1、The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft
2、 cannot guarantee the accuracy of any information presented after the date of publication.This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO THE INFORMATION IN THIS DOCUMENT.Complying with all applicable copyright laws is the responsibility of
3、the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means （electronic, mechanical, photocopying, recording, or otherwise）, or for any purpose, without the express writ
4、ten permission of Microsoft Corporation. Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this docum
5、ent does not give you any license to these patents, trademarks, copyrights, or other intellectual property.The example companies, organizations, products, people and events depicted herein are fictitious. No association with any real company, organization, product, person or event is intended or sho
6、uld be inferred. 2004 Microsoft Corporation. All rights reserved.Microsoft, Windows, Windows NT, and Active Directory are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.The names of actual companies and products mentioned herein may be
7、 the trademarks of their respective owners.ContentsOverview 1New Features of Windows Firewall 1Enabled by Default for All of the Connections of the Computer 1New Global Configuration Options that Apply to All Connections 2New Windows Firewall Component of Control Panel 2New Operating Mode 3Startup S
8、ecurity 3Incoming Traffic Scoping 3Excepted Traffic Can Be Specified by Program Filename 3Built-in Support for IPv6 4New Configuration Options 4Configuration Using Group Policy Settings 5Windows XP SP2 and the Impact to Enterprise Networks 5Allowing Users to Install Windows XP SP2 from Windows Updat
9、e 7Using Windows XP SP2 Windows Firewall and IPSec 7Deploying Windows Firewall Settings With Group Policy 9Step 1: Updating Your Group Policy Objects With the New Windows Firewall Settings 9Step 2: Specifying Windows Firewall Settings for Your Group Policy Objects 11Recommended Settings for Windows
10、Firewall Group Policy Settings 13Group Policy Settings in Mixed Windows XP Environments 13Deploying Windows Firewall Settings Without Group Policy 15Appendix A: Windows Firewall Group Policy Settings 17Windows Firewall: Allow Authenticated IPSec Bypass 17 Protect All Network Connections 19 Do Not Al
11、low Exceptions 20 Define Program Exceptions 21 Allow Local Program Exceptions 23 Allow Remote Administration Exception 24 Allow File and Print Sharing Exception 25 Allow ICMP Exceptions 27 Allow Remote Desktop Exception 28 Allow UPnP Framework Exception 29 Prohibit Notifications 30 Allow Logging 31
12、Prohibit Unicast Response to Multicast or Broadcast Requests 32 Define Port Exceptions 33 Allow Local Port Exceptions 35Appendix B: Netsh Command Syntax for the Netsh Firewall Context 37add allowedprogram 37set allowedprogram 38delete allowedprogram 39set icmpsetting 39set multicastbroadcastresponse
13、 40set notifications 41set logging 41set opmode 42add portopening 42set portopening 43delete portopening 44set service 45show commands 46reset 46Appendix C: Deploying Windows Firewall Settings in a Windows NT 4.0 Domain 47Appendix D: Allowing Remote Assistance Support 48Enabling Solicited Remote Ass
14、istance 48Enabling Offer-based Remote Assistance 48Appendix E: Example of Using the Unattend.txt File 49Appendix F: Example of Using the Netfw.inf File 51Appendix G: Port Numbers for Microsoft Applications and Services 52Summary 53Related Links 54OverviewWindows XP Service Pack 2 （SP2） includes the
15、Windows Firewall, a replacement for the feature previously known as the Internet Connection Firewall （ICF）. Windows Firewall is a stateful host firewall that drops all unsolicited incoming traffic that does not correspond to either traffic sent in response to a request of the computer （solicited tra
16、ffic） or unsolicited traffic that has been specified as allowed （excepted traffic）. This behavior of Windows Firewall provides a level of protection from malicious users and programs that use unsolicited incoming traffic to attack computers. With the exception of some Internet Control Message Protoc
17、ol （ICMP） messages, Windows Firewall does not drop outgoing traffic.New Features of Windows FirewallIn Windows XP SP2, there are many new features for the Windows Firewall, including the following:Enabled by default for all of the connections of the computerNew global configuration options that appl
18、y to all connectionsNew Windows Firewall component of Control PanelNew operating modeStartup securityIncoming traffic scoping for IPv4Excepted traffic can be specified by program filenameBuilt-in support for IPv6New configuration optionsConfiguration using group policy settingsEnabled by Default for
19、 All of the Connections of the ComputerIn Windows XP with Service Pack 1 （SP1） and Windows XP with no service packs installed, ICF is disabled by default for all connections, unless enabled for an Internet connection by the Network Setup Wizard or Internet Connection Wizard. You can manually enable
20、ICF through a single checkbox on the Advanced tab of the properties of a connection, from which you can also configure the set of excepted traffic by specifying Transmission Control Protocol （TCP） or User Datagram Protocol （UDP） ports.Windows Firewall in Windows XP SP2 is globally enabled by default
21、. This means that, by default, all the connections of a computer running Windows XP with SP2 have Windows Firewall enabled, including LAN （wired and wireless）, dial-up, and virtual private network （VPN） connections. New connections also have Windows Firewall enabled by default.Although this provides
22、 more protection for Windows XP-based computers, this default behavior can have consequences for the information technology （IT） department of an organization network with regards to application compatibility and the ability to manage the computers on the network. For more information, see Windows X
23、P SP2 and the Impact to Enterprise Networks in this article. New Global Configuration Options that Apply to All ConnectionsWindows Firewall in Windows XP SP2 allows you to configure settings that apply to all the connections of the computer （global configuration）. In Windows XP with SP1 and Windows
24、XP with no service packs installed, ICF settings are configured per connection, which means that if you want to enable ICF on multiple connections and configure excepted traffic, you must configure each connection separately. When you change a global Windows Firewall setting, the change is applied t
25、o all the connections on which Windows Firewall is enabled.Windows Firewall in Windows XP SP2 also allows per-connection configuration. Connection-specific configuration overrides global configuration.New Windows Firewall Component of Control PanelThe settings for ICF in Windows XP with SP1 and Wind
26、ows XP with no service packs installed consist of the Protect my computer and network by limiting or preventing access to this computer from the Internet check box on the Advanced tab of the properties of a connection, and a Settings button from which you can configure excepted traffic, logging sett
27、ings, and excepted ICMP traffic.In Windows XP SP2, the check box on the Advanced tab of the properties of a connection has been replaced with a Settings button, which launches the new Windows Firewall component in Control Panel, from which you can configure general settings, exceptions for programs
28、（applications and services）, connection-specific settings, log settings, and excepted ICMP traffic. The following figure shows the new Windows Firewall dialog box.You can also configure Windows Firewall from the new Security Center.For a detailed description of the settings and options of the new Windows Firewall component in Control Panel, see Manually Configuring Windows Firewall in Windows XP
