home *** CD-ROM | disk | FTP | other *** search
Text File | 2000-06-08 | 366.0 KB | 2,693 lines |
- format. Network Associates User's Guides
- document all product functions extensively,
- and discuss how best to use your Network
- Associates product to accomplish your tasks.
-
- * An Administrator's Guide saved on the product
- CD-ROM or installed on your hard disk in
- Adobe Acrobat .PDF format. Administrator's
- Guides describe how to deploy, maintain and
- administer Network Associates server-based
- products in a networked environment.
-
- * Specialized guides. These can include
- reference guides, deployment guides,
- configuration guides, vulnerability guides
- for intrusion detection software, and other
- product-specific documentation.
-
- * An online help system. Online help gives you
- quick access to hints and tips about how to
- use your Network Associates software. The
- format of the online help system for the
- product will vary, depending on which
- platform or operating system you use to run
- your Network Associates product. In most
- cases, the software will display a Help menu
- item or link that you can use to start the
- system.
-
- Some products might also include context-
- sensitive online help. Right-click buttons,
- lists or other elements within dialog boxes
- to see brief, descriptive help topics.
-
- * A LICENSE.TXT file. This file outlines the
- terms of your license to use your Network
- Associates product. Read it carefully. If
- you install the Network Associates product,
- you agree to the license terms.
-
- * This Readme.txt file. This file contains
- last-minute additions or changes to the
- documentation, lists any known behavior or
- other issues with the product release,
- and often describes new product features
- incorporated into incremental product
- updates.
-
- To get answers to your technical support
- questions, send messages to:
-
- techsupport@mcafee.com.
-
- To ask about your eligibility for updates and
- upgrades, check your registration, or ask
- general questions related to Network Associates
- software, send messages to:
-
- custcare@nai.com
-
- _________________________
- SR1 - SYSTEM REQUIREMENTS
-
- To use McAfee Firewall you need:
-
- * IBM PC or compatible computer running
- Windows 95/98 or Windows NT with SP4 or
- higher.
- * 5 megabytes (MB) minimum of RAM.
- * 16 MB free hard disk space. Additional
- disk space is required to install any
- optional Internet software that may be
- included on the compact disc (CD) version.
- * Microsoft mouse or compatible pointing device.
- * Access to the Internet, either a dial-up
- account with an Internet Service Provider
- (ISP) or a constant connection through a
- network.
- * Winsock 2
-
- __________________
- IN1 - INSTALLATION
-
- To install McAfee Firewall:
-
- * Close all open programs.
- * Insert the McAfee Firewall CD in the
- CD-ROM drive.
- * In the McAfee Firewall Setup screen,
- click Install McAfee Firewall. If the setup screen
- doesnÆt start automatically when you close
- your CD-ROM drive, click Start on the Windows
- taskbar, click Run, then type d:\setup. If D
- is not the drive letter of your CD-ROM drive,
- substitute the correct drive letter.
- * Read the text in the Welcome to McAfee Firewall
- screen, then click Next to display the
- Software License Agreement. After you read the
- license agreement, click Yes to continue.
- * In the Choose Destination Location window,
- do one of the following:
- * To install the software into the default
- location C:\Program Files\McAfee Firewall, click Next>.
- * To install the files in an alternate location,
- click Browse, locate the appropriate directory,
- and then click OK. Click Next> to copy the
- McAfee Firewall files to your hard drive.
- * The final installation screen notifies you that
- the installation is complete and lets you choose
- to view the McAfee Firewall ReadMe file and start McAfee
- Firewall. By default, these options are selected.
- To disable either option, clear its check box.
- * Click Finish.
-
- Installing Windows NT Network Component
-
- You must first install McAfee Firewall before applying
- these instructions. All steps must be performed in the
- order shown below.
-
- * Start Network Control Panel
- (<START BUTTON->SETTINGS->CONTROL PANEL->NETWORK>).
- * Select <PROTOCOLS> tab.
- * Select <ADD>.
- * Select <HAVE DISK...>.
- * If you have the McAfee Firewall CD, enter pathname
- to "WINNT4.0" subdirectory found in the CD
- installation folder. For example, if your CD-ROM
- drive letter is drive E, enter E:\MCFIRE\WINNT4.0.
-
- The McAfee Firewall Network Driver files wer also
- copied into the McAfee Firewall installation folder.
- To access the McAfee Firewall Driver files from here
- enter C:\Program Files\Mcafee\McAfee Firewall
-
- * Select <OK>.
- * Select "McAfee Firewall."
- * Select <OK>.
- The network component will install and will appear
- as the "McAfee Firewall Network Driver" network
- protocol.
- * Select <CLOSE> from network control panel dialog box.
- Reboot your computer.
-
- Changing McAfee Firewall Operation To/From and NT Service
-
- McAfee Firewall for Windows NT can be run as an NT service
- to provide continuous protection for your PC. To manually
- setup McAfee Firewall as a service, please follow these
- instructions:
-
- * Start the Network Control Services Panel
- START->SETTINGS->CONTROL PANEL->SERVICES.
