Welcome to Online Help

Online: SPF2519—HSPF55.7

Printed: PSPF55.7

Welcome to Online Help for Sygate Personal Firewall

This Help system aids you in the installation and use of the Sygate Personal Firewall (the Personal Firewall).

Getting Help

Select Start|Programs|Sygate Personal Firewall|Sygate Personal Firewall. The Personal Firewall starts and displays the user interface. You can then choose Help|Help topics... from the menu bar, click the Help button, or press F1.

The online help system appears. It provides all the information needed to use the Personal Firewall.

All information in this help system is also available in the 5.5 Sygate Personal Firewall User Guide in Adobe's PDF format for easy printing. You can download the Sygate Personal Firewall User Guide from the Sygate Technologies web site at http://smb.sygate.com.

Documentation Version


What's New

What's New for the Firewall?

This release of the Personal Firewall has a variety of new and enhanced features. Among them:

  • Log Dampener Feature—The Personal Firewall adds new logging flexibility and performance enhancement features, including the option to selectively enable or disable the security logs, system logs, traffic logs, and full packet logs.

  • Anti-Application Hijacking Protection—The Personal Firewall now protects against even more attacks, including such exploits such as "TooLeaky" and others.

  • Enhanced performance—The Personal Firewall is now faster and takes fewer system resources.

  • Improved Logging Capabilities—The Personal Firewall adds new logging flexibility, including the option to disable all logs.

  • Support for Windows Server 2003—The Personal Firewall is now supported on Windows Server 2003 for Small to Medium Businesses. For server deployments greater than 500 seats and that need centralized management, Sygate Secure Enterprise is required.

  • Improved Microsoft System Installer Support—The Personal Firewall is now packaged by default as a Microsoft System Installer (MSI) package to simplify deployment with Microsoft SMS and other software distribution tools.


Related Documentation

This Help system describes how to use the Sygate Personal Firewall, and includes the following documentation:

  • Online Help—This help file provides the same information as the printed documentation, which is available in PDF format from the Sygate web site at http://smb.sygate.com/support/ for easy printing.

  • Sygate Personal Firewall User Guide (this guide)—Describes how to use Sygate Personal Firewall (PDF format).


Intended Audience

This documentation has been written for end users of the Personal Firewall software.

This documentation assumes that the user is familiar with the basic functioning of Windows operating systems and standard Windows items, such as buttons, menus, toolbars, windows, etc. Further, this guide assumes that the user has an Internet connection, whether through a local area network, DSL connection, dial-up modem, wireless access point, or other connection method.


Technical Support

Sygate Technologies provides a wide variety of service and support programs. Contact Sygate through its web site, by email, or by telephone.

Sygate web site: | http://smb.sygate.com/support
Sygate Forums: | http://forums.sygate.com/vb
Email Support: | http://smb.sygate.com/support/forms/proreq_form.htm

Sygate provides documentation support and accepts documentation feedback by email.

Documentation feedback:

documentation@sygate.com

Third-Party Product Support

If you obtained this product from a hardware or software company other than Sygate Technologies directly, your software license as well as all service and support should be obtained through that vendor. Check the addendum provided with the package for service and support information.


Receiving the Software

The Personal Firewall software can be distributed to you in a number of ways, one of which was used to get the software to your computer. You may need to take some action to go and get the software, or the software may already be installed.

  • Download from the Sygate site—You connect to the Sygate Technologies Web site to download this tool, by going to smb.sygate.com. With this type of installation, you may be prompted for your agreement to the license agreement, location of the software on your hard drive, and so on, as described in "Installing the Software."

  • Other Web download—You receive an e-mail message or other pointer to a location on the Web or a server on your Extranet where a zipped file exists. Run that file, and it will unzip the Personal Firewall files and then run the Setup.exe program to install the Personal Firewall. With this type of installation, you may be prompted for your agreement to the license agreement, location of the software on your hard drive, and so on, as described in "Installing the Software."


Installing the Software

Installing the Firewall Software

To install the software:

  1. Run Setup.exe.
    The Personal Firewall Setup window appears.

  2. Click Next.
    The License Agreement dialog box appears. Scroll through the agreement to make sure that you agree with its terms.

  3. Click I accept the license agreement if you agree, then click Next.
    The Destination Folder dialog box appears.

  4. Click Next to accept the default location for the Personal Firewall files or click Browse to select a different location.
    The Ready to Install the Application dialog box appears.

  5. Click Next.
    If you are updating a previous installation, the Upgrade Installation dialog box appears.

  6. If you want to keep the previous configuration, click Yes. Otherwise, click No.
    The Updating System window appears while the files are copied to your system, followed by the Finish window.

  7. Click Finish.
    The Installer Information dialog box appears, telling you that you must restart your computer to begin using the Personal Firewall.

  8. Click Yes to reboot your system and begin using the Personal Firewall, or click No if you plan to restart manually later.


Upgrading Sygate Personal Firewall

Upgrading Sygate Personal Firewall to the Pro version

You can upgrade Sygate Personal Firewall (standard edition) to the Pro version by following these steps:

Note:
Performing an upgrade by installing a newer version on top of the existing installation is allowed. However, for increased system stability as well as a good practice for all software, we recommend that the previous version be uninstalled before the new firewall is installed. Note that any previously configured settings will be lost.

Step 1. Download Sygate Personal Firewall Pro from the Sygate Web site and save it to your computer's desktop.

Step 2. Double click the downloaded pspf.exe file to start the installation process.

Step 3. The InstallShield Wizard will notify you that a previous version was detected. Click OK to continue with the upgrade process.

Step 4. Click Yes to save all previously configured settings.

Note:
Please select "No" if you want to exclude any previously configured settings or you are currently performing an upgrade from Sygate Personal Firewall (std).

Step 5. The upgrade process is now complete. You can now launch Sygate Personal Firewall Pro. Although restarting your system after installation is optional, it is still highly recommended.


Registering Sygate Personal Firewall

To register Sygate Personal Firewall, fill out the following form and click Register Now. You can also choose to Register Later, or to purchase Sygate Personal Firewall Pro by clicking Buy Pro:

Note:
Click here if you are having problems registering the software behind a proxy server. The latest Sygate information on that topic will display from the Sygate Web site.


Uninstalling the Software

If you need to uninstall the Software:

  1. Click the Start Menu on your task bar.

  2. Click Settings|Control Panel|Add/Remove Programs.

  3. Click Sygate Personal Firewall 5.5.

  4. Click Remove. Windows guides you through the process.

You can also remove Sygate Personal Firewall from the Start menu:

  1. Click the Start Menu on your task bar.

  2. Click Sygate Personal Firewall|UnInstall Sygate Personal Firewall


Using Sygate's Online Services

Assessing your vulnerability to an attack is one of the most important steps that you can take to ensure that your system is protected from possible intruders. With what you learn from this battery of tests, you can more effectively set the various options on your Personal Firewall to protect your system from attack.

Click the Security Test button located on the main console of the Personal Firewall, or select Test Your Firewall from the Tools menu:

The Sygate Technologies Web page (http://scan.sygate.com) displays. If you then choose Scan Now, the Sygate Online Services scanner scans your computer and attempts to determine your IP address, operating system, Web browser, and other information about your system.

You can then choose one of the more focused scans. To find out more about each one, click the name of the scan.

  • Quick Scan

  • Stealth Scan

  • Trojan Scan

  • TCP Scan

  • UDP Scan

  • ICMP Scan

To scan your system:

Click the name of the scan and then click Scan Now.

A brief document of frequently asked questions about Sygate Online Services is also available from the main scan page. Click Scan FAQ at the bottom left side of the screen.


Performing a Quick Scan

Quick Scan is a brief, general scan that encompasses several scanning processes. It usually takes 20 seconds or less to accurately scan your computer’s ports, protocols, services, and possible Trojans. The results are recorded in the Personal Firewall’s Security log.


Performing a Stealth Scan

The Stealth scan scans your computer using specialized stealthing techniques, which mimic portions of legitimate computer communication to detect the presence of a computer. The Stealth scan takes about 20 seconds to complete and is most likely not recorded in the Security log.


Performing a Trojan Scan

The Trojan scan feature scans all of your computer’s 65,535 ports for active Trojan horse programs that you or someone else may have inadvertently downloaded. The Trojan scan takes about 10 minutes to complete. A list of common Trojans is available on the Web site.


Performing a TCP Scan

The TCP scan examines the 1,024 ports that are mainly reserved for TCP services, such as instant messaging services, to see if these ports are open to communication. Open ports can indicate a dangerous security hole that can be exploited by malicious hackers.

It scans ports on your computer that are connected to devices such as routers and proxies for users connecting to the Web site through such a device. The scan takes about 20 minutes to complete and is logged by the Personal Firewall as a scan event in the Security log.


Performing a UDP Scan

The UDP scan uses various methods and protocols to probe for open ports utilizing UDP. The UDP scan will scan ports on your computer that are connected to devices such as routers and proxies for users connecting to the Web site through such a device. The scan takes about 10 minutes and should be logged in the Security log as a portscan from Sygate.


Performing an ICMP Scan

When an ICMP scan has completed scanning a user’s computer, it displays a page with the results of the scan. If a user is running the Personal Firewall, all scans are blocked.


Help - The System Tray Icon is Flashing

If the system tray icon is flashing, the Personal Firewall is in Alert Mode because:

  • An attack has been recorded on your computer in the Security Log.

OR

  • You are missing a file or an application that is required by your System Administrator before you can log into the network. If a file or an application is missing, a message is probably displayed that lists the missing files or applications that you need to install before you can proceed.

To assess the status of the attack:

  • Double-click the System Tray Icon

If the reason for the flashing is an attack, the Security Log is automatically displayed. Otherwise, the icon stops flashing.

The system tray icon can tell you many other things, as described here: "Shortcut to the Software: the System Tray Icon"


Introduction

The Personal Firewall is a security agent that is installed on workstations, servers, and laptops in the network enterprise and on home and small business systems. Once installed, it provides a complex and customizable firewall. In addition, it can also provide intrusion detection and prevention, such as detecting and identifying known Trojans, port scans, and other common attacks, and to selectively enable or block the use of various networking services, ports, and components. Something that you may want to do immediately is to test your System's vulnerability, using Sygate's Web site to test it.

The Personal Firewall is designed to protect your computer from intrusion and misuse, whether malicious or unintentional.


Some Options May Not Show

This document, the Sygate Personal Firewall User Guide, describes all options that the Personal Firewall supports, but describes some options that are only available with the Pro version of Sygate Personal Firewall. Options that are disabled may appear dimmed or may not appear at all on your computer. The following note appears next to those options:

Option Alert: This option may appear dimmed or not at all. For further information, see "Some Options May Not Show."

You also will see a pop-up window when you attempt to use a feature that is a part of Sygate Personal Firewall Pro. This is your reminder that there are even more features and capabilities that are available in that product. Click Tell Me More on that window to be taken to the Sygate Technologies Web site, where you can purchase the Pro version.


How Firewalls Work

A firewall is hardware, software, or a combination of both that is used to prevent unauthorized Internet users from accessing a private network. All information entering or leaving the network must pass through the firewall, which examines the information packets and blocks those that do not meet the security criteria. Sygate Personal Firewall starts with extensive firewall capabilities, and then enhances those capabilities with additional ones.


What Does the Software Do?

The Personal Firewall protects an individual computer from network traffic that can cause harm to that computer. It does this in a variety of ways, which can be summarized into three categories of firewall rules:

  1. Allow: The Personal Firewall Allows some traffic to flow. This is usually traffic that is known to be "safe", usually because you have defined it, application by application, to be "safe." Examples of traffic normally classified as safe include Outlook, Internet Explorer, Netscape Navigator, Outlook Express, and other common networking and communications software.

  2. Block: The Personal Firewall Blocks some traffic. This is usually traffic that is known to be problematic or dangerous to your computer.

  3. Ask: The Personal Firewall Asks whether incoming and outgoing traffic is allowed to access your computer or an organization’s network resources. When you run the Firewall, it initially asks you whether to permit your applications to access network resources. Optionally, it remembers your responses, so that you do not have to tell it again, for example, that you plan to use Internet Explorer or Netscape Navigator.

