by a single packet and requires Deep Security to watch traffic for a period of time.
The agent or appliance reports a computer or port scan if it detects that a remote IP is visiting an abnormal ratio of IPs to ports. Normally an agent or appliance computer will only see traffic destined for itself, so a port scan is by far the most common type of probe that will be detected. However, if a computer is acting as a router or bridge it could see traffic destined for a number of other computers, making it possible for the agent or appliance to detect a computer scan (ex. scanning a whole subnet for computers with port 80 open).
Detecting these scans can take several seconds since the agent or appliance needs to be able to track failed connections and decide that there are an abnormal number of failed connections coming from a single computer in a relatively short period of time.

Deep Security Agents running on Windows computers with browser applications may occasionally report false-positive reconnaissance scans due to residual traffic arriving from closed connections.

For information on how to handle reconnaissance warnings, see Warning: Reconnaissance Detected.

Advanced

Events

Set whether to generate events for packets that are "Out of Allowed Policy". These are packets that have been blocked because they have not been specifically allowed by an Allow firewall rule. Setting this option to Yes may generate a large number of events depending on the firewall rules you have in effect.

Firewall events

Firewall events are displayed the same way as they are in the main Deep Security Manager window except that only events relating to this policy or specific computer are displayed.