FW in Adaptive Mode and reporting

[Linuxxo]

Hello,

I have enabled the FW policy with adaptive mode enabled for a small number of system, however I am unable to find any reports/logs related to those systems. I have tried to run reports related to the FW, but they are all empty. Am I missing something here? Or is there a chance that the FW in adaptive mode did not automatically created any rules?

Thanks

[Kenchee_etf]

Hello @Linuxxo 

May I ask you to check:

"Menu -> Reporting -> Host IPS 8.0 -> Firewall Client Rules (Tab)"

and let me know if anything is reported there? Please make sure to have proper nodes selected in "System Tree" and also corresponding "Preset:".

Also if it is nothing there, may I ask you to go to:

"Menu -> Automation -> Server Tasks"

and run "Host IPS 8.0 Property Translator" and check above section again.

Please let me know if the issue persists.

[Linuxxo]

Hi and many thanks for your reply. Unfortunately I do not have any of the options you have mentioned for the Host IPS. I am still using ePO version 5.9.1 and the only thing I have found that is related to the FW under Server Tasks, is the "Endpoint Security Firewall Property Translator", which is currently disabled.

[Kenchee_etf]

Hello @Linuxxo 

Thank you for your reply.

May I ask you which point product are you using?

You posted in HIPs section of the forum so I assumed you are using HIPs Firewall.

Are you using HIPs of ENS Firewall?

[Linuxxo]

Apologies for that, I have just realised that I ended posting in the wrong group. I am using the ePO and wants to enable the FW for the ENS.

[Kenchee_etf]

 Hello @Linuxxo 

In that case "Adaptive Rules" should be reported under:

"Menu -> Reporting -> Firewall Client Rules"

and if they are not there you may execute "Endpoint Security Firewall Property Translator".

Also, in order for ENSFW rules to be reported, please make sure to have also checked "Retain existing user-added rules and Adaptive mode rules when this policy is enforced" in "Endpoint Security Firewall :Firewall > Options > Name_of_your_policy" as long as you are using "Adaptive Mode" otherwise all "Adaptive Rules" that are created will be cleaned up during every policy enforcement and if they are not on the machine, they will not be listed in ePO either. 

I hope this helps.

[ktankink]

Verify that the system node (in the ePO server console) actually has client rules to process (ref KB58949; the concept applies to ENSFW as well; slightly different menus though).  In the HIPS/ENS Firewall node properties, you should see "Client firewall rules ###" under the Client Policy section.  Once you see this, the ENS Firewall Property Translator task will run (automatically every 15min; or run the ePO Server task manually if you don't want to wait (leave the task in DISABLE status though)) to convert these node property rules to ePO-managable rules in the Firewall Client Rules menu.

The McAfee Agent policy option "Retrieve all system and product properties (recommended). If unchecked retrieve only a subset of properties" must be enable to retrieve these client rules from the ENS/HIPS FW client.

[Linuxxo]

Everything seems to be in order now, but the reports are always empty. I assume that the user's activity is not triggering any FW rules. I wonder if there is a way to manually test the FW and trigger some events.

[Former Member · Accepted solution]

By Default, all the firewall events will not be sent back to the epo because of high bandwidth. But you can get the adaptive rules created on the client machine back to the epo by following below instructions.

---------------------------------------------

1)Once the adaptive rules are created under ENSFW on the client machine.

2)Then click on collect and send properties on the Agent monitor on the client machine so that the adaptive rules are sent back to epo.

3)On EPO console you can run the server task "Endpoint Security Firewall Property Translator" so that the rules created on the client machine are listed under epo.

4)Then you have to goto the "Menu>>>Reporting>>>Firewall Client Rules" and then select the rules and add to the policies. After following these steps if you have any queries, let us know.

---------------------------------------------