About the setting "Block all traffic until the firewall starts"

Products

• Endpoint Protection

Issue/Introduction

What is the setting: Block all traffic until the firewall starts and after the firewall stops?

Cause

The option to "Block all traffic until the firewall starts and after the firewall stops." With a sub-option "Allow initial DHCP and Net BIOS traffic."

What are these options and when should they be used?

Resolution

Architectural Overview: Firewall Initialization and Traffic Handling

In Symantec Endpoint Protection (SEP), there is a brief but critical gap between the time the operating system starts and the time the firewall’s full rule set is applied. Understanding this sequence is essential for maintaining network connectivity during the boot process.

The Startup Sequence Gap

The SEP firewall operates using two distinct components that load at different stages of the boot cycle:

1. The Firewall Driver (teefer.sys): This loads very early at the kernel level. Its job is to intercept all incoming and outgoing network packets.

2. The Firewall Engine and Services (ccSvcHst.exe): The logic that tells the driver which traffic to allow or block (the rule engine, tse.dll) and the module that determines the computer's location (trident.dll) load much later as part of the main SEP service.

Because the driver starts before the engine, there is a "window of silence" where the firewall is active but has not yet received its instructions on how to handle traffic.

The Impact of the "Block All Traffic" Setting

The policy option "Block all traffic until the firewall starts" determines how the driver behaves during this initialization window:

• When Enabled: The teefer.sys driver defaults to a "Fail-Safe" mode, blocking all network communication until the main service (ccSvcHst.exe) is fully operational.

• The Risk in Enterprise Domains: Many corporate environments require the computer to communicate with a Domain Controller immediately upon boot for authentication and Group Policy updates. If this traffic is blocked, the computer may experience hang times, failed logins, or a total failure to boot into the network profile.

Why This Setting is Global (Not Location-Based)

A common question is why this setting cannot be customized for different locations (e.g., "Block" at the Airport, but "Allow" at the Office).

The Location Awareness module (trident.dll) resides within the same late-starting service as the rule engine. Because the computer does not yet know its location during the early boot phase, the firewall cannot apply location-specific rules. Consequently, this setting must be applied globally within the Symantec Endpoint Protection Manager (SEPM).

 

Best Practice: For systems joined to an enterprise domain, it is recommended to leave "Block all traffic until the firewall starts" unchecked to ensure critical boot-time authentication is not interrupted.

Additional Information

CRE-23584