Symantec Endpoint Protection: Corporate Firewall Configuration Standard

1. Strategic Framework for Endpoint Firewall Management

In a modern, perimeter-less corporate environment, the endpoint firewall serves as the definitive line of defense against lateral movement. As traditional network boundaries dissolve, security must be enforced at the device level to ensure consistent protection across diverse connection scenarios, including home networks, public Wi-Fi, and the office. This configuration standard establishes a unified security posture for Symantec Endpoint Protection (SEP) clients, transitioning from basic port filtering to an environment-aware, granular trigger model. By leveraging complex triggers, we shield the workstation from network-based exploits and unauthorized reconnaissance before malicious traffic can reach vulnerable application layers.

The scope of this standard encompasses the architectural logic required to maintain security integrity across Remote, VPN, and Office locations.

Core Firewall Triggers

The SEP firewall evaluates traffic through four primary categories. The strategic advantage of this model lies in the synthesis of these triggers to create a multi-dimensional security layer.

Trigger Category | Description | Security Evaluation
Applications | Links traffic to specific executables (e.g., iexplore.exe). | Provides high granularity by allowing or restricting traffic based on the application's identity regardless of the port used.
Hosts | Identifies the remote computer relative to the local client. | Architectural Note: This host relationship is independent of traffic direction. It is essential for defining trusted vs. untrusted sources regardless of whether the connection is inbound or outbound.
Protocols | Specifies communication standards (TCP, UDP, ICMP) and ports. | Covers specific ports, protocol types, and traffic direction. This is the baseline for ensuring only intended communication channels are open.
Network Adapters | Links rules to hardware/virtual interfaces (Ethernet, Wi-Fi, VPN). | The lynchpin of environment-aware policy. Allows the firewall to automatically switch postures when a user moves from an untrusted adapter (Public Wi-Fi) to a trusted one (VPN).

By combining these triggers, the firewall operates via stateful inspection, monitoring the state of network connections to ensure only legitimate, expected traffic is processed.

 -------------------------------------------------------------------------------- 

2. Hierarchy of Firewall Rule Processing

The sequence of firewall rules is critical for policy integrity. Because the SEP client processes the rule list from top to bottom and stops at the first match, the order dictates whether a security gap is created. High-priority "Block" rules must be positioned surgically to prevent accidental "Allow" matches from lower-priority, more general rules.

Standard Processing Order

All network traffic is evaluated according to a strict hierarchy. As a Senior Architect, one must recognize that a high-level "Block" (such as a Custom IPS signature) will override a lower-level "Allow" firewall rule, providing essential defense-in-depth:

1. Custom IPS Signatures
2. Intrusion Prevention settings, traffic settings, and stealth settings
3. Built-in rules
4. Firewall rules
5. Port scan checks
6. IPS signatures downloaded through LiveUpdate

Best Practice Rule Base Sequence

To maintain a rigorous security posture, organize the firewall rule base into these four tiers:

• 1st: Rules that Block All Traffic
  • So What? Placing surgical "Block" rules at the top ensures prohibited traffic is discarded immediately. Because the client stops at the first match, this prevents traffic from ever reaching a