How to Use VMware Carbon Black Cloud Host-Based Firewall

Affected Products:

• VMware Carbon Black Cloud Standard
• VMware Carbon Black Cloud Advanced
• VMware Carbon Black Cloud Enterprise

Affected Versions:

• Windows Sensor 3.9 or higher

Affected Operating Systems:

• Windows

Host-Based Firewall Rules

A firewall rule is composed of an action and an object. Available actions are:

• Allow: Allows the network traffic
• Block: Blocks the network traffic
• Block and Alert: Blocks the network traffic and sends an alert to the Alerts page

Firewall rules are based on evaluation of the following types of objects:

• Local (client computer)
• Remote (computer that communicates with the client computer)

• IP address and subnet ranges
• Port or port ranges
• Protocol (TCP, UDP, ICMP)
• Direction (inbound and outbound)
• Application, determined by file path

Firewall rules can be combined into what is called a firewall rule group. A firewall rule group is a logical set of firewall rules that simplifies the management of multiple individual rules into a single group that have a shared purpose (for example, multiple rules to control access to FTP servers).

Rule groups and rules are defined in policies, and policies are assigned to assets.

Rule Precedence

When creating and applying rules, keep in mind the following order of precedence:

• Bypass rules take precedence over all other rules. Because of this, Host-based Firewall rules have lower precedence than Bypass rules.
• Host-based Firewall rules have higher precedence than Permissions rules that are set to Allow or Allow & Log.

Existing sensor conditions can impact the enforcement of rules. For example, the sensor can be in bypass mode or quarantine, or applications can be blocked. Carbon Black Cloud Host-based Firewall maintains the intended action of the rule as specified by the user, although the rule can take a different actual action when it is enforced based on the sensor condition.

For example:

Using Carbon Black Cloud Host-Based Firewall

This section provides a high-level overview of how to create and run firewall rules.

1. Select a policy to which to add firewall rules.
2. Set the default rule (Allow all or Block all).
3. Create a rule group and populate it with firewall rules.
4. View, create, and modify rule groups and rules as necessary.
5. Switch Host-based Firewall to Enabled on the Sensor tab.
6. Test the rules.

7. Review the rules outcome. Test rule data displays on the Investigate page.
8. Modify rules as necessary and retest until the rules perform as expected.
9. Stop testing rules that are verified to perform as expected and set their Status to Enabled.
10. If you have disabled it during modifications, switch Host-based Firewall to Enabled on the Sensor tab.
11. View firewall-related events and alerts on the Investigate and Alerts pages, respectively.
12. Continue to modify rules as necessary. Association of ordered (ranked) rule groups to security policies; rule groups can be reused across security policies.
    • Rules are evaluated in order of user-defined precedence.
    • Ability to test rules before enforcement.
    • Count of behaviors blocked by Host-based Firewall policy.
    • Visibility into security posture of assets through the Alerts and Investigate pages in the Carbon Black Cloud console.

To contact support, reference Dell Data Security International Support Phone Numbers.
Go to TechDirect to generate a technical support request online.
For additional insights and resources, join the Dell Security Community Forum.