Can the ENS Firewall block or allow printing based on location?

[blewis]

We currently use the McAfee ENS Firewall, and I was asked to find out if it is possible to use the Firewall to allow printing when users are on our internal network, but block them from printing to home printers when they are working remotely.  

Thank you in advance for your help.

McAfee Endpoint Security 

[Dayananda · Accepted solution]

Hello,

Thank you for reaching out to the Mcafee community.

Yes, you can try to use the feature called "Location awareness group" and setup criteria and test it.

You should be knowing which ports and which protocol has been used to do the printing.

Refer to the below link for more ideas.

https://docs.mcafee.com/bundle/endpoint-security-10.6.0-firewall-client-product-guide-windows/page/G...

I hope this helps, let us know if you have any questions.

[blewis]

Thank you!

[ktankink · Accepted solution]

Just to add a bit to the conversation here:

• ENS Firewall does not have any specific functionality to allow/block printers based on location.
• Printers can be setup with various configurations and this is likely going to be a factor in deciding IF and HOW a firewall can be configured to allow/block printing:
  • Is this a network-mapped or network-shared printer off another system or print server?
  • Is this a local printer?
  • Is the local printer setup to print via network IP address (e.g., wireless)?
  • Is the local printer setup by non-network connection (USB or older connections)
• If printing over a network connection:
  • what process(es) does it use?  Svchost.exe, Windows SYSTEM process, or vendor-specific processes?
  • What network IP addresses and port numbers does it use?

These are just a few questions that I can think of, but you may be able to configure the Firewall to allow/block based on network-shared printers, but you'd need to get the fine details on how the system is connecting to the printer and see if firewall rules can be used to control that type of traffic.  ENS Firewall's Core Networking rules may be part of some of that "default allowed" network traffic that printing might use, such as the "Allow outbound system applications" or "Allow outbound stock applications" rules.; ref https://kc.mcafee.com/corporate/index?page=content&id=KB91206.