You can create Time-Based Groups for limited internet access on clients that require public internet access for VPN connections.
These groups are useful in environments where an internet-restriction policy exists with Host IPS, but clients require internet access to build a VPN tunnel. This method allows the creation of VPN so users can access internal websites from public networks, on systems with Host IPS installed.
解決策
Use a Time-based Group to allow internet access while the VPN tunnel is established:
Log on to the ePO console.
Create a basic group in the Firewall Rules policy.
NOTE:This group can be placed in any order, as the group rules will only be active after you allow the group from McAfee Agent Tray icon.
Click Menu, Policy, Policy Catalog.
Select Host Intrusion Prevention 8.0:Firewall as the Product and Firewall Rules (Windows, Mac) as the Category.
Click New Policy, enter the name for the new policy, and click OK.
Click New Group and create a basic group with default settings that allows internet connectivity (example: Allow Port 80 HTTP traffic).
Click the Schedule tab, select the option Enable timed group from McAfee tray icon menu, enter a time for Schedule,and click Next.
Click Save.
When the user wants to activate this timed-group, they access it from the McAfee Agent Tray icon Quick Settings option.
NOTE: While this firewall rule group is active, the user can connect to a public network and establish a VPN tunnel.
Create a Connection Aware Group (CAG) that matches the VPN network to allow whatever traffic is needed.
If you do not want any outbound traffic from the system unless its CAG, do not have any Firewall rules below the CAG. The BLOCK ALL TRAFFIC option catches all non-VPN related traffic.