By using firewall rules, the Personal Firewall can systematically Allow, Block, or Ask about what action to take on incoming traffic from specific IP addresses and ports. The configuration of those rules with other security settings provides a security agent that protects your computer.


Agent Defaults: an Introduction

Personal Firewall Defaults: an Introduction

The Personal Firewall comes with default security policy settings. As a security agent, those settings are designed to be relatively secure "out of the box." However, the user can customize the default settings and default rules extensively.

For a more detailed summary, see, "Defaults: A Summary of Rules and Settings."


Starting and Using the Software

The Personal Firewall is usually set to start automatically when you turn on your computer, protecting you immediately. If you want to make changes in the configuration of your Personal Firewall or if you want to review logs of potential attacks on your Personal Firewall, you bring up the application itself so that you can make changes.

You have two main ways of opening the Personal Firewall application:

  • System Tray Icon—This way is easy to find: it is the icon that is on your system tray. Normally, it looks like this
    , an appearance that indicates that all is well, and that your system is transmitting traffic both to and from the network. To use the system tray icon, right click on it and make choices from there. For more information on how to use the system tray icon, see "Shortcut to the Personal Firewall: the System Tray Icon."

  • The Main Console —This is the control center for the Personal Firewall. From here, you have access to all of the settings and rules for the Personal Firewall. To bring up the main console, choose Sygate Personal Firewall from the Start menu. The main console appears.


Password Protecting Your Security Settings

You can set your Personal Firewall to use a password prior to making any security changes, and to require a password before shutting down the Personal Firewall.

Setting a Password

To set a password for the Personal Firewall, open the Tools|Options|General tab. Click the Set Password... button at the bottom right of the dialog box. The Password dialog box appears:

Enter your new password in the New Password field, and repeat it in the Confirm New Password field. Click OK to confirm, or click Cancel to discard your changes. From then on, this tab will show that password protection has been enabled:

Entering Your Password

Once you have set a password, the Personal Firewall prompts you for that password whenever you double-click the System Tray icon to access your security settings. You can also choose to have the Personal Firewall prompt you for a password before exiting the Personal Firewall, by clicking Ask password while exiting in the Password Protection dialog box. The Password... dialog box that prompts you for your password is the same in either case:

Enter your password and click OK to access the Personal Firewall.

Disabling Password Protection

You can choose to disable password protection by making no entry in the New Password field and confirming that in the Confirm New Password field. The tab will show that password protection has been disabled:


Shortcut to the Software: the System Tray Icon

Once installed, the Personal Firewall displays a small icon in your system tray (located on the right end of your task bar), consisting of two arrows. The arrows represent [image] system traffic: the upward-pointing arrow is outgoing traffic; the downward-pointing arrow is incoming traffic.

These arrows give you a real-time update of your computer’s traffic flow. You might not see a constant icon appearance for more than a few seconds, especially if you frequently use the Internet or your network connection.

The colors of the arrows are always changing (as is the traffic flow on your computer). For most users, it should be sufficient to remember the following points about the colors of the icon:

System Tray Icon colors
If the color of the arrow is... | ...then...
RED | ...traffic is being blocked by the Personal Firewall.
BLUE | ...traffic is flowing uninterrupted by the Personal Firewall.
GRAY | ...no traffic is flowing in that direction.

Alert Mode—Flashing System Tray Icon

The System Tray Icon will sometimes flash on and off. This tells you that the Personal Firewall is in Alert Mode. Alert Mode occurs when the Personal Firewall records an attempted attack on your computer. To view the attack information, double-click on the icon. The Security Log will open, displaying new log entries.

The icon will stop flashing after you double-click it and view the Security Log. Note that opening the Security Log through the main console will not cause the System Tray Icon to stop flashing.

For information on reading a Security Log, start with the "Understanding Logs."

Using the System Tray Icon

You can easily configure basic aspects of the Personal Firewall without even opening the main console. By right-clicking on the System Tray Icon, you can change your security level, view Help or log files, or even disable the Personal Firewall.

System Tray Icon
Menu Option | What It will do for you...
Sygate Personal Firewall | Opens the Personal Firewall main console.
Block All Normal Allow All | Blocks all network traffic. Provides your pre-chosen list of security policies and applies them. Allows all network traffic. This setting should be used for troubleshooting only.
Applications | Opens the Applications List.
Logs | Opens the Logs.
Options... | Opens the Options dialog box, where you can make detailed choices about your security.
Advanced Rules | Opens the Advanced Rules dialog box, where you can write specific rules for Allowing or Blocking network access.
Hide System Tray Icon | Removes the display of the System Tray icon for the Personal Firewall. The Personal Firewall is still running, but you no longer see the icon. To re-enable the icon, run the Personal Firewall and choose the option to show it: From the Start menu, choose Sygate Personal Firewall. Then, from the Tools menu, toggle the Hide System Tray Icon to toggle the choice back on.
Help Topics... | Opens the online help system.
About... | Opens the About window, providing information on your installation of the Personal Firewall.
Exit Sygate Personal Firewall | Disables the Personal Firewall. Option Alert: This option may appear dimmed or not at all. For further information, see "Some Options May Not Show."

You can roll your mouse over the System Tray Icon to see your current security level.

What the System Tray Icon Tells You

The table below illustrates the different appearances that the System Tray Icon may have, and what they mean.

What the System Tray Icon Tells You
Icon | Meaning
 | The Personal Firewall is in Alert Mode. This means that an attempted attack against your computer has been recorded in your Security Log. To make the icon stop flashing, double-click on the icon. The Security Log will open, displaying a new log entry.
 | The Personal Firewall is in Allow All mode.
 | The Personal Firewall is in Block All mode.
 | Incoming traffic is flowing uninterrupted; there is no outgoing traffic.
 | Both incoming and outgoing traffic are flowing uninterrupted.
 | There is no incoming traffic; outgoing traffic is flowing uninterrupted.
 | Incoming traffic is blocked; outgoing traffic is flowing uninterrupted.
 | Incoming traffic is blocked; there is no outgoing traffic.
 | Both incoming and outgoing traffic are blocked.
 | There is no incoming traffic; outgoing traffic is blocked.
 | Incoming traffic is flowing uninterrupted; outgoing traffic is blocked.
 | No traffic is flowing in either direction.


Client Control Mode Main Window

Server Control Mode Main Window

Power User Mode Main Window

A combination of all the security rules and settings that have been applied to a specific group to protect an enterprise's computing integrity. Security policies can include rules concerning the permitted applications, connection type, VPN, Ethernet, wireless, and any other restrictions or specifications that an organization wants to enforce.

A number that the Sygate Management Server automatically generates every time an Agent's policy changes. The system administrator can check the serial number on the Status panel of the Management Server to verify that the Agent is running an up-to-date policy.

Using the Main Console

The Main Console for the Personal Firewall is available from your Start menu: click Start|Programs|Sygate Personal Firewall|Sygate Personal Firewall. The main console appears. You can also bring up the main console by clicking the System Tray Icon.

The Personal Firewall interface is simple and intuitive. The main console (click to view image) provides real-time network traffic updates, online status, and links to logs, help files, and the Applications List.

The Personal Firewall interface is re-sizable, so you can view it as a full-screen or part-screen image.

Menus and Toolbar

The top of the screen displays a standard menu.

Toolbar Buttons

The buttons located below the menu items can be used to quickly access logs, view the Help file, or access the Applications List.

Traffic History Graphs

One of most noticeable features of the Personal Firewall is the set of Traffic History graphs (click to view image) that are located below the toolbar on the main console.

The Traffic History graphs produce a real-time picture of the last two minutes of your traffic history. The graphs reload new information every second, providing instant data, as measured in bytes, about your incoming and outgoing network traffic.

The Traffic History graphs are broken into three sections. On the left side of the graphs section are the Incoming and Outgoing Traffic History graphs. These provide a visual assessment of the current traffic that is entering and leaving your computer through a network interface. This includes traffic that is allowed and traffic that is blocked. The green lines and bars indicate traffic that is allowed to pass through, and the red coloring indicates traffic that is being blocked by the Personal Firewall.

Additionally, the Attack History graph on the right side of the console provides information on attempted attacks against your machine.

Broadcast Traffic

Broadcast traffic is network traffic that is sent to every computer in a particular subnet, and thus is not directed specifically to your computer. If you do not want to see this traffic, you can remove it from this graphical view by choosing to Hide Broadcast Traffic. You will then only see "unicast" traffic in this graph, which is traffic that directed specifically to your computer.

  • Click Hide Broadcast Traffic below the Traffic History graphs to make this traffic no longer appear in the Traffic History graphs.

  • Click Hide Broadcast Traffic to clear this setting, which causes broadcast traffic to appear.

Running Applications Field

The Running Applications Field provides a list of all applications and system services that are currently running on the your system. The display of application names can be changed through the View menu, or by right-clicking in the Running Applications field and selecting the desired view from the menu that appears.

You can also view the status of the applications. An application’s “status” refers to the permissions that you allow it—whether it can access your Internet connection, if it can access that connection without asking you first, or if it is blocked from accessing the Internet or network altogether.

You can change the status of applications from the Running Applications field by right-clicking on an application’s icon and selecting the desired status.

Running Applications Field
Icon | Status | Description
 | Allow | Icon appears normal, with no marks
 | Ask | Icon appears with a small, yellow question mark
 | Block | Icon appears with a red circle and cross-out mark

Additionally, application icons will display a small blue dot on lower left-hand or right-hand corner to indicate if it is receiving (left-hand) or sending (right-hand) traffic.

You can hide the display of system services by clicking Hide Windows Services above the Running Applications field. There are a number of services running at any given time, and since they are often crucial to the operation of your computer, you most likely want to allow them. You will see pop-ups that ask you if you want to allow these services to run. It is generally fine to allow them, and you can allow them permanently without worry. The Personal Firewall will block the services or applications if anything within the application’s executable file changes. For instance, if you download a Trojan horse or an email virus that affects a service or application, the Personal Firewall will notice the difference and ask you if you want to allow it. If you have not made any changes to the service or application (such as an upgrade), then you will want to block these applications from running and alert your system administrator. See “Understanding Pop-Up Messages” for details on pop-up messages.

Message Console

The Message Console of the Personal Firewall is located below the Running Applications field on the main console. It provides a real-time update of server-client communication, including profile downloads, Profile Serial Numbers, and server connection status.

The Message Console is, by default, hidden from view. To view the Message Console, click Show Message Console below the Running Applications field on the main console. The Message Console will appear.

To hide the Message Console from view, click Hide Message Console. The Message Console will collapse so that only the Show Message Console button is apparent.

Status Bar

The Status Bar, located along the bottom of the Personal Firewall main console, provides the user with the current location profile information.


Using the Menus and the Toolbar

The top of the Personal Firewall screen displays a standard menu with the following options: File, Security, Tools, View, and Help.

Firewall Menus

Menu

Menu choices

File

  • Close—Closes the Personal Firewall main console.

  • Exit Personal Firewall—Disables the Personal Firewall, effectively turning off security on your machine.

Security

  • Block All—Blocks all network traffic on your machine.

  • Normal—Blocks only selective traffic. This is the default configuration, and is a prudent choice.

  • Allow All—Permits all network traffic to flow on your machine. This is almost as non-secure as exiting the Personal Firewall, and is not recommended. It should be used for troubleshooting only.

Tools

  • Applications—Opens the Applications List.

  • Logs—Opens the Logs.

  • Options—Opens the Options dialog box, which contains many security options, including email alerts, Network Neighborhood browsing rights, and log file configuration.

  • Advanced Rules—Opens the Advanced Rules dialog box, where you can set very specific rules for the implementation of security on your Personal Firewall.

  • Update Signature—Updates intrusion prevention signatures.
    Option Alert: This option may appear dimmed or not at all. For further information, see "Some Options May Not Show."

  • Automatically Start Service—This toggle setting sets whether the Personal Firewall will be launched automatically when your machine is booted.
    Option Alert: This option may appear dimmed or not at all. For further information, see "Some Options May Not Show."

  • Hide System Tray Icon—This toggle setting hides the System Tray Icon from view. If it is checked, the icon is hidden.

  • Test Your Firewall—Opens the Sygate Technologies scan site, allowing you to test the effectiveness of the Personal Firewall.

View

The View menu gives users the option to alter the display of software programs in the "Running Applications" field:

  • Large Icons—Displays 32x32 icons in the field. Each icon represents a software application or a system service.