- * Highlight "McAfee Firewall" service.
- * Select <STARTUP>.
- * Select the desired mode:
- MANUAL - McAfee Firewall runs only upon manual launch.
- AUTOMATIC - McAfee Firewall launched during login
- sequence.
- * Reboot your system for the service changes to take
- effect.
- __________________
- KN1 - KNOWN ISSUES
-
- * McAfee Firewall does not currently fully support
- Windows 2000. You are able to use the program,
- however, features that uses the system settings
- will not work.
-
- see section on AD1
-
- ________________________________
- FQ1 - FREQUENTLY ASKED QUESTIONS
-
- * What is WinSock2?
- WinSock ("Windows Sockets") is an interface
- in your computer between the applications that
- you use (Explorer, Netscape, Eudora, Word, etc.)
- and the Operating System. This layer controls how
- your applications will interact with the rest of
- the computer. WinSock2 is an updated release of the
- original WinSock, adding new functionality and
- capabilites to Windows operating systems, thereby
- allowing your system to do more. Older machines
- may notice a slight slow down to some activities.
-
- * What will WinSock2 do to my PC?
- WinSock2 will enable your system to work with
- new applications that rely on improved WinSock
- features and management. Some older applications
- may not work and older machines may be slowed down
- slightly by WinSock2.
-
- * How do I install (uninstall ) WinSock2?
- Most WinSock2 kits are self-installing. If you
- install WinSock2 and have already attempted an
- installation, please reinstall McAfee Firewall
- completely after rebooting your PC. Most WinSock2
- installation kits include an uninstall option
- and backup features.
-
- * Where do I get information about WinSock2
- and the kit?
- WinSock2 is a free upgrade available from many
- sources including (but not limited to) software.com,
- download.com, ZDNet, Microsoft and Tucows.
- You can also download an update at:
- http://www.microsoft.com/windows95/downloads/
- contents/wuadmintools/s_wunetworkingtools/
- w95sockets2/default.asp
-
- * What does McAfee Firewall do? How does it do it?
- McAfee Firewall filters traffic at the devices that
- your system uses - network cards and modems. This means
- that McAfee Firewall can reject inbound traffic before
- that traffic can reach vital functions in your PC and
- before it can waste valuable system resources.
-
- McAfee Firewall does this by monitoring applications
- that are either trusted or not trusted. When trusted
- applications need to access a network, McAfee Firewall
- manages everything in the computer to allow that
- application's traffic. When McAfee Firewall see
- non-trusted applications trying to access a network,
- it blocks all traffic to and from that application.
-
- Some network communications are needed to maintain
- network-based services. These are managed through
- user defined rules under the SYSTEM button. The default
- SYSTEM settings will provide protection from hostile
- threats. The installation routine will prompt with some
- basic questions to set up McAfee Firewall to do what
- you need (e.g. allow fileshares or not).
-
- * APPLICATION and SYSTEM: What do they mean?
- McAfee Firewall manages your network privacy
- through two large areas---APPLICATION traffic and
- SYSTEM traffic. APPLICATION traffic is based on trusting
- or not trusting applications that you know and use.
- SYSTEM traffic is more static and will allow or not allow
- things like fileshares and ICMP (control) traffic.
-
- When you click on APPLICATION, you must choose whether
- you will automatically trust all applications or not. If
- you choose to trust all applications, everthing that
- applications on your PC try to do will automatically
- be allowed. This is probably not a good thing to do,
- is it will open your PC to attack. If you choose to not
- trust applications, McAfee Firewall will begin to manage
- a "trusted" list and a "not trusted" list. You can always
- click on APPLICATION to see these lists and move known
- applications around.
-
- Once McAfee Firewall knows an application, it remembers
- it the next time the McAfee Firewall or the application
- in question is run. As new applications are run in the
- "not-trusted" mode, the system will prompt you for
- whether to trust this application or not.
-
- If McAfee Firewall asks you about an application that you
- know you are not currently running, or you do not have on
- your system, care should be taken in trusting it. Make
- certain you know what you are doing. While McAfee Firewall
- blocks the trojan horse, Back Oriface (BO), be default,
- it provides a good example of what might happen with other
- suspect applications. As BO attempted to run on your system
- and communicate out, McAfee Firewall would have captured
- this activity and asked you whether or not to trust it.
- It would have appeared to you as an application without
- an icon. Since you don't know what is happening, block it.
-
- System behaviour is defined under the SYSTEM button on a
- per device basis. Each device can have its own behaviour.
- For example, a network card may allow fileshares (sharing
- computer resources between trusted computers using the
- NetBIOS protocol); but that could be turned off over a
- modem to the Internet. The same applies to other basic
- services. For the most part, you need not concern yourself
- with protocols such as ARP, ICMP, NetBEUI and the like. If
- you need them, you probably know what they are.
