SonicWALL 4.5 manual Select a firewall protection mode, Learn mode

Enforced Client Product Guide	Using the Firewall Protection Service
	Configuring policies for firewall protection

5

Select a firewall protection mode

Specify how the firewall protection service responds to suspicious activity on client computers.

„Protect: It blocks the suspicious activity.

„Prompt: It displays a dialog box with information about the detection, and allows the user to select a response. This option is the default.

„Report: It reports suspicious activity to the SecurityCenter and takes no additional action.

For all modes, detections are reported to the SecurityCenter, where you can view information about them in reports.

To prevent popup prompts from appearing on client computers when applications are detected, and for highest security, we recommend using Protect mode.

To specify a response to firewall detections:

1On the Groups + Policies page, click Add Policy (or click Edit to modify an existing policy).

2Click the Desktop Firewall tab, select a Firewall Protection Mode, then click Save.

Use the following table to determine how policy options are implemented in the different protection modes.

Mode	Behavior of protection service
Report	„ No user prompts.
	„ Detections reported to SecurityCenter.
	„ Administrator can select allowed applications, which are not reported as
	detections.
	„ Can be used as a Learn mode.
Prompt	„ Users prompted about detections.
	„ Detections reported to SecurityCenter.
	„ Administrator can select allowed applications. These applications are not
	reported as detections, and users are not prompted for a response to them.
	„ Users can approve additional applications in response to prompts. These are
	reported to SecurityCenter.
Protect	„ Users not prompted about detections.
	„ Users notified about deleted or quarantined applications.
	„ Detections reported to SecurityCenter.
	„ Administrator can select allowed applications. These applications are not
	reported as detections.
	If the policy is changed from Prompt mode to Protect mode or Report mode, the firewall
	protection service does not save user settings for allowed applications. If the policy is then
	changed back to Prompt mode, users need to specify allowed applications again.

Learn mode

Report mode can be used as a “learn mode” to help you determine which applications to allow (see Set up allowed Internet applications on page 121). In Report mode, the firewall protection service tracks but does not block unrecognized Internet applications. You can review detected applications in the Unrecognized Programs report (see View unrecognized Internet applications on page 123) and approve those that are appropriate for your policy. When you no longer see applications you want to allow in the report, change the policy setting to Prompt or Protect mode.

115