6.12 Network Control Policies

Network control policies manage client machine communications with unauthorized computers, block malicious or download-related ports, prevent virus intrusion, and safeguard internal network security.

These policies apply to computers and are ineffective in user mode. Policy attributes include:

Policy Example 1

To protect internal network security, a company may need to block certain malicious or download-related ports. This can be achieved using a network control policy.

• Policy: Mode = Block
• Settings: Specify the target address range and ports to block, e.g., port 80 or port 21.
• Blocking port 80 prevents clients from accessing websites.
• Blocking port 21 prevents FTP downloads.

Policy Example 2

Some departments may have critical computers that should not be accessed by machines outside the department. Network control policies can enforce this.

Policy Steps:

• Create a policy to Block the address range: Local Area Network.
• Create a policy to Allow communication where: Is Target a Client + Same Group.

Effect: Machines in the department can only communicate within their group. Before applying this policy, all departmental machines must be placed in the same group. Any machines outside the department without the client installed should have their IPs added to the allow policy.

Policy Example 3

Network control policies can be combined with access detection to prevent external computers from communicating with internal machines.

• For client-installed internal machines: Set network control policies to allow communication only with corporate computers. External machines cannot access these clients.
• For internal machines without the client: Mark them as Protected in access detection and enable access control. External machines will be considered unauthorized and cannot communicate with these protected machines.