Types of Firewall policies

You can use two types of Firewall policies in Trellix IPS — advanced and classic. Functionally, these two types are similar. However, as the names might suggest, advanced Firewall policies provide you more options to filter traffic when compared to classic.

Notes:

All Sensor models support classic Firewall policies.
Virtual IPS Sensors, NS-series Sensors, and M-series Sensors running on software version 8.1 and above support advanced Firewall policies.

Differences between advanced and classic Firewall policies
	Advanced	Classic
Supporting device	Virtual IPS Sensors NS-series Sensors M-series Sensors running on software version 7.0 or above	M-series Sensors running on software version lower than 7.0
Options on source or destination of the traffic	Source or destination are based on: Country A host's DNS name A host's IPv4 or IPv6 address An IPv4 or IPv6 address range to which a host belongs. IPv4 or IPv6 networks or a group of IPv4 or IPv6 networks. Windows Active Directory user names and user groups	Source or destination are based on: A host's IPV4 address IPv4 Network
Options on the traffic	Traffic is based on: A specific or a group of Layer 7 applications. For example, you can filter out Yahoo! Games while allowing Yahoo! Mail. These applications can be on the standard or custom communication ports. IP protocol or the TCP/UDP port numbers.	Traffic is only based on the IP protocol or the TCP/UDP port numbers.
Option to enforce the Firewall policy based on time.	Yes. For example, the Sensor can enforce a policy on all weekends only.	No.
Option to define a rule that mandates AD authentication	Yes.	No.