  • Small Icons—Displays 16x16 icons.

Both the large and small icon displays provide the full name of the application below the icon itself, and the icons are displayed in a “corkboard” fashion.

  • List—Provides small icon representations, with the icons displayed in a standard list.

  • Applications Details—Provides not only a list of all running applications, but also useful information on the version number and location path of each application.

  • Connection Details—Provides further information on the type of connection being made by an each application accessing the network adapter, as well as the protocol, local and remote ports and IP addresses being used, the application path, and more.

  • Hide Windows Services—Toggles the display of Windows Services in the "Running Applications" field.

  • Hide Broadcast Traffic—Toggles the display of broadcast traffic in the "Running Applications" field.

Help

  • Managed Personal Firewall—Links to the Sygate Technologies Web site to show the corporate version of the Firewall, Sygate Security Agent.

  • Easy Internet Sharing—Links to the Sygate Technologies Web site to show Sygate's Home Networking product line

  • Upgrade to Sygate Personal Firewall Pro—Links to the Sygate Technologies Web site, where you can download the upgrade to the more powerful version of Sygate Personal Firewall

  • Register...—Brings up a registration screen so that you can register your copy of the Firewall

  • Help Topics...—Opens the Personal Firewall online help files.

  • About—Opens the About screen.

Toolbar Buttons

The buttons located below the menu provide shortcuts that can be used to quickly block all applications, change your application profiles, access the logs, test your Personal Firewall using the Sygate Technologies Web site, or view the Help file.


What is this Pop-Up Window About?

What kind of pop-up window did you see? Click on a window to be taken to a description.


An application that carries out an unauthorized function covertly while running an authorized application. It is designed to do something other than what it claims to, and frequently is destructive in its actions. The Sygate Security Agent automatically detects and terminates known Trojan horse applications before the Trojan horse attempts to communicate.

Why Did I Get a Pop-Up Message?

An application-related pop-up message will occur for one of the following reasons:

  1. An application that the Personal Firewall has never seen before, or that has been assigned the status of “Ask” is trying to access your network connection.

  2. An application that normally accesses your network connection has changed, possibly because of a product upgrade.

  3. Your computer has received a data packet that is not associated with any particular application.

  4. The Personal Firewall has detected a Trojan horse on your computer.

New Application Pop-up

You may occasionally see the following pop-up message on your computer screen.

What Does This Mean?

The information on the pop-up tells you that Internet Explorer application is trying to access your network connection. Internet Explorer is trying to load www.google.com, which has an IP address of 216.239.39.99. The server that powers that site is using server port 80.

This pop-up appeared because Internet Explorer has been opened, either directly by you, indirectly by you, or by another application.

You might have tried to open Internet Explorer. If so, either this is the first time that you have done so since you installed the Personal Firewall, or you have assigned Internet Explorer a status of “Ask”, meaning that every time Internet Explorer tries to access your network connection, the Personal Firewall will ask you to grant it access.

What if you did not directly try to open Internet Explorer? Perhaps you clicked on a link to a web site in an email. In such a case, it is probably safe to click Yes and allow Internet Explorer to access the network.

What if you didn’t open any program or click on any link, and a program suddenly tries to access your network connection? Again, there could be a number of different reasons. However, if you haven’t opened any programs that use the application listed on the pop-up message, or can’t see any reason why that application should try to access your network connection, it is always safest to click No. This might indicate the presence of a Trojan horse on your computer, something that needs to be checked immediately.

Detail

Clicking the Detail button expands the pop-up box, providing further details on the connection the application is attempting to establish. Information such as the file name, version, and path are provided. Look at these items to make sure that they match the description of the application that you normally use. The details section should also indicate the location to which the file was attempting to connect: either local (meaning that it was trying to connect to your computer), or remote (meaning that the application was attempting to connect to an outside destination). Additionally, the local and remote port numbers and IP addresses should be provided, as shown in the following illustration:

What Should I Do?

This kind of message is common when you first start using the Personal Firewall. In this particular example, Internet Explorer is trying to access the www.google.com web site at the remote port 80. Most servers use port 80 to send and receive information on the Internet, so this isn’t anything unusual.

If you believe that you have triggered this application, it would be safe to click Yes. You have the option to tell the Personal Firewall to remember your answer in the future. If you click Remember my answer, and do not ask me again for this application, the Personal Firewall will remember your choice, and will act accordingly the next time this application tries to access your network connection.

If you have tried to open an application (such as a web browser) or a program that uses another application to access the Internet (such as a media streaming program) and you feel comfortable granting this application access to your network connection, then you can click Yes. The application will then be able to access your network. You can change the status of the application at any time, either in the Running Applications field or in the Applications List.

However, if a pop-up message is unexpected, and you can’t see any reason why the listed application should try to access your network connection, click No, and click Remember my answer.... This will assign the application the status of Block, so that it will be automatically blocked from your network connection any time it tries to gain access. You can change the status of the application at any time, either in the Running Applications field or in the Applications List.

You should also run a virus scan to make sure that you have not inadvertently downloaded a virus or a Trojan horse that could infect your computer files.

Pop-up: Remember My Answer?
Click | Check “Remember my answer...” box? | Status Assigned
Yes | Yes | Allow
Yes | No | Ask
No | Yes | Block
No | No | Ask

I Changed My Mind

What if you change your mind about an application after you have allowed it or blocked it? Simply go to the main console of the Personal Firewall, right click on the application’s icon in the Running Applications field, and click the desired status (Allow, Ask, or Block) from the menu that appears.

Changed Application Pop-up

Occasionally, you might see a pop-up such as the one pictured below.

What Does This Mean?

The application listed on the pop-up message is trying to access your network connection. Although the Personal Firewall recognizes the name of the application, something about the application has changed since the last time the Personal Firewall encountered it.

This could be because you have upgraded the product recently. The Personal Firewall uses an MD5 checksum to determine the legitimacy of an application. An upgraded version might not pass the checksum test, since a new build or new version of the application is likely to have a different checksum value.

On the other hand, if you have not recently upgraded the application, and see no reason why this message should appear, this could be an instance of a Trojan horse trying to access your network.

Detail

Clicking the Detail button expands the pop-up box, providing further details on the connection the application is attempting to establish. Information such as the file name, version, and path are provided. Look at these items to make sure that they match the description of the application that you normally use. The details section should also indicate the location to which the file was attempting to connect: either local (meaning that it was trying to connect to your computer), or remote (meaning that the application was attempting to connect to an outside destination). Additionally, the local and remote port numbers and IP addresses should be provided.

What Should I Do?

If you have recently upgraded the application mentioned on the pop-up message, it is probably safe to click Yes and allow the application network access. However, if you do not think that you have recently upgraded the listed application, you should click No and run an antivirus software program or, if you are at work, contact your IT department.

I Changed My Mind

What if you change your mind about an application after you have allowed it or blocked it? Simply go to the main console of the Personal Firewall, right click on the application’s icon in the Running Applications field, and click the desired status (Allow, Ask, or Block) from the menu that appears.

Trojan Horse Warning

Hopefully, you will never see a pop-up message like the following:

What Does This Mean?

This message indicates that the Personal Firewall has detected a known Trojan horse on your computer. It also explains that the Trojan horse has been blocked from accessing your network.

This means that a Trojan Horse is present on your system and has been activated. Either you tried to open the program identified as a Trojan horse, or it has been triggered by another program on your computer. It is possible that the Trojan was on your computer when you installed the Personal Firewall, or that you have recently downloaded it through a legitimate application, such as a web browser. The Trojan tried to access your network connection, and has been blocked by the Personal Firewall.

What Should I Do?

You should immediately notify your IT department. The Personal Firewall will block the Trojan from sending any information out of or into your computer, but it is still important to remove it from your system as soon as possible. The Personal Firewall will terminate the Trojan process automatically, but removal will require the assistance of your IT department.


Why Did I get a Security Notification?

Security notifications are designed to let you know the status of your security. You will see a security notification for one of two reasons:

  • Blocked Application Notification: An application that has been launched from your machine has been blocked in accordance with rules that you have set.

  • Security Alert Notification: There has been an attack launched against your machine, and this notification will either simply inform you of the situation or provide instructions on how to deal with it.

Blocked Application Notification

You may see notification messages above your system tray icon from time to time. They indicate that your system has blocked traffic that you have specified as not trusted. Please note that if you are operating under Block All mode, you will see these messages quite often. On the other hand, if you are operating in Allow All mode, you won't see any notifications at all.

If these notifications start annoying you, you can either click Do not show this window again, or you can disable these messages altogether in the Options window, under the General Tab.

Security Alert Notification

You may see notification messages above your system tray icon from time to time. There are two types of notification messages. The notification pictured below indicates that the Personal Firewall has logged an attack.

If you do not want to see these notifications, you can either click Do not show this window again, or you can disable these messages altogether in the Options window, under the General Tab.


Setting up Protection for Your System

This section describes the various options that you have for protecting your system. It includes:

  • Setting Up Protection Based on Application

  • Setting Up Protection by Configuration Changes

  • Configuring Advanced Rules for Security


How to Set Permissions by Application

To set the permissions (Allow / Block / Ask) for your applications one by one, you approach through the Applications List. You can access the Applications List by clicking the Applications icon on the toolbar, or by selecting Applications under the Tools menu.

The Applications List shows all applications and services that have asked you for permission to access your network connection since the installation of the Personal Firewall. The application/service name, version, status, and path are provided in a simple screen.

Like the Running Applications field, you can change the display view for the applications and services shown in the Applications List. To change the view, right-click anywhere in the Applications List. Select View from the list of options, and then select the desired view. The different views are explained in the section covering the Main Console.

To select an application or service for configuration, click on any of its attributes as shown in the Applications List. The application or service name must be highlighted before you can change or configure its status. See "Setting up Advanced Rules" for information on security settings options.

The buttons at the bottom of the Applications List screen provide the option to remove selected or all applications from the list. Once an application/service is removed from the Applications List, its status is erased. When that application/service attempts to connect to the network again, you will be notified through a new application pop-up message (see “New Application Pop-up”), and be asked to assign a new status to the application/service.

Advanced Application Configuration

You can configure advanced security settings for each application on your application list by setting certain restrictions on which IP addresses and ports an application can utilize. Only users who have a firm grasp on computer ports and application protocols should use the advanced configuration options, lest unintended results occur.

To Set Advanced Configuration

  1. Open the Applications List by clicking on the Applications icon on the Personal Firewall main console, or by right-clicking the System Tray Icon and selecting Applications from the list of choices.

  2. Click the Advanced button at the bottom left corner of the Applications List screen.

  3. The Advanced Application Configuration window (click to view image) opens.

  4. Make sure that the correct application in selected in the Name of Application list box.

  5. Decide if the application should be allowed network access during Screensaver Mode. Click Allow during Screensaver Mode to allow. Click to clear this choice, and thus to block the selected application during Screensaver Mode.

  6. Enter trusted IPs or IP ranges in the Trusted IPs for the Application text box.

You must enter a valid IP address range. The following IP address ranges are not valid choices:

0.0.0.0

255.255.255.255

127.X.X.X

  7. Enter the ports or ranges of ports that can be utilized for this application.

  8. Click OK if you want the application restrictions to be in effect at all times. If you wish to set a time limit or schedule specific periods when the restrictions will be in effect, see “To Enable Scheduling” below.

To Enable Scheduling

You can also set times for which the advanced configurations take effect. This scheduling lets you set up the application restrictions to be in effect either during a specific time period, or excluding a specific time period, using the list boxes on this screen.

1. Click Enable Scheduling below the Ports section on the Advanced Application Configuration screen.

2. Click either During the period below or Excluding the period below.

3. Select a Beginning Month, Day, Hour, and Minutes from the appropriate list boxes.

4. Enter a duration in units of Days, Hours, and/or Minutes.

5. Click OK to set scheduling restrictions.


Reviewing and Changing the Permission Status of an Application

Depending on the type of control that the Personal Firewall is under, you may or may not be able to change an application's access status.

  • What is access status?

  • How do I change an application's access status?

What is Access Status?

Access Status is a set of rules that governs how many rights an application has in terms of having access your network connection or modem. Depending on what status is assigned to an application (or service) and how much configuration you apply to it, an application can either gain access to your network any time, under certain conditions, with your permission, or be blocked from gaining access to the network altogether.

