Understanding Trend Micro™ Network VirusWall™ Enforcer 2500
1
-
33
Policy Prioritization and Creation
Network VirusWall Enforcer 2500 allows you to create multiple policies directed at
different network segments and different types of endpoints and traffic. Network
VirusWall Enforcer 2500 follows a first-match rule—once the device matches a
policy to an endpoint it stops searching for additional policy matches to the endpoint
down the policy list.
First-match Rule
Keep policies with broad settings at the bottom of the policy list and policies with
specific settings higher in the list. Once an endpoint matches a policy, that is the only
policy that Network VirusWall Enforcer 2500 applies.
For example, consider the following three policies in the table:
, prioritizing policies with broad settings lower in the list prevents
situations where all endpoints match the policy with broad settings. Since Network
VirusWall Enforcer 2500 applies only one policy to an endpoint, once a policy
matches an endpoint, no further matches are made.
, using the same policies from above, if you rearrange the priorities and
place polices with broad settings higher in the priority list, lower priority policies
may never be applied to endpoints.
Priority
Endpoint
Destination
Scan Feature
1
RD, Marketing
Sales
Antivirus Program
Scan, System Threat
Scan, Vulnerability
Scan, Network Virus
Policy
2
RD, Marketing
*
Antivirus Program
Scan, Network Virus
Policy
3
*
*
Network Virus Policy
T
ABLE
1-5.
Example of correctly prioritized policies
