HIPS FW replacement with ENS firewall - contradiction Installation Guide on replacement

[dmease27]

Hi,

PD27564 (McAfee Endpoint Security 10.6.0 - Installation Guide) page 18 states:

"McAfee Endpoint Security Firewall replaces the Host Intrusion Prevention Firewall, and you can also migrate your existing firewall settings to the new firewall. Host Intrusion Prevention (without its firewall module) can run side by side with Endpoint Security Firewall."

and

"You are not required to upgrade to Endpoint Security Firewall or migrate your settings. You can continue to run the McAfee Host IPS Firewall after installing Endpoint Security Firewall. Whenever McAfee Host IPS Firewall is installed and enabled, Endpoint Security Firewall is disabled even if enabled in the policy settings."

The first statement seems to imply that when ENS firewall module is installed, it removes and replaces HIPS FW.  This seems to be backed up by the explicit statement that HIPS (without its FW module) can run side by side with ENS FW.

The second statement seems to imply that HIPS FW is *not* removed, as it advises that both are present on the system.

Ultimately - if I have HIPS installed (including FW module), and I install ENS Threat Prevention+Firewall, does this action a)uninstall HIPS FW module or b)leave the HIPS FW module on the system and disable ENS firewall?

Cheers,

[Former Member]

You can have ENSFW and HIPS installed at the same time. It will only replace HIPS if  you use a specific parameter during the upgrade/ migration. You can however only have one firewall active - so either ENSFW or HIPS.

[ktankink · Accepted solution]

Hi @dmease27 .

PD27564 (McAfee Endpoint Security 10.6.0 - Installation Guide) page 34 states the Deployment task/Command line switch to remove HIPS from the system when ENS is installed.  Use this in the ENS Common package command line section of your McAfee Agent Deployment task to automatically uninstall HIPS during ENS installation.

/override"program_name" Overrides and removes the specified conflicting products:
• hips — McAfee Host Intrusion Prevention
Example:
/override"hips"
Removes McAfee Host Intrusion Prevention automatically during installation.

Also, the HIPS modules will take precedence over the ENS modules.  If you have both products installed, disable the HIPS modules if you want the ENS modules to be enabled.  If you want to switch back to HIPS, then just enable the HIPS modules again, and it will automatically disable the ENS modules.

HIPS IPS > ENS Exploit Prevention

HIPS Firewall > ENS Firewall