Effective Setting and Mixed-List Policies
The set of rules in the Windows Firewall is not ordered based on precedence. When multiple rules match a packet, the most restrictive of those rules take effect meaning that DENY rules take precedence over ALLOW rules. For more information, see the article on Microsoft TechNet.
Consider the mixed-list, both allow and deny, policy example from the Enforcement Agent section:
1. ALLOW 1.2.3.30 tcp port 80
2. ALLOW 1.2.3.40 udp port 53
3. BLOCK 1.2.3.0/24 ip
4. ALLOW 1.2.0.0/16 ip
5. Catch-all: DROP ingress, ALLOW egress
When a packet headed for the host 1.2.3.30 TCP port 80 reaches the firewall, it matches all the rules, but the most restrictive of them all, Rule number 3, is the one that will be enforced and the packet will be dropped. This behavior is contrary to the expectation that the rules will be evaluated in order, Rule 1 is the rule that is enforced, and that the packet will be allowed.
This difference in behavior is expected in the Windows platform owing to the design of the Windows Firewall described above. This behavior can be observed in mixed-list policies with overlapping rules that have different rule actions.
For example,
1. ALLOW 1.2.3.30 tcp
2. BLOCK 1.2.3.0/24 tcp
Interference from Other Firewalls or Policies
We recommend that you grant the agent full and exclusive control of the Windows Firewall to enforce the Secure Workload Network Policy as intended. Agents cannot reliably enforce the policy if:
-
A third-party firewall is present. (The Windows Firewall is required to be the active firewall product on the host.)
-
The Firewall is disabled for the current profiles.
-
Conflicting firewall settings are deployed using Group Policy. Some of the conflicting settings are:
-
Firewall rules.
-
Default inbound or outbound actions in the current profiles that differ from the catch-all rules of the policy.
-
Firewall disabled for the current profiles.
-