Step 5

Step 5: Specify Network Application Policy

Specify the service by selecting the check box next to the scan to perform:

Application protocol detection—select this option to regulate activity on certain TCP and UDP ports. Select ICMP to regulate ICMP activity.

Select Application Protocol Detection.
Under TCP port, type the TCP ports or port ranges to scan.
Under UDP port, type the UDP ports or port ranges to scan.
Select ICMP to regulate ICMP activity.
Note: To use ICMP, ensure you select All ports in the TCP/UDP Protocol Ports settings in Step 2: Specify Authentication and Network Zones.

Specify an Endpoint Action by selecting one of the following:
- Monitor endpoints—flag the endpoint as “noncompliant”, but allow endpoint traffic to pass.
- Reject packets—return a reset packet (RST) to inform the source endpoint that the connection has been broken.
- Drop packets—close the connection to prevent the packets from passing.

Instant messaging detection—use this feature to regulate instant messenger activity.

Select Instant messaging detection.
Select the instant messaging software to regulate:
- MSN—select to check MSN or Windows Live Messenger traffic. You can regulate only file transfer activity or all activities.
- Yahoo—select to check Yahoo! Messenger traffic. You can regulate only file transfer activity or all activities.
- ICQ/AIM—select to check ICQ or AOL Instant Messenger (AIM) traffic. You can regulate only file transfer activity or all activities.
- IRC—select to regulate all Internet Relay Chat (IRC) activity

Specify an Endpoint Action by selecting one of the following:
- Monitor endpoints—flag the endpoint as “noncompliant”, but allow endpoint traffic to pass.
- Reject packets—return a reset packet (RST) to inform the source endpoint that the connection has been broken.
- Drop packets—close the connection to prevent the packets from passing.

File transfer detection—use this feature to regulate file transfer activity.

Warning: Avoid overly broad wildcard entries such as *.* or *.htm for the files to assess. These entries can completely block access to the Internet.

- Windows file transfer—select this option to assess CIFS and Samba protocol file transfers. Most of these file transfers occur when files are copied to and from shared folders.
- HTTP file transfer—select this option to assess HTTP file transfers.
- FTP file transfer—select this option to assess FTP file transfers.

Type the files to check under Files to assess and the files to allow under Exception.
Specify an Endpoint Action by selecting one of the following:
- Monitor endpoints—flag the endpoint as “noncompliant”, but allow endpoint traffic to pass.
- Reject packets—return a reset packet (RST) to inform the source endpoint that the connection has been broken.

Select Allow Control Manager to modify Network Application Policy settings when an outbreak occurs if you use a Control Manager server to manage Trend Micro products. The device temporarily enforces the Outbreak Prevention Policy during an outbreak and reverts to this policy afterwards.
Select Send policy violation data to syslog to record events to logs.
Click Next.