Comparison of Endpoint Security Firewall features supported on Windows, Linux, and Macintosh

Environment

Endpoint Security (ENS) Firewall 10.x
Endpoint Security for Linux (ENSL) Firewall 10.x
Endpoint Security for Mac (ENSM) Firewall 10.x

Linux
macOS
Microsoft Windows

Summary

ENSL and ENSM don't support all features and options available in the ENS Firewall policies.
The table below presents the following:

Supported features for Linux and macOS
Differences between ENS, ENSL, and ENSM
Supported features with the latest version of ENSL and ENSM

NOTES:

Features not supported on macOS are marked as "Windows only" in the extensions.
ENSM doesn't support user-based policies. Policies are assigned to all users.
ENSL Firewall and ENSM Firewall don't support nested rule groups.
For ICMP rules and groups, ENSM supports the following message types from the drop-down: "Echo Request", "Echo Reply", and "All." Other ICMP message types aren't supported.

Feature	Feature options	Windows	Linux	macOS
Options policy
Firewall	Enable Firewall	Yes	Yes	Yes
Protection Options	Allow traffic for unsupported protocol Allow only outgoing traffic until firewall services have started Allow bridged traffic Enable firewall intrusion alerts	Yes	No	No
Tuning Options	Enable Adaptive mode (create rules on the client automatically)	Yes	Yes	Yes²
	Disable Trellix Core Networking Rules	Yes	No	No
	Retain existing user added rules and adaptive mode rules when this policy is enforced	Yes	Yes	Yes
	Log all blocked traffic	Yes	No	No
	Log all allowed traffic	Yes	No	No
Trellix GTI Network Reputation	Treat GTI match as intrusion Log matching traffic Block all untrusted executables Incoming network-reputation threshold Outgoing network-reputation threshold If GTI ratings server is not reachable	Yes	No	No
Stateful Firewall	Use FTP protocol inspection	Yes	Yes	Yes²
	Number of seconds (1–240) before TCP connections time out	Yes	Yes	Yes
	Number of seconds (1–300) before UDP and ICMP echo virtual connections time out	Yes	Yes	Yes
Firewall Status Control	Allow users to disable Firewall from the notification area icon	Yes	No	No
Firewall Status Control	Require justification from users when managing Firewall from the notification area icon	Yes	No	No
DNS Blocking	Domain Name	Yes	No	Yes
Defined Networks	Add Defined Network	Yes	Yes¹	Yes¹
Trusted Executables	Add (Name, File Path, Fingerprint, Signature, actions)	Yes	No	No
Rules policy
Add Rule
Description	Name	Yes	Yes	Yes
	Status	Yes	Yes	Yes
	Allow	Yes	Yes	Yes
	Block	Yes	Yes	Yes
	Treat match as intrusion	Yes	Yes	Yes
	Log matching traffic	Yes	Yes	Yes
	Direction	Yes	Yes	Yes
	Notes	Yes	Yes	No
Networks	Any protocol	Yes	Yes	Yes
	IP protocol - IPv4	Yes	Yes	Yes
	IP protocol - IPv6	Yes	No	No
	Non-IP protocol	Yes	No	No
	Connection types	Yes	Yes	Yes
	Specify networks - Add local and remote	Yes	Yes¹	Yes¹
Transport	All Protocols	Yes	Yes	Yes
	ICMP	Yes	Yes	Yes
	ICMPv6	Yes	No	No
	TCP	Yes	Yes	Yes
	UDP	Yes	Yes	Yes
	Other	Yes	Yes (if protocol is present in /etc/protocols)	No
Applications	Application association	Yes	No	Yes³
Schedule	To associate schedule with rule	Yes	Yes	No
Add Group
Description	Name	Yes	Yes	Yes
	Status	Yes	Yes	Yes
	Direction	Yes	Yes	Yes
	Notes	Yes	Yes	No
Location	Enable location awareness	Yes	No	Yes
	Name	Yes	No	Yes
	Enable connection isolation	Yes	No	No
	Require that ePolicy Orchestrator is reachable	Yes	No	Yes
	Location criteria - Items in the drop-down list	Yes	No	Yes
	Registry key	Yes	No	No
Networks	Any protocol	Yes	Yes	Yes
	IP protocol - IPv4	Yes	Yes	Yes
	IP protocol - IPv6	Yes	No	No
	Non-IP protocol	Yes	No	No
	Connection types	Yes	Yes	Yes
	Specify networks - Add local and remote	Yes	Yes¹	Yes¹
Transport	All Protocols	Yes	Yes	Yes
	ICMP	Yes	Yes	Yes
	ICMPv6	Yes	No	No
	TCP	Yes	Yes	Yes
	UDP	Yes	Yes	Yes
	Other	Yes	Yes (if protocol is present in /etc/protocols)	No
Applications	Application association	Yes	No	Yes³
Schedule	To associate schedule with group	Yes	Yes	No
Server Task
Endpoint Security Firewall Property Translator	Process properties received from client and convert them into rules	Yes	Yes	Yes

¹	Firewall on Linux or macOS doesn't support IPv6 options.
²	The following options aren't supported with ENSM 10.7.5 and later: Enable Adaptive mode (create rules on the client automatically) Use FTP protocol inspection
³	ENSM only supports the path-based option for Application association. Wildcards can't be used when specifying an application within firewall rules.

Related Information

For Knowledge Base articles that describe features supported for Windows, Linux, and Macintosh operating systems, see this dynamic list.

Knowledge Center

Comparison of Endpoint Security Firewall features supported on Windows, Linux, and Macintosh

Environment

Summary

Related Information

Affected Products

Languages:

Title

Title

Knowledge Center

Comparison of Endpoint Security Firewall features supported on Windows, Linux, and Macintosh

Environment

Summary

Related Information

Affected Products

Languages:

Choose your region

Title

Title