The Personal Firewall provides the following type of access status:

  • Allow

An application with a status of Allow is permitted to have access to network connections. Under the Allow status, an application (or service) can be configured so that it can only access the network if using a certain port, or during certain hours.

  • Ask

When a new application attempts to access your network connection while you are under the default security setting (Normal), the Personal Firewall displays a pop-up window to ask if you want to allow the application to have access to the network because the application has a default access status of Ask. If you have not allowed or blocked an application, the Personal Firewall prompts you every time it tries to gain access to the network or modem.

  • Block

An application with a status of Block is denied access to the network.

You have several choices when the application pop-up message is displayed as shown in the following table.

Firewall Application Access Status
If you click | If you check “Remember my answer...” box? | Your Personal Firewall will...
Yes | Yes | Allow the application.
Yes | No | Ask you if you want to allow the application.
No | Yes | Block the application.
No | No | Block the application this time, and in the future ask you if you want to allow the application.

If you select:

  • Yes and tell the Personal Firewall to remember your answer, you are no longer prompted. This application is allowed to have access to the network until you change its access status. The application now has a status of Allow.

  • Yes but do not elect to have the Personal Firewall remember your answer, then every time this application attempts to gain access to the network, you are asked each time whether or not the application is allowed or denied access. This application now has a status of Ask.

  • No and tell the Personal Firewall to remember your answer, you are no longer prompted. This application is systematically denied access to the network unless you change its access status. This application now has a status of Block.

  • No but do not elect to have the Personal Firewall remember your answer, then every time this application attempts to gain access to the network, you are asked each time whether or not the application is allowed or denied access. This application now has a status of Ask.

If you change your mind about the access status of an application, you can change its status from the Applications List.

To Change the Status of an Application

  1. Open the Applications List.

  2. Click on the File Name of the appropriate application until the row is highlighted.

  3. Right-click on the highlighted row.

  4. Click the appropriate access status (Allow, Ask, or Block) from the list.

  5. Click OK to close the Applications List.


How to Change Configuration Options

The Options selection of the Tools menu offers several settings for the Personal Firewall, including e-mail notification of attacks, screen saver mode, log file configuration, and Network Neighborhood options.

You can open the Options... window either from the Tools menu at the top of the main console, or by right-clicking the System Tray Icon and selecting Options... from the menu that appears. The Options window consists of the following tabs:

  • General tab (see "Review of General Configuration Options")

  • Network Neighborhood tab (see "Sharing Files and Folders")

  • Security tab (see "Setting Detailed Security Options")

  • E-Mail Notification tab (see "Setting Up Email Notification of Security Events")

  • Log tab (see "Logging Security Events on Your System")

  • Updates tab (see "Updating Your Security")

The OK and Cancel buttons are located at the bottom of every tab in the Options window. The OK button applies any changes that you have made in the Options window, and then closes the window. Clicking the Cancel button ignores any changes you may have made in the Options window, and closes the window while retaining the previous settings.


Review of General Configuration Options

The broadest level of configuration options for protecting your Personal Firewall appears on the General tab (click to view image). This tab provides access to options for the basic running of the Personal Firewall.

Two buttons appear at the bottom of the Options window, and can be accessed from each tab.

  • Clicking the OK button applies any changes that you have made in the Options window, and then closes the window.

  • Clicking the Cancel button ignores any changes you may have made in the Options window, and closes the window while retaining the previous settings.

System Tray Icon

Checking this box will hide the System Tray Icon from view, or if it is hidden, will show the System Tray Icon. For details on the System Tray icon, see "Shortcut to the Software: the System Tray Icon."

Sygate Personal Firewall Service

Click this box to automatically launch the Personal Firewall at start-up.

Screensaver Mode

Enabling the Screensaver Mode option automatically sets your security level to Block All when your computer’s screensaver is activated. As soon as the computer is used again, the security level will return to the previously assigned level.

Hide Notification Messages

You can enable or disable the system tray notification messages by clicking here. Additionally, you may select to allow audio announcement of the notification window.

Password Protection

Enabling Password Protection will protect your settings from being changed by another user. Password Protection will prompt you to enter your password every time you access the Personal Firewall main console.


Sharing Files and Folders

The Network Neighborhood tab (click to view image) provides multiple interface support and network browsing rights configuration. The Network Neighborhood tab is made up of three sections: Network Interface, Network Neighborhood Settings, and Description.

The settings in the Network Neighborhood section apply to the network displayed in the Network Interface list box.

Network Neighborhood Settings

  1. Select the network from the Network Interface list box.

  2. Decide if you wish to browse other computers on the network and if you wish to allow other users on the selected network to browse your computer. Under the Network Neighborhood Settings section, select the appropriate check boxes:

  3. Select the Allow to browse Network Neighborhood files and printer(s) option to browse other files and printers on the selected network. This allows you to access other files on your network. If you disable this, you cannot copy files from network locations.

  4. Select the Allow others to share my files and printer(s) to allow other users of the selected network to browse your files and printer(s).

  3. Click OK.


Setting Detailed Security Options

A device or software that detects and notifies a user or enterprise of unauthorized or anomalous access to a network or computer system. Sygate's IDS operates on every machine in an enterprise on which the Sygate Personal Firewall is installed by analyzing network packets targeted at the network node and comparing them with signature database entries. An IDS helps identify attacks and probes by monitoring traffic for attack signatures that represent hostile activity. See also Intrusion Prevention System (IPS).

A device or software used to prevent intruders from accessing systems from malicious or suspicious activity. This is contrast to an Intrusion Detection System (IDS), which merely detects and notifies. Sygate Personal Firewall is both an IDS and an IPS product since the Firewall includes both an IDS and firewall functionality making it capable of not only detecting but also blocking an attack. See also Intrusion Detection System (IDS).

A device or software that detects and notifies a user or enterprise of unauthorized or anomalous access to a network or computer system. Sygate's IDS operates on every machine in an enterprise on which the Sygate Personal Firewall is installed by analyzing network packets targeted at the network node and comparing them with signature database entries. An IDS helps identify attacks and probes by monitoring traffic for attack signatures that represent hostile activity. See also Intrusion Prevention System (IPS).

A device or software used to prevent intruders from accessing systems from malicious or suspicious activity. This is contrast to an Intrusion Detection System (IDS), which merely detects and notifies. Sygate Personal Firewall is both an IDS and an IPS product since the Firewall includes both an IDS and firewall functionality making it capable of not only detecting but also blocking an attack. See also Intrusion Detection System (IDS).

A device or software that detects and notifies a user or enterprise of unauthorized or anomalous access to a network or computer system. Sygate's IDS operates on every machine in an enterprise on which the Sygate Personal Firewall is installed by analyzing network packets targeted at the network node and comparing them with signature database entries. An IDS helps identify attacks and probes by monitoring traffic for attack signatures that represent hostile activity. See also Intrusion Prevention System (IPS).

A device or software used to prevent intruders from accessing systems from malicious or suspicious activity. This is contrast to an Intrusion Detection System (IDS), which merely detects and notifies. Sygate Personal Firewall is both an IDS and an IPS product since the Firewall includes both an IDS and firewall functionality making it capable of not only detecting but also blocking an attack. See also Intrusion Detection System (IDS).

About Sygate's Intrusion Detection and Prevention System—only available in the Pro version

Sygate’s Intrusion Detection (SID) detects inappropriate and incorrect activity. It is a host-based Intrusion Detection system that operates on every computer on which the Firewall is installed. In addition, Sygate’s Intrusion Detection works in conjunction with Sygate’s Intrusion Prevention (SIP). As soon as a known attack is detected, it can be automatically blocked by one or several of Sygate’s Intrusion Detection and Prevention systems, also commonly referred to as Intrusion Prevention Systems (IPS).

Sygate supports the following Intrusion Detection and Prevention systems:

Port Scan Intrusion Detection and Prevention—Sygate’s Port Scan Intrusion Detection and Prevention system detects port scans. Although it can be a precursor to an intrusion attempt, it does not in itself allow access to a remote system. Whenever a port scan is detected, the port scan Intrusion Detection and Prevention system does not automatically block ports. Port Scan Detection is automatically enabled.

Trojan Intrusion Detection and Prevention—Sygate’s Trojan Intrusion Detection and Prevention system automatically terminates known Trojan Horse programs before the Trojan Horse attempts to communicate.

Signature-Based Intrusion Detection and Prevention—Sygate’s Signature-Based Intrusion Detection and Prevention system identifies known attacks by using a technique called pattern matching. For example, Sygate’s pattern matching Intrusion Detection and Prevention system can watch web servers that can be programmed to look for the string phf in GET /cgi-bin/phf? as an indicator of a CGI program attack. Each packet is evaluated for a specific pattern, such as a string in a single packet. If a match occurs, the attack is blocked.

Denial of Service Intrusion Detection and Prevention—Sygate’s Denial of Service (DoS) Intrusion Detection and Prevention system identifies attacks in which users or organizations are deprived of the services or a resource that they would normally expect to have available. It identifies known attacks based on multiple packets regardless of port number or type of Internet Protocol (IP), which is a limitation of signature-based Intrusion Detection and Prevention systems. Sygate’s DoS Intrusion Detection and Prevention system is automatically enabled when you install the product.

Setting Detailed Security Options

The Security tab (click to view image) offers a way to enable and disable some of the more complex security options. As such, this tab provides both power and complexity. You should test settings made here before propagating them to other computers, to make certain that they work as you intend.

Enable Intrusion Detection System

By default, this option is disabled and cannot be changed in the Standard version, and is enabled and changeable in the Pro version of the Personal Firewall. This feature provides you with alerts when another user attempts to compromise your system. Intrusion detection on the Personal Firewall actually enables a combination of both an intrusion detection system (IDS) and an intrusion prevention system (IPS). The end result is a system that analyzes network packets and compares them with both known attacks and known patterns of attack, and then blocks those attacks. One of the key capabilities of the Intrusion Prevention System is its capability to do deep packet Inspection. More details appear here.

Enable anti-MAC spoofing

By default, this option is disabled and cannot be changed in the Standard version, and is enabled and changeable in the Pro version of the Personal Firewall. Some hackers use MAC spoofing to attempt to hijack a communication session between two computers in order to hack one of the machines. MAC (media access control) addresses are hardware addresses that identify computers, servers, routers, etc. When Computer A wishes to communicate with Computer B, it may send an ARP (Address Resolution Protocol) packet to the computer.

The anti-MAC spoofing feature allows incoming and outgoing ARP traffic only if an ARP request was made to that specific host. It blocks all other unexpected ARP traffic and logs it in the security log.

Enable port scan detection

By default, this option is enabled and cannot be changed in the Standard version, and is enabled and changeable in the Pro version of the Personal Firewall. By default, this option is enabled on the Personal Firewall. Port scanning is a popular method that hackers use to determine which of your computer's ports are open to communication. Ports are dynamically blocked by the Personal Firewall and are therefore protected from hacking attempts. This feature detects if someone is scanning your ports, and notifies you. If disabled, the Firewall does not detect scans or notify you of them, but still protects your ports from hacking attempts.

Enable anti-IP spoofing

By default, this option is disabled and cannot be changed in the Standard version, and is disabled and changeable in the Pro version of the Personal Firewall. IP spoofing is a process used by hackers to hijack a communication session between two computers, which we will call Computers A and B. A hacker can send a data packet that causes Computer A to drop the communication. Then, pretending to be Computer A, the hacker can communicate with Computer B, thus hijacking a communication session and attempting to attack Computer B.

Anti-IP spoofing foils most IP spoofing attempts by randomizing the sequence numbers of each communication packet, preventing a hacker from anticipating a packet and intercepting it.

Enable driver-level protection

By default, this option is already enabled on the Personal Firewall. This feature, when enabled, blocks protocol drivers from accessing the network unless the user gives permission. If a protocol driver attempts to access the network, you will see a pop-up message asking if you want to allow it.

Enable OS fingerprint masquerading

By default, this option is disabled and cannot be changed in the Standard version, and is enabled and changeable in the Pro version of the Personal Firewall. This option keeps programs from detecting the operating system of a computer running the Personal Firewall software. When OS Fingerprint Masquerading is enabled, the Personal Firewall modifies TCP/IP packets so it is not possible to determine its operating system. It is recommended that you enable this option along with Enable anti-IP spoofing.

