topic Re: Firewall with SCV WindowsSecurityMonitor in SASE and Remote Access

Firewall with SCV WindowsSecurityMonitor

pfilipe — Wed, 20 Oct 2021 11:33:02 GMT

Hello Everyone,

So i Need a litle help, i am setting up a SCV for Endpoint when they connect to VPN.

One of the things i need is for the SCV check for WindowsSecurityMonitor : VirusProtection, WindowsUpgrade, SpywareProtection and NetworkFirewall.

The things is when i connect with the Firewall disabled it continues to say that i am compliant with the Site. On the other end VirusProtection Works Fine.

This is the Configuration i am using.

: (WindowsSecurityMonitor
:type (plugin)
:parameters (
:VirusProtectionRequired (true)
:VirusProtectionRequiredMismatchMessage ("Please verify that your virus protection is up to date and virus scanning is on.")
:VirusProtectionInstalledPrograms ("any")
:VirusProtectionInstalledProgramsMismatchMessage ("There is no anti-virus program installed on the machine.")
:WindowsUpdateRequired (true)
:WindowsUpdateRequiredMismatchMessage ("Please make sure that windows automatic updates is turned on")
:SpywareProtectionRequired (true)
:SpywareProtectionRequiredMismatchMessage ("Please verify that your spyware protection is turned on.")
:SpywareProtectionInstalledPrograms ("any")
:SpywareProtectionInstalledProgramsMismatchMessage ("There is no anti-spyware program installed on the machine.")
:NetworkFirewallRequired (true)
:NetworkFirewallRequiredMismatchMessage ("Please verify the your network firewall is turned on.")
:NetworkFirewallInstalledPrograms ("any")
:NetworkFirewallInstalledProgramsMismatchMessage ("There is no network firewall program installed on the machine.").

Does anyone have any clue why this is happening? Is there any proccess i should monitor?

Best Regards,

Pedro Filipe

Re: Firewall with SCV WindowsSecurityMonitor

_Val_ — Wed, 20 Oct 2021 12:38:19 GMT

Make sure you do not use endpoint policy and FW blade on the Endpoint client itself.

Re: Firewall with SCV WindowsSecurityMonitor

pfilipe — Wed, 20 Oct 2021 13:48:08 GMT

Hello @_Val_ ,

Yes i have the FW blade on the Enpoint enable on the client. Once i turn i disable it i get the error for the Windows Firewall.

Is there anyway i have the FW Blade enabled but still checks for the windows Firewall?

Thanks

Re: Firewall with SCV WindowsSecurityMonitor

_Val_ — Wed, 20 Oct 2021 14:40:36 GMT

I do not think so. Once Endpoint client has a policy, it counts for a FW. Also, having two separate FWs on a client is not a good idea.

Re: Firewall with SCV WindowsSecurityMonitor

pfilipe — Wed, 20 Oct 2021 16:22:24 GMT

And how can i disable completely the FW Blade, since i only find a way that the users disable it. I would like to disable it globally and not giving the chance do enable/disable.

Thanks

Re: Firewall with SCV WindowsSecurityMonitor

_Val_ — Thu, 21 Oct 2021 06:50:50 GMT

I believe you need to install Remote Access VPN client and not Endpoint Client. Look into sk175451 under "StandAlone Clients"

Re: Firewall with SCV WindowsSecurityMonitor

pfilipe — Thu, 21 Oct 2021 10:25:45 GMT

Yeah thats it, you need as well to make true the SCVGlobalParams ( :skip_firewall_enforcement_check (true))

Thank you!

If anyone needs the SCV i will leave it here.

Re: Firewall with SCV WindowsSecurityMonitor

GerberthM — Fri, 22 Mar 2024 21:11:54 GMT

Hi pfilipe, this local.scv it works for all antivirus application (trend micro, mcafee, windows defender, etc)?