|
 | Document ID:2008070803545448
Last Modified:02/17/2010 |
How to block/allow website access using the Symantec Endpoint Protection Manager custom Intrusion Prevention Signature policy
| Situation: | How to block certain websites for access by clients in an organization, so we need to create a custom IPS policy to block access to websites |
| Solution: | NOTE: This rule is created to block Google,this rule can be used to block any website that is needed by making changes accordingly.
NOTE: The following steps require that you have Network Threat Protection and Intrusion Prevention installed on the client.
In the SEPM console, in the system navigation bar, click Policies.
In the View Policies navigation bar, select Intrusion Prevention.
In the Tasks list, click Add a Custom Intrusion Prevention Signatures.
In the Custom Intrusion Prevention Signatures window, set the Name of the policy to Block Google (just an example, you can choose the website that you need to block).
Under the Signature tab, in the Signature Groups section, click Add.
In the Intrusion Prevention Signature Group dialog, add the Group Name and Description as shown below, and then click OK.
Group Name: Block Google
Highlight the newly created Signature Group (Block Google), then in Signature for this Group section, click Add.
In the Add Signature window, fill in the following information shown below:
In the Content section add the following text:
rule tcp, dest=(80), msg="GOOGLE BLOCKED", content="www.google.com"
Under the Action section do the following:
Click OK to close the Add Signature window.
Click OK to close the Custom Intrusion Prevention Signatures window.
When prompted to assign the policy, click Yes.
In the Assign Intrusion Prevention Policy window, click the Global group, and then click Assign.
Click Yes to confirm policy changes.
Click OK to close the Intrusion Prevention Policies Changes dialog.
BLOCK GOOGLE policy now appears in the console under Intrusion Prevention Policies.
Note: If a site is being blocked and you want to allow it you can use the same steps but under action select allow. |
| Document ID:2008070803545448
Last Modified:02/17/2010 |
|