Enable stealth mode browsing

By default, this option is disabled and cannot be changed in the Standard version, and is disabled and changeable in the Pro version of the Personal Firewall. Stealth mode is a term used to describe a computer that is hidden from web servers while on a network. A computer on the Internet, for instance, if in stealth mode, cannot be detected by port scans or communication attempts, such as ping.

NetBIOS protection

By default, this option is disabled and cannot be changed in the Standard version, and is disabled and changeable in the Pro version of the Personal Firewall. This option blocks all communication from computers located outside the Personal Firewall's local subnet range. NetBIOS traffic is blocked on UDP ports 88, 137, and 138 and TCP ports 135, 139, 445, and 1026. Be aware that this can cause a problem with Outlook if connecting to an Exchange server that is on a different subnet. If that occurs, you should create an advanced rule specifically allowing access to that server.

Enable DoS protection

By default, this option is enabled and cannot be changed in the Standard version, and is enabled and changeable in the Pro version of the Personal Firewall. This option causes the Personal Firewall to check incoming traffic for known Denial of Service (DoS) attack patterns. DoS attacks are characterized by an explicit attempt by an intruder to prevent legitimate users of a service from using that service.

Anti-Application Hijacking

By default, this option is enabled on the Personal Firewall. This option causes the Personal Firewall to check for malicious applications that work by interjecting DLLs and Windows hooks into Windows applications, and to block those malicious applications when found.

Block Universal Plug and Play (UPnP) Traffic

By default, this option is disabled and cannot be changed in the Standard version, and is enabled and changeable in the Pro version of the Personal Firewall. This option causes the Personal Firewall to look for and block UPnP traffic to counter the vulnerabilities that are introduced by this operating system feature: The first vulnerability could enable an attacker to gain complete control over an affected system, while the second vulnerability could enable an attacker to either prevent an affected system from providing useful service or utilize multiple users’ systems in a distributed denial of service attack against a single target. Users can disable this feature when using applications that require the UPnP protocol to operate.

Automatically block attacker's IP address for... second(s)

By default, this option is disabled in the Standard version, and enabled in the Pro version of the Personal Firewall. This feature blocks all communication from a source host once an attack has been detected. For instance, if the Firewall detects a DoS attack originating from a certain IP address, the Personal Firewall will block any and all traffic from that IP for the duration specified in the seconds field.

Block all traffic while the service is not loaded

By default, this option is disabled in the Standard version and cannot be changed, and it is enabled and changeable in the Pro version of the Personal Firewall. By default, this option is enabled in the Personal Firewall. This feature prevents any traffic from entering or leaving your computer during the seconds between the time that your machine turns on and the Personal Firewall is launched. This time frame is a small security hole that can allow unauthorized communication. Enabling this feature prevents possible Trojan horses or other unauthorized applications from communicating with other computers. This also takes effect if the Personal Firewall crashes or if the Personal Firewall is shut down.

Allow initial traffic

By default, this option is enabled in the Standard version and cannot be changed, while it is enabled and changeable in the Pro version of the Personal Firewall. This option enables initial traffic, needed for basic network connectivity, to take place. This includes initial DHCP and netBIOS traffic so that the Personal Firewall can obtain an IP address, for example.

Enable DLL authentication

By default, this option is disabled in the Personal Firewall. DLL stands for "dynamic link library", which is list of functions or data used by Windows applications. Most, if not all, Windows applications use DLLs to run, and each application uses specific DLLs. Often, several applications will access the same DLL. However, some hackers try to disguise malicious code or applications as DLLs, and use them to hack computers. Most DLLs have a file extension of .dll, .exe, .drv, or .fon.

Enabling DLL authentication means that you allow the Firewall to determine which DLLs are used by which trusted applications and to store that information. The Personal Firewall then blocks applications that are using DLLs that are not associated with a trusted application, or DLLs that are associated with a trusted application and that have changed. Note that this may take place if you download a patch to an application that modifies that application's DLL, in which case you are prompted to approve or reject using this changed DLL.

Because this option can interfere with the functioning of Windows applications, it is recommended that only users who have a firm understanding of Windows and DLLs enable this feature.

Automatically allow all known DLLs

By default, this option is enabled in the Personal Firewall. This option will automatically allow DLL modules that are commonly loaded by the network application, without prompting the user. Disabling this feature will cause the engine to prompt for permission on all new DLLs that are loaded, and may cause very frequent prompting when using a complex network application, such as an Internet browser.

Reset all fingerprints for all applications

By default, this option is enabled in the Personal Firewall. If you want to erase all application fingerprints, click this button. It clears the Personal Firewall's memory of all application fingerprints. The result is that each time you use an application that uses the network, you are prompted through a pop-up message to Allow or Block that application's activity.

Smart Traffic Handling

Enable smart DNS

By default, this option is enabled in the Standard version and cannot be changed, while it is enabled and changeable in the Pro version of the Personal Firewall. Smart DNS is a feature that blocks all DNS traffic, except for outgoing DNS requests and the corresponding reply. This means that if your computer sends out a DNS request, and another computer responds within five seconds, the communication will be allowed. All other DNS packets will be dropped.

If you disable this feature, please note that you will need to manually allow DNS name resolution by creating an advanced rule that allows UDP traffic for remote port 53.

Enable smart DHCP

By default, this option is enabled in the Standard version and cannot be changed, while it is enabled and changeable in the Pro version of the Personal Firewall. Smart DHCP is a feature that allows only outgoing DHCP requests and incoming DHCP replies, and only for network cards that allow DHCP.

Should you choose to disable this feature, and need to use DHCP, you must create an advanced rule for UDP packets on remote ports 67 and 68.

Enable smart WINS

By default, this option is disabled in the Standard version and cannot be changed, while it is disabled and changeable in the Pro version of the Personal Firewall. It allows Windows Internet Naming Service (WINS) requests only if they were solicited. If the traffic was not requested, the WINS reply is blocked.


Setting Up Email Notification of Security Events

The E-Mail Notification tab (click to view image) provides you with the option to automatically notify a specified recipient via email of any attacks against your computer.

To Activate E-Mail Notification

  1. First, select the frequency of notification. You have three choices. Selecting Do Not Notify will disable the email notification option. Select Notify Immediately to have an email sent immediately following an attack on your computer. Alternately, you can select to have an email sent at regular intervals following an attack, by selecting the After Every X Minute(s) dial.

  2. Enter an email address in the From: address field. This can be your personal email address or another email address.

  3. Enter a recipient email address in the To: field. This can be an administrator's email address, or your email address, if you are accessing email remotely.

  4. If you wish, you can send a courtesy copy of each email to a specified email address in the Cc: field.

  5. Enter a subject in the Subject field.

  6. Enter your SMTP Server Address.

  7. If your email server requires authentication, click My E-Mail Server Requires Authentication. Enter the address of the authentication server in the Authentication Server Address field.

  8. Enter your username and password for the authentication server in the appropriate fields.

  9. Click OK to save changes.


Updating Your Security

The Updates tab (click to view image) provides the capability of configuring your Firewall to check for:

  • New versions—Automatically check for, download, and install new versions of Sygate Personal Firewall. Note that you can also do this manually: from the same screen, click Check Now.

  • Signature Updates—Automatically check for, download, and install new Intrusion Detection signatures. Note that you can also do this manually: from the Main Menu, click Tools|Update Signature.

Note:
This feature is only available with Sygate Personal Firewall Pro.


Logging Security Events on Your System

The Log File tab (click to view image) provides a central location to manage the logs for the Personal Firewall. You can determine the standard log size for each log, as well as specify how many days of entries are recorded in each log. For more information on logs and how they work, see "Monitoring Your System: Logs." You can also toggle whether or not logs are kept for each type of log.

To Set Log Size

  1. Click the appropriate Maximum Log File Size field and enter a size, in kilobytes, of the maximum size for the log file.

  2. Click OK.

To Set Log Days

  1. Click the appropriate Save Log File for the Past field for the log you want to configure.

  2. Enter a number of days.

  3. Click OK.

To Clear the Log

To clear a log from the Log File tab:

  • Click Clear Logs for the log you want to clear.

To Enable the Security Log

  1. Click Enable Security Log to enable this choice.

  2. Select a maximum file size (512 Kb is the default setting).

  3. Enter a number of days for which the Personal Firewall should save the log file entries.

  4. Click OK.

To Enable the System Log

  1. Click Enable System Log to enable this choice.

  2. Select a maximum file size (512 Kb is the default setting).

  3. Enter a number of days for which the Personal Firewall should save the log file entries.

  4. Click OK.

To Enable the Traffic Log

  1. Click Enable Traffic Log to enable this choice.

  2. Select a maximum file size (512 Kb is the default setting).

  3. Enter a number of days for which the Personal Firewall should save the log file entries.

  4. Click OK.

To Enable the Packet Log

  1. Click Enable Full Packet Logging to enable this choice.

  2. Select a maximum file size (1024 Kb is the default setting).

  3. Enter a number of days for which the Personal Firewall should save the log file entries.

  4. Click OK.


About Advanced Rules

This section describes how to configure advanced security rules for the Personal Firewall. It goes through the various steps in creating an advanced rule that the Personal Firewall provides through its user interface, including:

  • "Setting up Advanced Rules"

  • "Overview of Creating Advanced Rules"

  • "Advanced Rules: Provide a Name, Specify Allow or Block"

  • "Advanced Rules: Specify a Source"

  • "Advanced Rules: Specify Ports and Protocols"

  • "Advanced Rules: Define a Schedule"

  • "Advanced Rules: Specifying Applications"


Setting up Advanced Rules

The Personal Firewall offers users the unique option to configure advanced rules that can override the rules automatically created by the firewall during normal user-firewall interaction. You may not realize it, but every time you allow or deny access to an application, you are creating a rule for that application. If you use Advanced Configuration to specify application access rights (such as scheduling and port rights), you are specifying parameters for the selected application, and thus creating an application rule. However, these rules are application-specific, so that if you create a schedule for an application, the schedule applies only to that application.

Advanced rules, on the other hand, are rules that you can create directly that affect all applications. If you create an advanced rule that blocks all traffic between 10 PM and 8 AM, the rule will override all other schedules and configurations that have been set for each application.

Rules in the Advanced Rules window will apply to all applications unless they are specifically tied to an individual application.

Maximum of Twenty Rules

Sygate Personal Firewall is limited to a maximum of twenty Advanced Rules. That limitation is not present in Sygate Personal Firewall Pro.


Overview of Creating Advanced Rules

When you create an Advanced Rule, first decide what effect you want the rule to have.

Do you want to block all traffic when your screensaver is on? Would you like to allow all traffic from a particular source? Do you want to block UDP packets from a web site?

  1. To begin, open the Tools menu at the top of the main console, and click Advanced Rules. The Advanced Rules dialog box (click to view image) will open, with an informational warning (click to view image) about their priority. Once you have created rules, they will appear in the main list.

  2. Click Add. The Advanced Rule Settings dialog box opens at the General tab.

  3. Enter a descriptive name for your rule on this tab, and then specify the conditions for it on the other tabs.

To create a rule, you must first specify the kind of traffic, and the conditions that must exist for the rule to take effect. There are five different sections within the Advanced Rule Settings dialog box where you can specify the characteristics of the traffic: General, Hosts, Ports and Protocols, Scheduling, and Applications. You can use as many sections as necessary to specify the conditions and characteristics (time of day, type of traffic, port number) that will cause the rule to take effect, as well as the effect the rule will have. The more information and characteristics that you enter in the Advanced Rule Settings dialog box, the more specific the rule will be. Note that each tab that contains specified information contributes to the functioning of a rule.


Advanced Rules: Provide a Name, Specify Allow or Block

The General tab (click to view image) is used to provide a name for the rule you are creating, as well as the effect that the rule will have (allowing or blocking traffic).

  1. First, enter a rule description. This will also function as the name of the rule, and it should indicate qualities of the rule. For instance, "Rule1" may not be a very good name for a rule, but "Block After 10 PM" would be (assuming the rule had some sort of function that did block traffic after 10 PM).

  2. Second, decide the main action of the rule - do you want to block traffic, or allow traffic?

  3. Next, choose which network interface card this rule will apply to. If you have multiple network cards, select one from the list box, or select All network interface cards to apply the rule to every card.