-
- * What does the McAfee Firewall main window show?
- The MAIN window of McAfee Firewall (below the
- FILE, APPLICATION, SYSTEM, SYSTRAY and HELP tabs) shows
- activity that is live on your system. It also provides
- you with "radio-buttons" for global options like logging
- and overall behaviour of McAfee Firewall.
-
- * What do SUMMARY and DETAIL mean?
- SUMMARY shows basic applications that are trusted or
- not trusted in the main window of McAfee Firewall.
- DETAIL splits the main window into a left-hand
- summary side and a right-hand detail side that describe
- the network activity on your system.
-
- * What is the left-hand side for in DETAIL mode?
- The left-hand side show the two major network activity
- areas in your system: APPLICATION traffic and SYSTEM
- traffic. It also shows red current activity icon and
- blue log icon (if logging is enabled). Note that this
- is similar to the window's appearance when running SUMMARY
- mode with the addition of the current activity and log icons.
-
- When there is activity in the application area, a "+"
- sign appears in front of the icon. Clicking on the "+" sign
- will make it a "-" sign and will show the applications that
- McAfee Firewall is currently monitoring. There is
- always a "+" or a "-" in front of the system and application
- icons. This works exactly the same way as Windows Explorer,
- except that McAfee Firewall presents activities and
- applications (not files and folders).
-
- Each application can also be in a closed, explicit or inactive
- state. If a "+" or "-" sign appears in front of an application,
- that application is doing something. Clicking on the "+" or "-"
- sign will cause it to change state. In the explicit state, the
- application traffic will show "real-time" with red (block)
- arrows or green (allow) arrows for traffic direction and an
- icon to show the type of traffic as well as IP address or
- system names for the traffic. Applications with a red "X"
- on them are untrusted applications.
-
- * What is the right-hand side for in DETAIL mode?
- The right-hand side shows details on items that are
- highlighted on the left-hand side.
-
- * What does an X on an application mean?
- An "X" means that the application is not trusted and is
- being blocked by McAfee Firewall.
-
- * What do the little + and - signs mean and how do I use them?
- As described in section D., the "+" and "-" indicate activity
- in an item. The "+" sign is a closed state and shows not
- details. When the "+" sign is clicked, it becomes a "-"
- sign and represents an explicit state that shows details
- on the left-hand side of the main window.
-
- * The system is prompting me to trust an application.
- What should I do?
- The system will treat applications in one of two ways:
- (1)trust all applications or (2)don't trust all applications.
- This is set by clicking on APPLICATION and removing or adding
- a check mark to the TRUST ALL APPLICATIONS box.
-
- When there is no check mark here, McAfee Firewall
- will build a trusted list and a not-trusted list of applications.
- As new applications are run, if McAfee Firewall does
- not trust all applications, it will prompt the user to
- decide how it should treat each application. To change the
- status of an application, click on APPLICATION and move the
- application in question from the left, trusted list to or
- from the right, not-trusted list. NOTE-trusted applications
- can send and receive traffic; not-trusted applications can not.
-
- * Log files: Where are my log files and how do they work?
- The log files reside in the Private Desktop folder. This folder
- is in C:\PROGRAM FILES\McAfee\McAfee Firewall unless you chose
- another folder at installation. The files are of the format
- YYYYMM.log. For example, in September of 1999, the current
- log file will be 199909.log. Each log file can be up to 2
- MB in size before warnings are generated by the system and
- only essential messages are then written. If there is no log
- file, a new one is built for the current month. This means
- that a full log file can be deleted or renamed, and a new
- one will instantly replace it.
-
- The log file is in a ".txt" format and can be read
- with any text editor.
-
- * Network Control Buttons: What do they do?
- The NETWORK CONTROL buttons are at top left of the
- McAfee Firewall application window.
- They determine the overall behaviour of McAfee Firewall.
- Only one button can be selected at a time here:
-
- The first BLOCK EVERYTHING button will cause all traffic to
- be blocked regardless of any options chosen anywhere else.
- The second FILTER TRAFFIC button will cause all traffic to
- be processed as defined by options chosen elsewhere in
- McAfee Firewall.
- The final ALLOW EVERYTHING button will cause all traffic to
- be allowed, regardless of options chosen elsewhere in
- McAfee Firewall. This is a permissive mode and
- effectively turns off all protection provided by McAfee
- Firewall.
-
- * Display Buttons: What do they do?
- The DISPLAY buttons are in the top middle of the
- McAfee Firewall application window. They determine
- the single screen or split screen nature of the main portion of
- the McAfee Firewall window.
-
- * System Tray: How can McAfee Firewall start in the system tray?
- Click on SYS TRAY and select "Start in System Tray"
-
- * Auto Start: How can McAfee Firewall run automatically
- when I start my PC?
- You need to put a shortcut to the McAfee Firewall
- icon in the startup folder. This is C:\WINDOWS\ START MEN". On