BPP Firewall exceptions - interaction with Windows Domain Profile by GPO

[1tb]

We have a few SQL server apps running on some workstations (small database loads) that require SQL ports to be open. The default BPP settings don’t open these ports, yet they are already open by GPO in the windows domain profile.

As soon as you install BPP we cannot connect to our ‘local SQL servers’. Why doesn’t BPP firewall follow the same rules set up by our domain profile Group Policy?

This also happened with File and Printer sharing- enabled for domain profile for localsubnet, but as soon as avast BPP firewall installs it is blocked!

We just want to open up the ports in the group configured in the BPP console, but I cannot see how you do this for specific firewall ports? Where is it?

As it stands we have to go around to each workstation and customise the settings that are not exposed in the BPP console- too much work. We have decided to just disable Avast firewall on the clients and rely on the SBS GPO’s to manage the firewall ports.

[system]

This is a bit of a show stopper for me too.

How did you disable the firewall on the Workstations?

I have “unchecked” the firewall shield within the default group (the only group I have), but this does not seem to have had any lasting effect on the workstation settings. Initially they were disabled (and the users received a warning notification), but now they are all enabled again.

Regards,
Stephen

[giogio]

Is possible, if you disable the firewall, that a person see the alert notification.
If this person click on the “Fix”, of course, re-enable the firewall again, but I think it will turn off the firewall again when you restart the computer, it’s possible?

The only thing you can try to do, is disable the notification of firewall in status bar on the policy group

@wpn post:1

When i turn of the firewall or antispam in a group, all computers in that group turn yellow and the client tells me its not fully secured
Via the advanced settings it is possible to control the firewall and antispam. In a later release there will be better GUI access
Edit group settings → Expert Settings → avastcfg://avast5/Common/PropertyPowerbarFirewall → 0
Edit group settings → Expert Settings → avastcfg://avast5/Common/PropertyPowerbarAntispam → 0
(thanks Soaked for the correction)

Unfortunately I’ve not the ABPP but only ABP, then I can’t try to investigate with firewall shield :(, but I did some tests with other shields…

[system]

@giogio post:3

Is possible, if you disable the firewall, that a person see the alert notification.

Hello.

Many thanks.

Yes, that is what happens. However, the alert is from the Avast Client in the Taskbar Notification Area (not the windows Security Center).

Since the Windows Firewall is still running in ADDITION to the Avast One (as far as I can tell), editing Group Policy to surpress security warnings would not help.

Kind Regards,
Stephen

[giogio]

@studio_two post:4

Since the Windows Firewall is still running in ADDITION to the Avast One (as far as I can tell), editing Group Policy to surpress security warnings would not help.

There is a misunderstanding…For policy group I mean the policy configurable by avast console… not the Windows policy! Can you try to modify the avast settings in this mode?

@wpn post:1

When i turn of the firewall or antispam in a group, all computers in that group turn yellow and the client tells me its not fully secured
Via the advanced settings it is possible to control the firewall and antispam. In a later release there will be better GUI access
Edit group settings → Expert Settings → avastcfg://avast5/Common/PropertyPowerbarFirewall → 0
Edit group settings → Expert Settings → avastcfg://avast5/Common/PropertyPowerbarAntispam → 0
(thanks Soaked for the correction)

[system]

Ah, Ok. ;D

I will try your suggestion this evening.

Many Thanks,
Stephen

[system]

Unless I am mistaken, there is now a slightly easier way of disabling the Firewall:

[1] Edit Group Settings → Shields → Firewall (Uncheck)
[2] Edit Group Settings → Status Bar → Firewall (Uncheck)

Unchecking those TWO settings will:
[1] Disable the Firewall
[2] Prevent the Status Bar issuing a Warning.

Is this a NEW option? I don’t recall seeing it before, so make sure you have the latest version of the workstation client installed.

HTH
Stephen

[giogio]

I think this is a new feature of new console version 1.1.131.7 released on 06-10-2011…

[system]

@giogio post:8

I think this is a new feature of new console version 1.1.131.7 released on 06-10-2011…

Ah, thank you for the clarification.

It is important to update the CONSOLE to get this to work.

Many thanks,
Stephen

[spi]

I don’t know is right or not, in version 1.0.x is already has the feature disable or enable service by check mark and in version 1.1 this disable and enable service was move and changed as button on/off.