ENS Firewall - how to restrict McAfee core networking

[polezhaevdmi]

Environment: ENS Firewall under ePO supervision on Windows machine with VPN.

Goal: create FW rule to block all traffic outside VPN, while keep default FW protection for services, available via VPN. And do not loose Agent - ePO connectivity, which is also uses th VPN.

Questions are:

- How to restrict McAfee core networking traffic in trusted VPN network(s)? The 'McAfee core networking' rule group has no network scope, is read-only, and seems nailed to top of the list. If one will duplicate it to add trusted 'network scope' restriction, the corrected group will appear under the initial. This will have no effect on FW behaviour, because of rules processing 'from top to bottom till first match' (link for MAC, see no Windows guide).

- Is it possible to create the rule without using pre-defined template? The 'Create a New Policy' ePO dialog does not allow to skip the rule template parameter to create the 'empty' rule set.

[Pravas · Accepted solution]

Hi @polezhaevdmi ,

Not all, but its possible to disable some of the rules within McAfee Core Networking.

This can be achieved by selecting Disable McAfee core networking rules option in the Firewall Options. But, this might disrupt network communications on the client.

Please refer the document below that mentions the rules which can be disabled.

https://docs.trellix.com/bundle/endpoint-security-10.7.x-product-guide-windows/page/GUID-5C381195-22...

Thanks

[polezhaevdmi]

@Pravas, You are Great!

Using the link You provided, I found a confirmation the 'copy-way' to restrict 'McAfee core networking' is legal and recommended. 

The prepared FW rule is provided below. The pair of rules 'Client VPN' (by application) + 'Client Secure GW'  (by IP) was created to made VPN slightly more redundant in the case of software upgrade.

A lot of thanks!