Sygate new release

[manythanks]

Just downloaded, shame they have not fixed the Proxy issue, if they had it would be a winner.

Thanks

[TAG97]

What's New for the Firewall?
This release of the Personal Firewall has a variety of new and enhanced features. Among them:

Provides "Deep Packet" Inspection—The Personal Firewall provides further enhanced intrusion detection and prevention capabilities, including alerts when another user attempts to compromise your system. The end result is a system that analyzes network packets and compares them with known attacks and known behavioral patterns of attack, and then intelligently blocks the malicious attacks.

Denial of Service (DoS) Protection—This enables the Personal Firewall to monitor and block incoming traffic with known Denial of Service (DoS) attack patterns. DoS attacks are characterized by an explicit attempt by an intruder to prevent legitimate users of a service from using that service by flooding a service with illegitimate traffic. This feature can be enabled or disabled.

Trojan Detection and Protection—Trojan protection is enhanced to identify, block, and terminate the process of more types of Trojan attacks.

Universal Plug and Play (UPnP) Protection—The Personal Firewall has a new option that protects computers from UPnP exploits. This feature can be enabled or disabled.

Log Dampener Feature—The Personal Firewall adds new logging flexibility and performance enhancement features, including the option to selectively enable or disable the security logs, system logs, traffic logs, and full packet logs.

Smart WINS—This feature allows Windows Internet Naming Service (WINS) requests only if they were requested. If the traffic was not requested, the WINS reply is blocked. The user can enable or disable this feature.

Active Response Protection—Active response is a feature that automatically blocks all communication from a source host once an attack has been detected. For example, if the Personal Firewall detects a DoS attack originating from a certain IP address, the Personal Firewall will automatically block any and all traffic from that IP for the duration specified in the seconds field. The user can now stop a current active response session.

Anti-Application Hijacking Protection—The Personal Firewall now protects against even more attacks, including such exploits such as "TooLeaky" and the Shatter Attack.

Enhanced performance—The Personal Firewall is now faster and takes fewer system resources.

Improved Logging Capabilities—The Personal Firewall adds new logging flexibility, including the option to disable all logs.

Support for Windows Server 2003—The Personal Firewall is now supported on Windows Server 2003 for Small to Medium Businesses. For server deployments greater than 500 seats and that need centralized management, Sygate Secure Enterprise is required.

Improved Microsoft System Installer Support—The Personal Firewall is now packaged by default as a Microsoft System Installer (MSI) package to simplify deployment with Microsoft SMS and other software distribution tools.

[Comp01]

Hmm, where do I go about getting this version of sygate? Do I run the Updte feature? or do I download a whole new installer?

[TAG97]

-{ Quote: " quoting: Comp01 link=board=23;threadid=15579;start=0#msg96980 date=1067449169]
Hmm, where do I go about getting this version of sygate? Do I run the Updte feature? or do I download a whole new installer?
" }-
Comp01 I got mine through options>update>check now
Regards Tim

[notageek]

They still haven't fixed the loopbck problem.

[manythanks]

OH! Iget it, maybe Sygate are using "anti application hijacking" instead of fixing the proxy issue, so instead of an application being stopped by the firewall as it tries to leave the computer - it is actually stopped as it tries to alter itself to mimic or install itself into the application.

Thanks

[notageek]

It could be true. Maybe I'll test drive it with Proxo and see if it works. :)

[manythanks]

How would you know if it works, you wont know until an application alters, I tried it with Command AV and it went right through without any action from SPF.

Thanks

[notageek]

Well if you tried the new sygate like that than it's not really fixed but you could use SSM just be on the safe side. Maybe I'll still try it. :)

[Chuck57]

I think Sygate has jumped ahead of the field with the current additions. What I especially like is that they're one of the few on the market that will fully stealth your system by blocking browser and OS info from being seen. Besides being fully stealthed in all other areas, that just about covers it all. Only your ISP info is revealed and, in my case, all that shows concerning my browser is Mozilla 4. I might keep this version on my system along with my LnS and switch back and forth periodically, since I can't seem to stick with any one version very long. I like playing with new software too much.

[notageek]

Hi Chuck Are you talking about the pro or free?

[manythanks]

Sorry, the free

[notageek]

OK. What does the new free version offer?

[manythanks]

Anti Application Hijacking.

[notageek]

Oh Ok.

[manythanks]

That's it, if the user sets the Proxo to ask, then every time an application tries to access the internet the user is allowed.

Thanks

[notageek]

It's been like that. :) I don't think they will fix it either.

[manythanks]

That's it, back to ZAF if it's not being fixed.

