Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 1 reply
  • Subscribers 1 subscriber
  • Views 2260 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Firewall Policy Update Loses Checksums

hobbsieoz

We manage our enterprise deployment of Sophos through the SEC. Our laptops when they are outside of our network have their Firewalls enabled and users are prompted to allow checksums and applications etc. 

Whenever we update the Firewall policy, even something as simple as just ticking a box somewhere, once the client gets the policy update, all of the checksums are wiped and they are then prompted for all of the applications again.

Is there a way we can do firewall policy updates while preserving the checksums?

:39065


This thread was automatically locked due to age.
Parents
  • 0

    Hello hobbsieoz,

    as you have seen any change in a policy (perhaps even closing the edit dialog with OK rather than Cancel) results in the policy applied to the clients.

    While Export/Import of a configuration offers a "merge" its semantics are not self-evident. The process is not naturally unambiguous and will, no matter how the merge process is defined, produce unexpected and likely unwanted results - unless two source configurations are carefully crafted. There's a very succinct article (Expected behavior when merging two firewall policies together) illustrating one quandary - there are others as well. There is a limited set of configuration items and I guess the process could in theory be unambiguously defined. But for it to produce the desired results you'd have to have control over both sets to be merged - which clearly isn't the case here.  As an only loosely related aside (and an example of potential intricacies) please see the paragraph "Exceptions in Dual Location mode" in Understanding Location Awareness and Dual Location.

    A central policy and interactive mode are an oxymoron. Anyway the users have to have (AFAIK) administrator rights in order to be able to add checksums, thus they can manipulate the configuration at will. Are these checksums for different (updated) versions of known applications or also "new" applications (which would then need their set of rules as well)?

    Basically there's only onw way to deal with this situation: Put these laptops in a group with a "dummy" policy (and never touch this policy, move the endpoints to a different group or use Comply with -> All Group Policies). The drawback is that in most cases the users have to replicate possible central changes manually. 

    when they are outside of our network have their Firewalls enabled

    Are you using Dual Location with Allow All set for the Primary? Or?

    Sorry to be of not much help. BTW: It might be a good idea to (automatically) make a versioned backup of the configuration on the clients, guess copying Configuration.conf should suffice.  

    Christian

    :39075
Reply
  • 0

    Hello hobbsieoz,

    as you have seen any change in a policy (perhaps even closing the edit dialog with OK rather than Cancel) results in the policy applied to the clients.

    While Export/Import of a configuration offers a "merge" its semantics are not self-evident. The process is not naturally unambiguous and will, no matter how the merge process is defined, produce unexpected and likely unwanted results - unless two source configurations are carefully crafted. There's a very succinct article (Expected behavior when merging two firewall policies together) illustrating one quandary - there are others as well. There is a limited set of configuration items and I guess the process could in theory be unambiguously defined. But for it to produce the desired results you'd have to have control over both sets to be merged - which clearly isn't the case here.  As an only loosely related aside (and an example of potential intricacies) please see the paragraph "Exceptions in Dual Location mode" in Understanding Location Awareness and Dual Location.

    A central policy and interactive mode are an oxymoron. Anyway the users have to have (AFAIK) administrator rights in order to be able to add checksums, thus they can manipulate the configuration at will. Are these checksums for different (updated) versions of known applications or also "new" applications (which would then need their set of rules as well)?

    Basically there's only onw way to deal with this situation: Put these laptops in a group with a "dummy" policy (and never touch this policy, move the endpoints to a different group or use Comply with -> All Group Policies). The drawback is that in most cases the users have to replicate possible central changes manually. 

    when they are outside of our network have their Firewalls enabled

    Are you using Dual Location with Allow All set for the Primary? Or?

    Sorry to be of not much help. BTW: It might be a good idea to (automatically) make a versioned backup of the configuration on the clients, guess copying Configuration.conf should suffice.  

    Christian

    :39075
Children
No Data