ENS products include a feature to retrieve locally created client rules from the ENS client and display the client rules in the ePO console. The client rules are created manually or by using the
Adaptive mode feature. Then, you can manage the client-side rules and add them to your ENS policies. To delete these rules, follow the steps below.
- Log on to the ePO server.
- Click Menu, Policy, Policy Catalog.
- Select Endpoint Security Firewall from the Product drop-down list.
- Edit the Options policy.
- Click Show Advanced.
- Deselect the option Retain existing user-added rules and Adaptive mode rules when this policy is enforced.
NOTE: Deselect the option Enable Adaptive mode if you are finished tuning your policies. Disabling the option prevents the ENS Firewall client from auto-creating new Adaptive-mode client rules locally on the client. If you haven't tuned your policies, you can leave the option Adaptive mode selected to continue auto-creation of client rules for policy tuning or troubleshooting. You also need to reselect the option Retain existing user-added rules and Adaptive mode rules when this policy is enforced after performing this procedure. You must reselect the option to keep any new client rules from being deleted automatically at the next agent-policy-enforcement interval.
- Perform an agent wake-up call to the client.
- Review the ENS console. Any locally created firewall rules in the User-defined or Adaptive firewall rule groups are removed after the agent-policy-enforcement interval.
- When these locally created rules are removed on the client, perform another agent wake-up call to retrieve product properties from the client.
- Verify that the client rules are removed properly from the agent node on the ePO server. Review the agent node properties, and click the Endpoint Security Firewall product information. Under the Client Policy section of the product information, you should not see any references to Client firewall rules ###.
- After the client rules are removed from the agent node, the ePO server task Endpoint Security Firewall Property Translator runs. This task removes the ENS Firewall client rules from the ePO server. It runs automatically every 15 minutes on the ePO server, or you can run it manually once.
NOTE: Do not set the Endpoint Security Firewall Property Translator task to an Enabled state. The task listed in the ePO server task menu is only listed so that you can run it manually on-demand. You can use this option if you do not want to wait until the next autorun interval every 15 minutes.
- Repeat this process for any other client rules for ENS clients that have Firewall client rules listed in the ePO console at Reporting, Firewall Client Rules.