Thanks

[notageek]

LOL That's where I'm at now. ZAF switching to ZAP after my vaction. :)

[manythanks]

That's a real shame because the firewall has great potential and if this issue get's fixed it will be better than ZA.

Thanks

[notageek]

It's a good firewall and I'm sure if you use it and SSM you could get by. I'll email Sygate and ask them if they plan on fixing the problem. I'll post the response they send me (if they send one) here.

[manythanks]

That would be great.

Thanks ;)

[mvdu]

I'm evaluating it right now. There's a big improvement on leak tests. But, does it still give server rights automatically if server rights is checked and no ports are entered in? I miss ZA's privacy features, and ZA + BI is hard to beat IMO, but I will give Sygate a chance.

[Eliot]

I gave it a shot. Sygate blocked access for Perfect Disc even though both IP's and the broadcast IP were set to allow all in an advanced rule. LAN options worked fine and it blocked traffic from a trusted address for Perfect Disc access. I am sticking with Kerio as that is simply absurd! >:(

[mvdu]

Sygate's also blocking my Weatherbug for some reason..

[notageek]

If you're using the pro version you can email tech support about the problem. If you're using the free version you can ask them how to fix the problem in the sygate forum. I don't have the sygate forum link but I'm sure someone here might.

[CrazyM]

-{ Quote: " quoting: notageek link=board=23;threadid=15579;start=15#msg97123 date=1067489770]I don't have the sygate forum link but I'm sure someone here might." }-

http://forums.sygatetech.com/vb/

Regards,

CrazyM

[minacross]

-{ Quote: " quoting: TAG97 link=board=23;threadid=15579;start=0#msg96976 date=1067448510]
What's New for the Firewall?
This release of the Personal Firewall has a variety of new and enhanced features...
" }-

TAG97,
from where did you get these info ?
I can not find it on Sygate's website ::)

[SpaceCowboy]

-{ Quote: " quoting: mvdu link=board=23;threadid=15579;start=15#msg97087 date=1067475058]
But, does it still give server rights automatically if server rights is checked and no ports are entered in?" }-
YES it does. you have to uncheck the box to take away server rights.

[TAG97]

-{ Quote: " quoting: minacross link=board=23;threadid=15579;start=15#msg97191 date=1067519703]
...
" }-

TAG97,
from where did you get these info ?
I can not find it on Sygate's website ::)
-{ Quote: "" }-
minacross, in the Online Help for Sygate Personal Firewall PRO.

[TAG97]

Here's a little bit more

Does the Firewall protect against viruses and Trojans?
The Personal Firewall does not check for viruses, but it works well with virus-scanning software. Programs that access the network are checked for Trojans. If one is found, the network access is blocked to that Trojan program, and the program is automatically terminated. The Personal Firewall specifies the location of the Trojans, but does not delete them from your computer.

After updating one of my applications, the Firewall shows a major attack. Do I have a Trojan?
Upgrading any program will change the MD5 checksum, a value that the Personal Firewall uses to verify the integrity of each application on your computer. When the Personal Firewall sees that the executable for an application has been changed, it logs this in the Security Log with a severity of Major. If you have updated the software yourself, then there is probably no Trojan attached to it. However, if you have not updated the software and you receive this message, you should block the application and install a virus scanner using the latest signatures to remove this Trojan.

Does the Firewall do Stateful Packet Inspection?
Yes, the Personal Firewall does Stateful Packet Inspection on every Remote TCP connection. The Personal Firewall also uses an algorithm to check Remote UDP and DHCP traffic to make sure that the communication is secure

[mvdu]

So how much of a security threat is the automatic allowing of server rights? This is one of the things holding me back from purchasing it.

[mvdu]

Another question: when Sygate would block an ICMP ping or connection attempt, it would show this:

blocked - severity: 15
allowed - severity: 3

What was it allowing?

[TAG97]

-{ Quote: " quoting: mvdu link=board=23;threadid=15579;start=30#msg97349 date=1067569617]
So how much of a security threat is the automatic allowing of server rights? This is one of the things holding me back from purchasing it.
" }-

Hi mvdu
This is easily solve by highlighting each application>clicking advance>unchecking 'act as server'
It took me five minutes to do 25 applications.
Regards
Tim

[TAG97]

-{ Quote: " quoting: mvdu link=board=23;threadid=15579;start=30#msg97352 date=1067570296]
Another question: when Sygate would block an ICMP ping or connection attempt, it would show this:

blocked - severity: 15
allowed - severity: 3

What was it allowing?
" }-
It should be in your Traffic log to the right of "severity: 3" ???
Regards
Tim

[mvdu]

I have Sygate off right now - that was an approximation of the appearance. I am wondering why it had both those entries for things it blocked.