  4. Decide if this rule will be influenced by the activation of your computer's screensaver (if applicable).

  5. On—The rule will be activated only when the screensaver is on. This is a great feature if you want to block all traffic and all ports while you computer is idle.

  6. Off—This rule will be activated only if the screen saver is off and all other conditions are satisfied.

  7. Both On and Off—This rule is unaffected by the screensaver.

  8. Click Record this traffic in "Packet Log" if you want traffic affected by this rule to be entered in the Packet Log.

  9. The Rule Summary field at the bottom of the General tab provides a summary of the rule's functionality. Click OK to set the rule, or click on another tab to further specify rule conditions and properties.


Advanced Rules: Specify a Source

The Hosts tab (click to view image) is where you can specify the source (IP address, MAC address, or Subnet range) of traffic that you want to block or allow.

To block or allow traffic for a specified source:

  1. Click the Advanced Rules|Host tab.

  2. Select the way in which you want to identify the traffic source. Click All Addresses if you are planning on blocking traffic from all sources for this rule.

  3. Click MAC Address and type the corresponding address or address range.

  4. Click IP Addresses and type the corresponding address or address range.

  5. Click Subnet and type the corresponding subnet IP address and Subnet mask.

The Rule Summary field at the bottom of the General tab provides a summary of the rule's functionality. Click OK to set the rule, or click on another tab to further specify rule conditions and properties.


Advanced Rules: Specify Ports and Protocols

The Ports and Protocols tab (click to view image) provides an area to specify which ports and protocols, if any, should be affected by the traffic specified in the rule.

Select a protocol from the top list box.

All Protocols

As indicated, the ALL selection will affect all protocols on all ports, for both incoming and outgoing traffic.

TCP

If you select TCP from the Protocol list box, you will be given shown two more list boxes in which you can specify which ports (remote and/or local) should be affected by the rule. You can type the port numbers or select the port type from the list boxes for the both local and remote ports.

If you do not enter or select a port number, then all ports will be affected by the rule. If you enter a port number for the local port entry, but not for the remote port entry, then the local port you entered and ALL remote ports will be affected by the rule.

Then, select which traffic (Incoming or Outgoing) should be affected by the rule.

UDP

If you select UDP from the list box, you will then see two port list boxes. You can type the port numbers or select the port type from the list boxes for both local and remote ports. If you do not enter or select a port number, then all ports will be affected by the rule. If you enter a port number for the local port entry, but not for the remote port entry, then the local port you entered and ALL remote ports will be affected by the rule.

Then, select which traffic (Incoming or Outgoing) should be affected by the rule.

ICMP

If you select ICMP as the protocol for your rule, you will be shown a list of ICMP types. Select the types of ICMP that you wish allow or block by placing a check next to them. Then select the direction of traffic to be affected by the rule.

IP Type

Should you select IP Type from the list of protocols, you will see a list of IP protocol types displayed on the lower half of the Ports and Protocols tab.

Then, select the traffic direction from the pull-down list.

Click OK. The Rule Summary at the bottom of the window provides a description of the rule and what traffic it will affect on your system.


Advanced Rules: Define a Schedule

Scheduling is a good way to create a rule that you want to take effect only during (or excluding) certain time periods. For instance, if you want to block all traffic after 10 PM, then you can create a schedule that will permit the rule to do so.

  1. Open the Scheduling tab (click to view image). Click Enable Scheduling.

  2. Decide if you want the schedule to take place during a certain time period, or outside of a certain time period. Click either During or Excluding.

  3. Select a month, day and beginning time from the list boxes, or leave the default settings, which will apply the rule schedule to all day, every day, all year.

  4. If you have a beginning time, enter a duration for the rule's effect.

  5. The Rule Summary field at the bottom of the General tab provides a summary of the rule's functionality. Click OK to set the rule, or click on another tab to further specify rule conditions and properties.


Advanced Rules: Specifying Applications

You can specify applications that will be affected by advanced rules. The Applications tab (click to view image) provides a list of all applications that have accessed your network connection.

  1. To select an application to be affected by this rule, click the box next to its name under the FileName column. You can select all applications in the table by clicking the Select All button. To browse for applications that are not displayed in the table, click Browse... and select the application from its directory.

  2. You can choose to display only the applications that you have selected to be controlled by this rule by clicking Display selected applications only. The Rule Summary at the bottom of the window provides a description of the rule and what traffic it will affect on your system.


Introduction to Logs

About Logs

This section describes how you can monitor your system by using the logs that are present in the Personal Firewall. It begins with an overview of logs, describes how to export logs, and then describes each log, concluding with a section on back tracing logged events. The following topics are included:

  • Understanding Logs

  • Exporting Logs

  • Viewing Logs

  • Viewing the Security Log

  • Viewing the Traffic Log

  • Viewing the Packet Log

  • Viewing the System Log

  • Back Tracing Logged Events


Understanding Logs

Personal Firewall logs are some of the key sources of information on how your Personal Firewall interacts with the network. With logs, you can tell when you have been blocked from the network, and to some extent why. You can also troubleshoot connectivity problems or possible network attacks.

In the Personal Firewall, a log is a record of information attempting to enter or exit you computer through your network connection. There are four separate logs that monitor different aspects of your network connection.

Logs are an important method for tracking your computer's activity and interaction with other computers and computer networks. They are particularly useful in detecting potentially threatening activity, such as port scanning, that is aimed at your computer.

To view the different logs available in the Personal Firewall, click on the Logs icon on the toolbar at the top of the main screen.

Click the Logs button to view the log that you most recently viewed

OR click the down arrow and select a log type

There are four different logs in the Personal Firewall:

  • Security Log

  • Traffic Log

  • Packet Log

  • System Log

Another important capability of the Personal Firewall is Back Tracing, which enables you to use ICMP to determine all the hops between your computer and an intruder on another computer.


Exporting Logs

Logs can be exported and saved in different locations. You may want to do this to save space, but is it more likely that you do this to import them into a tool such as Microsoft Excel. Logs are an excellent tool for analyzing the traffic and the security incidents on your computer.

  1. To export a log file, open the log in the Log Viewer.

  2. Open the File menu, and select Export....

  3. In the Save As window, select the location for the log file. We recommend giving it an appropriate name, incorporating the date, and type of log file (Security, Traffic, etc.).

  4. Click Save.


Viewing Logs

You can view the following types of logs for the Personal Firewall:

  • Security—The Security log for the Personal Firewall records DoS attacks, port scans, executable file alterations, Trojan horse attacks, and host integrity.

  • Traffic—The Traffic log for the Personal Firewall is a record of Personal Firewall network traffic.

  • Packet—The Packet log for the Personal Firewall captures data packets for the Personal Firewall network traffic.

  • System—The System log for the Personal Firewall only deals with the operation of the Personal Firewall.

To view logs on the Personal Firewall:

  1. Click the Logs icon on the toolbar

    OR

    Click Tools|Logs

    OR

    Right-click the Tool Bar icon, and then click Logs

    The most recently viewed log appears.

You can also click the down-arrow next to the Logs icon to choose a different log. The most recently viewed log appears by default, but you can choose any of the logs to view.

  2. From the View list, select Local View, the default setting, or Source View. You can select how you view local and remote IP addresses or names. The following example is from the Security Log:

  • If you select Local View from the View list, then Remote Host, Remote MAC, Local Host, and Local MAC information appear. The Remote Host and Remote MAC always represent the IP address and MAC address of the attempted attacker whereas Local Host address and Local MAC always represent your IP address and your MAC address. Your system is always considered the Local system.

  • If you select Source View from the View list, then Remote Host, Remote MAC, Local Host and Local MAC information no longer appear. Instead, Source Host, Source MAC, Destination Host, and Destination MAC appear.

  • If someone sends a message or attacks your system, then the originator's IP address and MAC address are listed in the Source Host and Source MAC columns whereas your IP number and your MAC address are listed in the Destination Host and Destination MAC because you are the recipient.

  • If you send a message or attack someone else's system, then your IP address and MAC address are listed in the Source Host and Source MAC columns whereas the recipient's IP number and MAC address are listed in the Destination Host and Destination MAC sections.

  7. Click a different log name if you wish to view a different log.

  8. Click Refresh or press F5 to update the log that you are viewing.


Viewing the Security Log

The Security Log records potentially threatening activity directed towards your computer, such as port scanning, or denial of service attacks. The Security Log is probably the most important log file in the Personal Firewall.

Viewing the Security Log

To view the Security Log on the Personal Firewall:

  1. Click the down-arrow near the Logs icon on the toolbar, and then choose Security Log...

    OR

    Click Tools|Logs|Security Log...

    OR

    Right-click the Tool Bar icon, and then click Logs|Security Log...

You can also click the down-arrow next to the Logs icon to choose a different log. The most recently viewed log appears by default, but you can choose any of the logs to view.

  2. From the View list, select Local View, the default setting, or Source View. You can select how you view local and remote IP addresses or names.

  • If you select Local View from the View list, then Remote Host, Remote MAC, Local Host, and Local MAC information appear. The Remote Host and Remote MAC always represent the IP address and MAC address of the attempted attacker whereas Local Host address and Local MAC always represent your IP address and your MAC address. Your system is always considered the Local system.

  • If you select Source View from the View list, then Remote Host, Remote MAC, Local Host and Local MAC information no longer appear. Instead, Source Host, Source MAC, Destination Host, and Destination MAC appear.

  • If someone sends a message or attacks your system, then the originator's IP address and MAC address are listed in the Source Host and Source MAC columns whereas your IP number and your MAC address are listed in the Destination Host and Destination MAC because you are the recipient.

  • If you send a message or attack someone else's system, then your IP address and MAC address are listed in the Source Host and Source MAC columns whereas the recipient's IP number and MAC address are listed in the Destination Host and Destination MAC sections.

  3. Click a different log name if you wish to view a different log.

  4. Click Refresh or press F5 to update the log that you are viewing.

Icons for the Security Log

When you open a Security Log, icons are displayed at the left side of the first column. These are graphical representations of the kind of attack logged on each line, and they provide an easy way to scan the Security Log for possible system errors.

Personal Firewall Security Log Icons
Icon | Description
 | Severe attack
 | Major attack
 | Minor attack
 | Information

Personal Firewall Security Log Parameters and Description

The log is a data sheet, where each row represents a logged event, and the columns display information regarding the event. The columns are:

Personal Firewall Security Log Parameters and Description
Name of Parameter | Description
Time | The exact date and time that the event was logged
Security Type | Type of Security Alert (for example: DoS attack, executable file, Ping of Death)
Severity | The severity of the attack (either Severe, Major, Minor, or Information)
Direction | Direction that the traffic was traveling in (incoming, outgoing, or unknown)—Most attacks are incoming, that is, they originate in another computer. Other attacks, like Trojan horses, are programs that have been downloaded to your computer and therefore are already present; they are considered outgoing. Still other attacks are unknown in direction; they include Active Response or application executable changed.
Protocol | Type of protocol—UDP, TCP, and ICMP
Remote Host | Name of the remote computer (only appears in Local View - this is the default)
Remote MAC | MAC address of the remote computer (only appears in Local View - this is the default)
Local Host | IP address of the local computer (only appears in Local View - this is the default)
Local MAC | MAC address of the local computer (only appears in Local View - this is the default)
Source Host | Name of the source computer (only appears in Source View)
Source MAC | MAC address of the source computer (only appears in Source View)
Destination Host | IP address of the destination computer (only appears in Source View)
Destination MAC | MAC address of the destination computer (only appears in Source View)
Application Name | Name of the application associated with the attack
User Name | The User or Computer client that sent or received the traffic
Domain | Domain of the user
Location | The Location (Office, Home, VPN, etc.) that was in effect at the time of the attack
Occurrences | Number of occurrences of the attack method
Begin Time | The time the attack began
End Time | Time that the attack ended

Description and Data Fields for the Security Log

Below the rows of logged events are the Description and Data fields. When you click on an event row, the entire row is highlighted. A description of the event, such as "Somebody is scanning your computer, with 13 attempts", appears in the Description field.

Back Tracing Hack Attempts for the Security Log

  1. From the Traffic Log file, click on the event you want to back trace so that the entire row is highlighted.

  2. Either right-click the row and select Back Trace from the pop-up window or click the Action menu and select Back Trace.

