Win 7 Firewall Profile Issue 64bit Professional (standalone laptop)

CeJay · 10 Oct 2011

Hi All

I have some laptops here, which are setup as standalone machines running windows 7 Professional 64bit.

Now they have two nics for wireshark testing. I have setting them up running a Local GPO customised set of Group policy.

The issue I am running across is that I can disable one NIC under the domain profile in (Windows firewall with Advanced Security on Local Computer under control panel) if I set Windows Firewall: Protect all network connections to not configured. This is under Windows firewall\Domain

However I cannot do the same for Public or private profile.

Has anyone run across this issue before. Basically I just need to be able to disable the firewall on one nic. And so far I have been unable to do so.

Any help would be appreciated.

edit: can I get around this issue by using a third party firewall and disabling windows firewall?

CeJay · 10 Oct 2011

I take it I cant get around this by using netsh or advfirewall? I know netsh is supposed to be deprecated, but I get no message coming up warning me of that and when I type in advfirewall in the command prompt it doesn't recognise it. I have launched the cmd prompt as an admin, to no avail.

Currently reading the technet article on this but any help would be appreciated.

**cluberti** · 10 Oct 2011

I'm pretty sure that you can't do that outside the domain profile, but I'd have to build a lab machine to be sure (on the road, so not available atm). However, the question I have is why? Perhaps there's a way around to getting to what you are trying to achieve without messing with the NICs themselves?

CeJay · 11 Oct 2011

We're having issues with some wireshark traces and traffic no showing on the trace and think the issue may be firewall related. So wanted to be able to disable the firewall on one of the nics and test.

thanks for the reply

**cluberti** · 11 Oct 2011

Ah - OK, so I understand. Generally, wireshark uses WinPCap on Windows, which is a protocol driver. It's actually inserted first in the NDIS stack, meaning it will see traffic destined anywhere on the system, even the windows filtering drivers (where the firewall gets a crack at packets). If you aren't seeing anything with WinPCap installed, the problem is not the firewall, it's more likely a driver issue (as that's where the WinPCap driver sits in relation to everything else - sounds like WinPCap is either not getting informed of the packet coming in, or it's not doing what it's supposed to with it when it does). Does netmon 3.4 see data in this same situation? Netmon sits *above* the filtering engine, so if it sees it, you can be absolutely certain it's not a firewall issue.

CeJay · 11 Oct 2011

Turned out to be user error. But thanks for the quick response