Symantec Endpoint Protection (SEP) clients use two different technologies to protect computers from network attacks/exploit attempts: the Network Threat Protection firewall and the Client Intrusion Detection System (CIDS) engine. It may be necessary to disable each of these technologies when troubleshooting network related issues on computers protected by SEP.
Note: Disabling these features does not stop the associated drivers. It places them in a passthrough mode where network traffic is still passed through the drivers, but is not evaluated against any rules or definitions.
Disabling the NTP firewall
The NTP firewall can be set into passthrough mode either by disabling/withdrawing the client's Firewall policy, or by disabling the component in the local SEP client interface.
Note: Disabling/withdrawing the SEP client's firewall policy on clients in either client or mixed control mode will not disable the firewall as the client is already using a locally configured firewall policy instead of one configured in the SEPM. Make sure clients are in Server control mode
Disabling a client Firewall policy
Withdrawing a client Firewall policy
Manually disabling the NTP firewall on the client
Disabling CIDS by policy
The CIDS engine can be set into passthrough mode either by disabling the component in the client's Intrusion Prevention policy, or by disabling the component in the local SEP client interface.
Disabling CIDS by policy
Manually disabling CIDS on the client