Skip to main content

Secureframe Agent: Firewall Check

Written by Brady Price

Firewall

The Secureframe Agent firewall check verifies that a local firewall is enabled on employee devices. Results update after the agent syncs with Secureframe, typically within a few hours of changing your settings.

Use the steps below to enable and verify firewall settings on Windows, Mac, or Linux.

Windows

The Secureframe Agent checks that the Windows Defender Firewall is enabled for all network profiles.

  1. Open Windows Security and go to Firewall & network protection.

  2. Confirm the firewall is turned on for Domain network, Private network, and Public network.

  3. Verify from an elevated Command Prompt:

  • Run netsh advfirewall show allprofiles

  • Each profile (Domain, Private, Public) should show State ON

Note: After changing firewall settings, allow time for the Secureframe Agent to sync before re-checking the test result in Secureframe.

Mac

Ensure that Firewall is enabled (instructions here).

Linux

This check looks for Uncomplicated Firewall (UFW) installed and configured on Debian-based distributions. More information on Uncomplicated Firewall (UFW).

Frequently Asked Questions (FAQ)

How do I enable the Windows firewall to pass the Secureframe Agent check?

  • Open Windows Security → Firewall & network protection and turn the firewall on for Domain, Private, and Public networks.

  • Confirm all profiles are enabled by running netsh advfirewall show allprofiles in an elevated Command Prompt. Each profile should show State ON.

  • Wait for the Secureframe Agent to sync (typically within a few hours), then re-check the test in Secureframe.

Why does Secureframe Agent show my Windows firewall as off when Windows Security and netsh show it is on?

  • The Secureframe Agent reads firewall status from Windows Security Center telemetry. On some Windows devices, including Windows 10 Home, Windows Security Center can hold a stale state even when the firewall is actually enabled.

  • First confirm the firewall is truly on:

  • Check Windows Security → Firewall & network protection and confirm all three network types show the firewall is on.

  • Run netsh advfirewall show allprofiles in an elevated Command Prompt and confirm each profile shows State ON.

  • If both confirm the firewall is on but the Secureframe Agent check still fails, try refreshing Windows Security Center on a trusted network:

  • Open Command Prompt as Administrator.

  • Run netsh advfirewall set allprofiles state off.

  • Then run netsh advfirewall set allprofiles state on.

  • Reboot the device.

  • Wait for the Secureframe Agent to sync (typically within a few hours), then re-check the test in Secureframe.

  • If the check still fails after these steps, contact [email protected] with the device name and the output from netsh advfirewall show allprofiles.

Related Articles
Did this answer your question?