Dirty Interface Outbout
NoteActionPortProtocolDestinationSource
Allow outbound traffic from
samples. (To get accurate
results it is required that
malware be allowed to contact
its command and control
server using whatever port and
protocol it is designed to use.)
AllowANYANYInternetDirty
Interface
Dirty Interface Inbound
NoteActionPortProtocolDestinationSource
Deny all incoming
connections.
DenyANYANYDirty InternetANY
Clean Interface Outbound
NoteActionPortProtocolDestinationSource
The appliance uses the clean
interface to initiate SMTP
connections to the configured
mail server.
Allow25TCPSMTP ServersClean
Interface
Clean Interface Outbound (Optional)
NoteActionPortProtocolDestinationSource
Optional, only required if
Clean DNS is configured.
Allow53TCP/UDPCorporate DNS
Server
Clean
Interface
Optional, only required if
AMP for Endpoints Private
Cloud integration is used.
Allow443TCPAMP Private CloudClean
Interface
Allow connectivity to server
designated to receive Syslog
messages and Threat Grid
notifications.
Allow514UDPSyslog ServersClean
Interface
Optional, only required if
LDAP is configured.
Allow389TCP/UDPLDAP ServersClean
Interface
Optional, only required if
LDAP is configured.
Allow636TCPLDAP ServersCean
Interface
Server Setup
6
Server Setup
Firewall Rules