How to Configure Firewall Management

How to Configure Firewall Management

Overview:

Why a rule on paper isn't the same as a rule on the endpoint

A firewall rule that exists only as a definition in the console does nothing for the endpoint it was meant to protect. Someone needs to decide what to allow or block, someone needs to push that decision to the right machines, and someone needs proof it actually landed - otherwise "we have a firewall policy for that" is just a document, not a control.

Firewall Management covers that full path: define a policy with its inbound/outbound posture and specific rules (protocol, direction, program, ports), deploy that policy to a chosen scope of endpoints, and track the deployment down to a per-endpoint status with an execution log. Nothing is enforced until it's deployed, and nothing is confirmed until the task status and output say so.

This guide walks the full workflow end to end: opening Firewall Management, creating a firewall policy, adding a rule to that policy, deploying the policy to specific endpoints, monitoring deployment progress, and confirming the rule actually executed successfully on the endpoint.

• Policies and rules are layered: a policy sets the overall profile-level posture (Action, Inbound, Outbound); rules within it define specific allow/block conditions by program, protocol, direction, and IP/port.
• Deployment is a separate step from policy creation: a policy has no effect until a Policy Deployment sends it to a defined scope of endpoints.
• Flexible endpoint scoping: deploy to All Endpoints, Specific Endpoints, Specific Department, Specific Locations, or Windows as a platform-wide scope.
• Per-endpoint task visibility: each deployment breaks down into per-endpoint tasks with their own status (e.g. Ready to Deploy, Success) and a timestamped execution log.
• Notify on deployment: an optional Notify To field lets you alert specific people when a deployment completes.

Prerequisites

Confirm these before creating a firewall policy. An incomplete rule (missing protocol, direction, or program) is the most common reason a deployment reports success while the endpoint's actual firewall behavior doesn't change as expected.

1. Administrator access: your account holds a role permitted to manage the Device Control -> Firewall Management module.
2. Agent installed and reporting: the endpoint agent is installed, registered, and reporting healthy on every target device.
3. Rule details decided in advance: know the exact program path (e.g. C:\Program Files\VideoLAN\VLC\vlc.exe), protocol, direction, and profile(s) the rule should apply to before creating it.
4. Endpoint scope identified: know which specific endpoints, department, location, or platform this policy should be deployed to before publishing the deployment.

Architecture: how a firewall policy reaches an endpoint

A firewall policy defines the overall posture and contains one or more rules. A policy deployment binds that policy to a scope of endpoints. The endpoint agent executes the rules and reports back a per-task status and log.

Step 1: Open Firewall Management

Get oriented in Device Control before creating anything, so you know where firewall policies and deployments each live.

Instructions

1. From the main console, go to Endpoints -> Device Control.
2. Under Network and Web, select the Firewall Management card - "Controls inbound and outbound traffic to reduce attack surfaces and prevent unauthorized network access."
3. Note the sections in the left sidebar: Firewall Policies and Policy Deployments.

Path: Console / Endpoints / Device Control / Firewall Management

Result: You're in the Firewall Management module with visibility into any existing policies and deployments before authoring new ones.

Step 2: Create a firewall policy

Define the overall posture: a name, the profile(s) it applies to, and whether inbound/outbound traffic is left alone or explicitly turned on or off.

Instructions

1. Go to Firewall Policies -> Create.
2. Enter a Policy Name describing the policy's intent, e.g. Block VLC Outbound Connection.
3. Add an optional Description.
4. Set Profile (e.g. All).
5. Set Action to On, Off, or Do Not Modify.
6. Set Inbound and Outbound to Do Not Modify (or another available option) as appropriate.
7. Optionally check Apply On Startup.

Path: Console / Device Control / Firewall Management / Firewall Policies / Create

Console: policy definition

Result: A firewall policy exists with its overall posture set. It has no rules or targets yet - those are added next and in the deployment step.

Step 3: Add a firewall rule to the policy

Define the specific condition to allow or block: which program, which protocol, which direction, and under which network profiles.

Instructions

1. In the policy panel, select + Add Firewall Rule.
2. Set Rule Action to Create, Delete, Enable, or Disable.
3. Enter a Rule Name, e.g. Block VLC Outbound Connection.
4. Add an optional Group Name.
5. Select one or more Profile(s): Domain, Private, Public.
6. Set Action to Allow or Block.
7. Set Protocol (e.g. Any, TCP, UDP, ICMPV4, IGMP, IPV6).
8. Set Direction to Inbound or Outbound.
9. Enter the Program path, e.g. C:\Program Files\VideoLAN\VLC\vlc.exe.
10. Optionally set Local IP, Remote IP, Local Port, and Remote Port.
11. Optionally check Overwrite if exists to replace a rule with the same name.
12. Select Create.

Path: Console / Device Control / Firewall Management / Firewall Policies / Create / Add Firewall Rule

Console: rule definition

Result: The policy now shows 1 under Firewall Rules in the Firewall Policies list, alongside any other existing policies (e.g. Block Specific ip, Allow Inbound RDP, Block FTP Traffic).

Step 4: Deploy the firewall policy to endpoints

Bind the policy to a scope of endpoints so it's actually enforced, rather than just defined.

Instructions

1. Go to Policy Deployments -> Create.
2. Enter a Deployment Name, e.g. Block VLC Outbound Connection.
3. Add an optional Description.
4. Set Scope to All Endpoints, Specific Endpoints, Specific Department, Specific Locations, or Windows.
5. If Specific Endpoints, select the target Endpoints from the list.
6. Set Select Firewall Policy to the policy created in Steps 2-3.
7. Set Deployment Policy (e.g. OOB Instant deployment policy, type Instant).
8. Optionally set Notify to for completion alerts.
9. Select Publish (or Save As Draft to finish later).

Path: Console / Device Control / Firewall Management / Policy Deployments / Create

Console: deployment definition

Result: A deployment task is created (e.g. ADR-264: Block VLC Outbound Connection) with stage Initiated and progress 0/1, visible in the Policy Deployments list alongside prior deployments.

Step 5: Monitor deployment progress

Track the deployment from Initiated through Completed, then drill into per-endpoint task status.

Instructions

1. Go to Policy Deployments to see every deployment with its Type (Install), Stage (Initiated, Completed), Progress, and Policy.
2. Select the view icon on a deployment row to open its Tasks panel, showing Endpoint, Name, Status, and Last Updated.
3. Refresh to see status move from Ready to Deploy to Success (or Failed) as the agent processes the task.

Path: Console / Device Control / Firewall Management / Policy Deployments

Console: task status

Result: Confirmation that the deployment is not just Completed at the task level, but actually Success at the individual endpoint level.

Step 6: Confirm rule execution with the task output

Verify the exact rule that was applied and that it completed without errors, rather than relying on the status label alone.

Instructions

1. From the Tasks panel, select the task row to open its Output view.
2. Review the timestamped log lines confirming the firewall policy execution began, the specific rule was applied, and the overall result.
3. Confirm the summary line reports the expected count of successful vs. failed rules.

Path: Console / Device Control / Firewall Management / Policy Deployments / Tasks / Output

Result: Evidence-backed confirmation that the specific rule was applied on the endpoint, not just an assumption based on the deployment or task status alone.

Best practices for firewall management

Troubleshooting: common issues and resolutions

Frequently asked questions