User guide

ManageEngine Firewall Analyzer :: User Guide
183
Zoho Corp.
Admin Settings
Managing Protocol Groups
A protocol group is a set of related protocols typically used for a common purpose. The
Protocol Groups link lets you define protocols as well as protocol groups, so that you
can identify traffic that is unique to your enterprise. Most of the common enterprise
protocols are already included in Firewall Analyzer under appropriate groups.
Some of the important protocol groups include the following:
Protocol Group Protocols Included Description
Web
HTTP, HTTPS,
Gopher
Includes protocols used to access IP traffic (the
Internet)
Mail POP, SMTP, IMAP
Includes protocols used to send or receive e-mail
traffic
FTP FTP, TFTP, FTPS
Includes protocols used to transfer files through
FTP
Telnet
telnet
Includes protocols used to access telnet services
Click the Protocol Groups link to view the list of protocol groups and the corresponding
protocols.
The View by Group box lets you view the list, one protocol group at a time.
The Unassigned protocol group contains all the protocols that are not assigned to any
group.
Some firewalls interpret protocols at Layer 4 (Application Layer), which means that
a combination of port and protocol is identified as an application, and written into
the log file. For example, tcp protocol on port 80 is identified as http traffic. Hence
http is shown in the Protocols column. Other firewalls interpret protocols at Layer 3
only, which means only the port and protocol values are written into the log file.
Hence, in the same example, tcp/80 is shown in the Protocols column.
Operations on Protocols
Click the
icon next to a protocol to delete it from the protocol group. Once a protocol
is deleted, all the database records related to that protocol will be deleted. Click the
icon to move a protocol from the current protocol group to another.
Click the Add Protocol link or the
icon next to it to add a new protocol, and assign it
to a protocol group. Remember to enter the protocol value exactly as it appears in the
log file. If you want to add it to a new protocol group, click the
icon next to the
Protocol Group text box to add a New Protocol Group, and enter the name of the new
protocol group and click Add. From the list of Available Protocol Identifiers, move
the required protocols to the Selected Protocol Identifiers to be included in this
protocol group. Please note that a protocol can belong to only one protocol group at a
time.