Opening Ports on Firewall

[Guest]

I have an odd situation and it goes like this:

Our network clients use eTrust antivirus and to enable communication with
the antivirus admin server to WAN clients, those clients need a certain few
ports open on the XP firewall. If i set those ports manually on the client XP
firewall, comms work. If i set them in a GP and propagate it, comms do not
work. I have checked registry and firewall and it does seem that the group
policy is being applied. Any ideas.

Just a general question regarding using the XP firewall. What is the general
line of thought about turning the XP firewall off for clients on a close
private IP network?

Cheers, all advice appreciated

 

[Mark Heitbrink [MVP]]

Hi,

Our network clients use eTrust antivirus and to enable communication with
the antivirus admin server to WAN clients, those clients need a certain few
ports open on the XP firewall.

For etrust it´s usually the inoupdate.exe(?) thats need the exception
Or was it inort* something like that ...

If i set those ports manually on the client XP firewall, comms work.
If i set them in a GP and propagate it, comms do not
work. I have checked registry and firewall and it does seem that
the group policy is being applied. Any ideas.

- you are using the worng DNS
- your Computer is not in the OU, where the GPO is linked to
- you are filtering by DSACLs
- you are filtering by WMI
etc.
etc.

Just a general question regarding using the XP firewall. What is the general
line of thought about turning the XP firewall off for clients on a close
private IP network?

A lot of people deactivate it in their own DNS Zone (its a single Policy)
It is depending on the network, if I activate it or not.


Mark

 

[Guest]

Thanks for your input, some things to test out.

Can you expand on your comments about filtering by DSACLs and filtering by WMI

Cheers

 

[Mark Heitbrink [MVP]]

Hi,

Can you expand on your comments about filtering by DSACLs and filtering by WMI

GPMC:
Take a look on the tab "scope" on the GPO. If there is something different
than "Authenticated Users" than there is a filter ... some, if there is an
entry in the WMI Section

Mark

 

[Guest]

Thats all sweet...as i said it looks like the ploicy is being applied. In
windows firewall you can actually see the new port settings in the programs
and services section but still the only way to get comms to work is to turn
off the firewall or manually enter the ports.