Sophos Enterprise Console
■ Conversely, using large numbers of configurations will mean extra time spent on monitoring and maintenance.
Network-wide systems and protocols
Take into account the services that your network relies upon. For example:
■ DHCP
■
■
DNS
RIP
■
■
NTP
GRE
Rules exist in the default firewall configuration to govern most of these services. However, be aware of those that you should allow, and those that you don't need.
Remote access to computers
If you use remote access software to monitor and fix computers, you must build rules into your configuration to enable you to work this way.
Identify the technologies that you use to access the computers on your network. For example:
■ RDP
■
■
■
■
VPN client/server
SSH/SCP
Terminal services
Citrix
Check what sort of access is needed, and create your rules accordingly.
5.3 Recommended settings
When setting up your firewall policy, consider the following:
■
■
When Sophos Client Firewall is installed, Windows Firewall is turned off. Therefore, if you were using the Windows Firewall, make a note of existing configurations and move them to Sophos
Client Firewall.
Use the Allow by default mode to detect but not block traffic, applications, and processes.
Initially defining a report-only policy enables you to gain a better view of network activity.
■
■
Use the firewall Event Viewer to view which traffic, applications, and processes are being used.
The Event Viewer also allows you to easily create rules that allow or block reported traffic, applications, and processes. You can access the Event Viewer by clicking Events > Firewall
Events.
Review the rules created via the Event Viewer. An application may trigger multiple firewall events—different events for different actions performed by the application—but an application
12