The Personal Firewall traces the event information. The Back Trace Information window is displayed with a trace route log.

  3. To view detailed information on the original IP address, click the Whois>> button at the bottom of the Back Trace Information window. A drop panel appears, displaying detailed information about the owner of the IP Address from which the security event originated.

  4. Click the Whois<< button again to hide the information.

Filtering the Log Events by Severity in the Security Log

  1. In the Security log, you can filter the events that you are viewing by the severity level of the attack.

  2. In the Log Viewer, open the Filter menu.

  3. Select Severity.

    The Severity window appears.

  4. Place check marks in each box next to the severity level(s) that you want to view.
    You have the following options:

  • Critical

  • Major

  • Minor

  • Information

You can view more than one type of event at once. The Log Viewer is automatically reloaded.

Filtering the Log Events by Date in the Security Log

To filter the log events by date:

  1. Click the Filter menu in the Log Viewer window.

  2. Select which events you want to view from the list:

Viewing Personal Firewall Security Log Events by Date
Events for... | Displays...
1 Day Logs | the events recorded on the current day
2 Day Logs | the events recorded over the past 2 days
3 Day Logs | the events recorded over the last 3 days, including the current day
1 Week Logs | the events recorded over the past 7 days
2 Week Logs | the events recorded over the past 14 days
1 Month Logs | the events recorded over the last 30 days
Show All Logs | all Security Log events

  3. The log displays the requested events.


Viewing the Traffic Log

Whenever your computer makes a connection through the network, this transaction is recorded in the Traffic Log.

Viewing the Traffic Log

To view the Traffic Log on the Personal Firewall:

  1. Click the down-arrow near the Logs icon on the toolbar, and then choose Traffic Log...

    OR

    Click Tools|Logs|Traffic Log...

    OR

    Right-click the Tool Bar icon, and then click Logs|Traffic Log...

You can also click the down-arrow next to the Logs icon to choose a different log. The most recently viewed log appears by default, but you can choose any of the logs to view.

  2. From the View list, select Local View, the default setting, or Source View. You can select how you view local and remote IP addresses, MAC addresses, or ports/ICMP types.

  • If you select Local View from the View list, then Remote Host, Remote MAC, Remote Port/ICMP Type, and Local Host, Local MAC, Local Port/ICMP Type information appear. The Remote information always represents the attempted attacker whereas Local information always represents your local system. Your system is always considered the Local system.

  • If you select Source View from the View list, then Remote Host, Remote MAC, Remote Port/ICMP Type, and Local Host, Local MAC, Local Port/ICMP Type information no longer appear. Instead, Source Host, Source MAC, Source Port/ICMP Type, and Destination Host, Destination MAC, and Destination Port/ICMP Type appear.

  • If someone sends a message or attacks your system, then the originator's IP address, MAC address, and port/ICMP type are listed in the Source Host, Source MAC, and Source Port/ICMP columns whereas your IP number, MAC address, and your port are listed in the Destination Host, Destination MAC, and Destination Port/ICMP Code because you are the recipient.

  • If you send a message or attack someone else's system, then your IP address, MAC address and port/ICMP code are listed in the Source Host, Source MAC, and Source Port/ICMP Code columns whereas the recipient's IP number, MAC address, and port/ICMP type are listed in the Destination Host, Destination MAC, and Destination Port/ICMP code sections.

  3. Click a different log name if you wish to view a different log.

  4. Click Refresh or press F5 to update the log that you are viewing.

Icons for the Traffic Log

When you open a Traffic Log, icons are displayed at the left side of the first column. They are graphical representations of the kind of traffic logged on each line and provide an easy way to scan the Traffic Log. Traffic Log includes information about incoming and outgoing traffic.

Personal Firewall Traffic Log Icons
Icon | Description
 | Incoming traffic; passed through the Personal Firewall
 | Incoming traffic; blocked by the Personal Firewall
 | Outgoing traffic; passed through the Personal Firewall
 | Outgoing traffic; blocked by the Personal Firewall
 | Traffic direction unknown; passed through the Personal Firewall
 | Traffic direction unknown; blocked by the Personal Firewall

Personal Firewall Traffic Log Parameters and Description

Each row represents a logged event, and each column displays information about the event.

Personal Firewall Traffic Log Parameters and Description
Name of Parameter | Description
Time | The exact date and time that the event was logged
Action | Action taken by the Personal Firewall: Blocked, Asked, or Allowed
Severity | The severity of the attack (either Severe, Major, Minor, or Information)
Direction | Direction that the traffic was traveling in (incoming or outgoing)
Protocol | Type of protocol - UDP, TCP, and ICMP
Remote Host | Name of the remote computer (only appears in Local View - this is the default)
Remote MAC | MAC address of the remote computer (only appears in Local View - this is the default)
Remote Port/ICMP Type | Port and ICMP type on the remote computer (only appears in Local View - this is the default)
Local Host | IP address of the local computer (only appears in Local View - this is the default)
Local MAC | MAC address of the local computer (only appears in Local View - this is the default)
Local Port/ICMP Code | Port and ICMP code used on the Personal Firewall computer (only appears in Local View - this is the default)
Source Host | Name of the source computer (only appears in Source View)
Source MAC | MAC address of the source computer (only appears in Source View)
Source Port/ICMP Type | Port and ICMP type on the source computer (only appears in Source View)
Destination Host | IP address of the destination computer (only appears in Source View)
Destination MAC | MAC address of the destination computer (only appears in Source View)
Destination Port/ICMP Code | Port and ICMP code used on the destination computer (only appears in Source View)
Application Name | Name of the application associated with the attack
User | Login name of the user
Domain | Domain of the user
Location | The Location (Office, Home, VPN, etc.) that was in effect at the time of the attack
Occurrences | Number of occurrences of the attack method
Begin Time | The time the attack began
End Time | Time that the attack ended
Rule Name | The rule that determined the passing or blockage of this traffic

Description and Data Fields for the Traffic Log

Below the rows of logged events are the Description and Data fields. When you click an event row, the entire row is highlighted. A description of the event is displayed in the Description field.

Back Tracing Traffic Events for the Traffic Log

  1. From the Traffic Log file, click on the event you want to back trace so that the entire row is highlighted.

  2. Either right-click the row and select Back Trace from the pop-up window or click the Action menu and select Back Trace.

  3. The Personal Firewall traces the event information. The Back Trace Information window is displayed with a trace route log.

  4. Click Detail at the bottom of the Back Trace Information window to view detailed information about the original IP address.
    A drop panel displays detailed information about the owner of the IP Address from which the traffic event originated.

  5. Click Detail again to hide the information.

Viewing the Traffic Log Events by Date

To filter the log events by date:

  1. Click the View menu in the Log Viewer window.

  2. Select which events you want to view from the list:

Viewing Personal Firewall Traffic Log Events by Date
Events for... | Displays...
1 Day Logs | the events recorded on the current day
2 Day Logs | the events recorded over the past 2 days
3 Day Logs | the events recorded over the last 3 days, including the current day
1 Week Logs | the events recorded over the past 7 days
2 Week Logs | the events recorded over the past 14 days
1 Month Logs | the events recorded over the last 30 days
Show All Logs | all Traffic Log events

  3. The log is automatically displays the requested events.


Viewing the Packet Log

The Packet Log captures every packet of data that enters or leaves a port on your computer. The Packet Log is disabled by default in the Personal Firewall because of its potentially large size.

To enable the Packet Log, open the Options window by selecting Options... from the Tools menu. Click on the Log tab and click the check box next to the text Enable Packet Log. Then click Apply. If you do not have an Options window, the Packet Log is not available for your Personal Firewall.

Viewing the Packet Log

To view the Packet Log on the Personal Firewall:

  1. Click the down-arrow near the Logs icon on the toolbar, and then choose Packet Log...

    OR

    Click Tools|Logs|Packet Log...

    OR

    Right-click the Tool Bar icon, and then click Logs|Packet Log...

You can also click the down-arrow next to the Logs icon to choose a different log. The most recently viewed log appears by default, but you can choose any of the logs to view.

  2. From the View list, select Local View, the default setting, or Source View. You can select how you view local and remote IP addresses or ports.

  • If you select Local View from the View list, then Remote Host, Remote Port, Local Host, and Local Port information appear. The Remote Host and Remote Port always represent the IP address and port of the attempted attacker whereas Local Host address and Local Port always represent your IP address and your port. Your system is always considered the Local system.

  • If you select Source View from the View list, then Remote Host, Remote Port, Local Host and Local Port information no longer appear. Instead, Source Host, Source Port, Destination Host, and Destination Port appear.

  • If someone sends a message or attacks your system, then the originator's IP address and port are listed in the Source Host and Source Port columns whereas your IP number and your port are listed in the Destination Host and Destination Port because you are the recipient.

  • If you send a message or attack someone else's system, then your IP address and port are listed in the Source Host and Source Port columns whereas the recipient's IP number and port are listed in the Destination Host and Destination Port sections.

  3. Click a different log name if you wish to view a different log.

  4. Click Refresh or press F5 to update the log that you are viewing.

Icons for the Packet Log

There is only one icon displayed in the Packet Log. It indicates the capturing of raw data packets.

Personal Firewall Packet Log Icon
Icon | Description
 | Full data packet captured

Firewall Packet Log Parameters and Description

Each row represents a logged event, and the columns display information regarding the event. The columns are:

Personal Firewall Packet Log Parameters and Description
Name of Parameter | Description
Time | The exact date and time that the packet was logged
Remote Host | Name of the remote computer (only appears in Local View - this is the default)
Remote Port | Port on the remote host that sent/received the traffic (only appears in Local View - this is the default)
Local Host | IP Address of the local computer (only appears in Local View - this is the default)
Local Port | Port used on the Personal Firewall computer for this packet (only appears in Local View - this is the default)
Source Host | Name of the source computer (only appears in Source View)
Source Port | Port on the source host that sent/received the traffic (only appears in Source View)
Destination Host | IP Address of the destination computer (only appears in Source View)
Destination Port | Port used on the destination computer for this packet (only appears in Source View)
Direction | Direction that the traffic was traveling in (incoming or outgoing)
Action | Action taken by the Personal Firewall: Blocked or Allowed
Application Name | Name of the application associated with the packet

Packet Decode and Packet Dump for the Packet Log

Below the Log Viewer are two additional data fields that provide further detail regarding the selected event. In the Packet Log, these fields are labeled Packet Decode, which provides data on the type of packet logged, and Packet Dump, which records the actual data packet.

Back Tracing Packet Log Events

  1. From the Packet Log file, click on the event you want to back trace so that the entire row is highlighted.

  2. Either right-click the row and select Back Trace from the pop-up window or click the Action menu and select Back Trace.

  3. The Personal Firewall traces the event information. The Back Trace Information window is displayed with a trace route log.

  4. Click Detail at the bottom of the Back Trace Information window to view detailed information about the original IP address.
    A drop panel displays detailed information about the owner of the IP Address from which the traffic event originated.

  5. Click Detail again to hide the information.

Viewing the Packet Log Events by Date

To filter the log events by date:

  1. Click the View menu in the Log Viewer window.

  2. Select which events you want to view from the list:

Viewing Personal Firewall Packet Log Events by Date
Events for... | Displays...
1 Day Logs | the events recorded on the current day
2 Day Logs | the events recorded over the past 2 days
3 Day Logs | the events recorded over the last 3 days, including the current day
1 Week Logs | the events recorded over the past 7 days
2 Week Logs | the events recorded over the past 14 days
1 Month Logs | the events recorded over the last 30 days
Show All Logs | all Packet Log events

  3. The log is automatically displays the requested events.


Viewing the System Log

The System log records all operational changes, such as the starting and stopping of services, detection of network applications, software configuration modifications, and software execution errors. The System Log is especially useful for troubleshooting the Personal Firewall.

Viewing the System Log

To view the System Log on the Personal Firewall:

  • Click the down-arrow near the Logs icon on the toolbar, then choose System Log...

    OR

    Click Tools|Logs|System Log...

    OR

    Right-click the Tool Bar icon, and then click Logs|System Log...

You can also click the down-arrow next to the Logs icon to choose a different log. The most recently viewed log appears by default, but you can choose any of the logs to view.

Icons for the System Log

When you open the System Log, icons are displayed at the left side of the first column. These are graphical representations of the kind of event logged on each line, and they provide an easy way to scan the System Log for possible system errors.

Icons for the Personal Firewall System Log
Icon | Description
 | Error
 | Warning
 | Information

Personal Firewall System Log Parameters and Description

The Event Log is a data sheet, where each row represents a logged event, and the columns display information regarding the event. The columns are:

Personal Firewall System Log Parameters and Description
Name of Parameter | Description
Time | The date and time that the event has been logged
Type | The type of event represents an Error, Warning, or Information. An Error log indicates a problem with the source; a Warning log indicates a potential problem; and an Information log provides information about an event involving the Personal Firewall.
ID | The ID assigned to the event by the Personal Firewall
Summary | Summary description of the event

Description and Data Fields for the System Log

Below the rows of logged events are the Description and Data fields. When you click on an event row, the entire row is highlighted. A description of the event, such as "Install WsProcessSensor successful....", appears in the Description field.

Viewing the System Log Events by Date

  1. To filter the log events by date, click the View menu in the Log Viewer window.

  2. Select which events you would like to view from the list:

Viewing Personal Firewall System Log Events by Date
Events for... | Displays...
1 Day Logs | the events recorded on the current day
2 Day Logs | the events recorded over the past 2 days
3 Day Logs | the events recorded over the last 3 days, including the current day
1 Week Logs | the events recorded over the past 7 days
2 Week Logs | the events recorded over the past 14 days
1 Month Logs | the events recorded over the last 30 days
Show All Logs | all System Log events

  3. The log automatically displays the requested events.


Back Tracing Logged Events

Back tracing enables you to pinpoint the source of data from a logged event. Like retracing a criminal’s path at a crime scene, back tracing shows the exact steps that incoming traffic has made before reaching your computer and being logged by the Personal Firewall.

The option to back trace a log event is available in both the Security and Traffic logs.

To Backtrace a Log Event

  1. In an open log file, click on an event until it is highlighted.

  2. Right-click on the highlighted event.

A pop-up window prompts you to BackTrace.

  3. Click on the BackTrace option.

The Personal Firewall begins back tracing the event.

The BackTrace Information window is displayed. Information appears regarding the backtracing of the IP addresses that the log event data visited before arriving at your computer’s front door.

The Trace Route field provides details on each “hop” made by the data packet that was logged by the Personal Firewall. A “hop” is a transition point, usually a router, that a packet of information travels through at as it makes its way from one computer to another on a public network, such as the Internet.

Backtracing is the process of following a data packet backwards, discovering which routers the data took in order to reach your computer. In the case of a Security Log entry, you can trace a data packet used in an attack attempt. Each router that a data packet passes through has an IP address, which is provided in the Trace Route field.

WhoIs

Clicking the WhoIs button prompts the Personal Firewall to pull up detailed information on each hop logged in the Trace Route field. The information is displayed in a drop-down Detail Information panel. Please note that the information displayed does not guarantee that you have discovered who the hacker actually is. The final hop's IP address lists the owner of the router that the hackers connected through, and not necessarily the hackers themselves.

You can cut and paste the information in the Detail information field by pressing Control+C to copy the information to the Windows clipboard, and then pasting it (Control+V) into an e-mail message to your system administrator, for example, asking about a particular site that connects to your computer.

Please note that the information provided in the Detail Information panel should be used responsibly. It is not advisable to contact persons listed in the Detail Information field unless you are experiencing a high number of security logs in which the attacks originate from one particular IP address.


Defaults: A Summary of Rules and Settings

This table provides a summary of rules and settings for the Personal Firewall.

Default Rules and Settings for the Personal Firewall

The following rules and settings apply:

  • VPNs enabled—VPNs are enabled

  • IDS is enabled—IDS is enabled immediately, and a new IDS library

  • Ask before application use—Ask for user permission before permitting an application to use the network and log that decision

  • Security: Normal—The menu shows File, then Security, with the choices of Normal/Allow all/Block All. Normal is the default choice

  • Popup messages enabled

  • Allow ping reply

  • Allow traceroute

  • Browse Network Neighborhood enabled

  • Disable Network Neighborhood sharing—Block access to any files on the end user's computer

  • Screensaver—Ignore status

  • Windows Kernel—Ask before permitting access

  • Block broadcast traffic—Block all multicast and broadcast traffic and do not log it

  • Block all other traffic—Block all remaining network traffic and log it. This is the final rule to be implemented and catches everything that has not otherwise been covered


Troubleshooting Sygate Personal Firewall

This section is designed to help you to understand some of the areas that are sometimes causes of confusion. It includes questions and answers on:

  • "Firewall Configuration, Usage, and Software Expiration"

  • "Firewall Protection Against Attacks, Viruses, Trojans"

  • "Firewall and Internet Connection Sharing, VPNs, and Networking"

For the most up-to-date information, go to the Sygate Forums


Firewall Configuration, Usage, and Software Expiration

The usual questions that come up in this area include:

Can I continue using the product after the end of the upgrade protection period?

As with most software, the Personal Firewall will never stop functioning, once it has been registered. Purchasing the Upgrade Option gives you free updates and upgrades for a year, which includes updates to the Intrusion Detection signatures and upgrades to the Personal Firewall software.

Will the Firewall work on a computer that has multiple IP addresses assigned to a single NIC?

The Personal Firewall cannot detect your network card if you are running Windows NT 4.0, Windows 2000, or Windows XP, AND if you have multiple IP addresses assigned to one of more of the network adapters. You will need to remove the other IP address if you want to run the Personal Firewall software.

What should I do if I am having trouble with Network Shares?

In order to share files and printers, or to access mapped drives with the Personal Firewall, you must allow this feature for your inside NIC. To do this:

  1. From the Main Menu, click Tools|Options|Network Neighborhood.

  2. Enable both network settings for your inside NIC, by clicking Allow to browse Network Neighborhood files and printer(s), and by clicking Allow others to share my files and printer(s).

  3. From the Main Menu, click Tools|Options|Security.

  4. Be certain that Enable driver level protection and NetBIOS Protection are disabled. The default for these settings is enabled.

  5. From the Main Menu, click Tools|Applications, or click the Applications button.

  6. Set the following applications to Allow in the Running Applications list:

  7. mpsrv

  8. kernel

  9. ntoskrnl

  10. svchost

  11. NetBeui

also, possibly set these applications to Allow:

  • tcpsvcs

  • nwlnkipx.sys

  • ndisuio.sys

  • ssdpsrv


Firewall Protection Against Attacks, Viruses, Trojans

The usual questions that come up in this area include:

Does the Firewall protect against viruses and Trojans?

The Personal Firewall does not check for viruses, but it works well with virus-scanning software. Programs that access the network are checked for Trojans. If one is found, the network access is blocked to that Trojan program, and the program is automatically terminated. The Personal Firewall specifies the location of the Trojans, but does not delete them from your computer.

After updating one of my applications, the Firewall shows a major attack. Do I have a Trojan?

Upgrading any program will change the MD5 checksum, a value that the Personal Firewall uses to verify the integrity of each application on your computer. When the Personal Firewall sees that the executable for an application has been changed, it logs this in the Security Log with a severity of Major. If you have updated the software yourself, then there is probably no Trojan attached to it. However, if you have not updated the software and you receive this message, you should block the application and install a virus scanner using the latest signatures to remove this Trojan.

Does the Firewall do Stateful Packet Inspection?

Yes, the Personal Firewall does Stateful Packet Inspection on every Remote TCP connection. The Personal Firewall also uses an algorithm to check Remote UDP and DHCP traffic to make sure that the communication is secure.


Firewall and Internet Connection Sharing, VPNs, and Networking

The usual questions that come up in this area include:

Is the Personal Firewall compatible with Microsoft's Internet Connection Sharing (ICS)?

Yes, it is.

How do I configure the Personal Firewall to work with ICS?

To configure the Personal Firewall to work with ICS, all operating systems should be set as follows:

  1. From the Main Menu, click Tools|Applications, or click the Applications button.

  2. Set the following applications to Allow in the Running Applications list:

  • Kernel

  • LSA Shell

  • Generic Host Process

  • Application Layer Gateway Service (for Windows XP)

  • NCIS User mode I/O Driver

Based on the particular operating system in use, set the following applications to Allow:

  • For Windows 98/ME:

  • ICSHAREP.VXD

  • ICSMGR.EXE

  • NDIS

  • NetBeui

  • IPX (if used)

  • Kernel

  • For Windows 2000:

  • LSASS.EXE

  • TCP/IP

  • NDIS

  • NetBeui

  • IPX (if used)

  • Kernel

  • For Windows XP:

  • LSASS.EXE

  • ALG.EXE

  • NDIS

  • Kernel

When the Test button is clicked, the Personal Firewall starts the Internet Connection Wizard. Why?

The Firewall service uses the Windows System Account for access. Because each user account in Windows can have different settings, sometimes the Windows System Account does not have the same Internet Explorer settings. In this case, you must manually set up the Internet Connection Wizard after clicking on one of the Firewall's built-in links.

How do I set up the Personal Firewall to work with my CheckPoint VPN client software?

To allow CheckPoint's VPN client to work with the Personal Firewall, take the following steps, in order. Stop taking steps when the Firewall and VPN are both working:

  1. Be sure that you have set the VPN client and all of its components to Allow under the Applications List.

  2. Be sure that CheckPoint SecuRemote's firewall has not been enabled. If it has, you will need to take the following steps:

  3. Uninstall both the Firewall and the CheckPoint VPN client

  4. Reinstall the Firewall

  5. Reinstall the CheckPoint VPN client software, specifying to install it without the CheckPoint firewall

  3. Check your Traffic Logs to see if anything is being blocked when you try to use the VPN. If it is, create an Advanced Rule to allow those ports or applications.

  4. Try creating an Advanced Rule to trust all traffic for the IP of your VPN server.

  5. Try disabling driver level protection:

  6. From the Main Menu, click Tools|Options|Security.

  7. Be certain that Enable driver level protection is disabled. The default for this setting is enabled.

  6. Try disabling all security options:

  7. From the Main Menu, click Tools|Options|Security.

  8. Click to clear all options.

What should I do if experiencing a slow or non-existent connection after installing the Personal Firewall?

Here is the recommended procedure. Take the following steps, in order. Stop taking steps when your connection is working properly.

  1. Be sure that you set your browser to Allow under the Applications List.

  2. For DSL connections, be sure that you have set your NTS or PPPoE application to Allow under the Applications List.

  3. Create Advanced Rules to Allow incoming and outgoing traffic to and from all hosts and applying to <all NICs>, as follows:

  4. UDP remote and local ports 67 and 68 (one rule)

  5. TCP remote and local ports 67 and 68 (one rule)

  4. Create an Advanced Rule to trust the IP of your Internet Service Provider.

  5. Try disabling NetBIOS protection:

  6. From the Main Menu, click Tools|Options|Security.

  7. Be certain that NetBIOS Protection is disabled. The default for this setting is enabled.

  6. Try disabling driver level protection:

  7. From the Main Menu, click Tools|Options|Security.

  8. Be certain that Enable driver level protection is disabled. The default for this setting is enabled.

  7. Try disabling all security options:

  8. From the Main Menu, click Tools|Options|Security.

  9. Click to clear all options.

Should I Allow the win32 kernel core or ntkernel component? What about ICMP?

As a rule, if you are unsure about any application, you should not allow it to access the Internet. Only the applications that you specifically know about should be allowed. Under most circumstances, blocking the Windows kernel should not create a problem. However, some Internet Service Providers (ISPs) send you an ICMP message to verify that you are online. Blocking this message may cause them to turn off their interaction with your computer. If this happens, enable ICMP using the Advanced Rule editor:

  1. From the Main Menu, click Tools|Advanced Rules. You may have to click OK on a warning message before entering the Editor.

  2. Click Add. This will bring up a new rule template.

  3. Give the rule a name, such as "Allow ICMP", and then click Allow this traffic.

  4. Click the Ports and Protocols tab, and select ICMP from the dialog box. You will get another list of options from which to choose.

  5. Click Echo Reply - 0 and Echo Request - 8.

  6. Click OK to exit this rule.

  7. Click OK to exit the Advanced Rule editor.