> ## Documentation Index > Fetch the complete documentation index at: https://docs.iru.com/llms.txt > Use this file to discover all available pages before exploring further. # Configure the Windows Firewall Library Item > Set up the Windows Firewall Library Item in Iru Endpoint. Configure firewall rules, enable or disable profiles, and enforce network protection settings. This Library Item is available for Windows devices The **Windows Firewall** Library Item lets you configure and enforce firewall settings for Windows devices. With this profile, you can manage global firewall behavior, define security association rules, and enforce profile-specific policies across public, private, and domain networks. By using this Library Item, you ensure that Windows endpoints in your organization adhere to consistent firewall configurations, reducing the risk of misconfigurations or unmanaged local rules. For detailed technical background on each firewall setting, refer to Microsoft's official [Windows Firewall documentation](https://learn.microsoft.com/en-us/windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security). ## Create a Windows Firewall Profile Library Item To add this Library Item to your Iru Endpoint Library, follow the steps outlined in the [Library Overview](/en/endpoint/library/library-items-profiles/library-overview) article. In the **Library**, select **Add Library Item**. Search for and select **Windows Firewall**. Give the Library Item a **Name**. Assign the profile to one or more **Blueprints**. You can use Assignment Maps within Blueprints for conditional logic if needed. ## Global Settings These options apply globally across all firewall profiles: * **Disable stateful FTP transfers** If enabled, disables stateful File Transfer Protocol (FTP) filtering. * **Enable packet queue** Configures scaling for encrypted and clear-text forwarding paths in IPsec tunnels. Ensures packet order is preserved. Default is off. * **IPSec Exemptions** Defines exemptions for IPsec traffic. * **Security association idle time** Sets the idle time (in seconds) before unused security associations are deleted. Default is `300`. ## Profile Settings Profile settings can be applied separately for **Public**, **Private**, and **Domain** network profiles. Toggle management for each profile at the top of the section. ### Core Firewall Settings * **Shielded** Blocks all inbound traffic, regardless of rules. Use with caution. * **Default inbound action** Specifies action (allow or block) for inbound traffic. * **Default outbound action** Specifies action (allow or block) for outbound traffic. ### Policy Management * **Allow local IPsec policy merge** Determines whether local connection security rules are enforced. * **Allow local policy merge** Determines whether local firewall rules are enforced. * **Merge user authorized global ports** Determines whether user-defined global port rules are enforced. * **Merge user authorized app firewall rules** Determines whether user-defined app firewall rules are enforced. ### Advanced Options * **Disable inbound notifications** Suppresses notifications when apps are blocked from listening. * **Disable stealth mode** If enabled, disables stealth (which drops unsolicited traffic). * **Disable unicast responses to multicast/broadcast** Blocks unicast responses to multicast or broadcast requests. ### Logging Configuration * **Log dropped packets** Records all dropped packets. * **Log ignored rules** Records when rules are ignored, depending on implementation. * **Log success connections** Records successful inbound connections. * **Log file path** Defines where firewall logs are written (e.g., `%programdata%\kandji\agent\logs`). * **Log max file size** Maximum size (in KB) for the log file. Default is `1024`. ## Network Profile Configuration The Domain profile applies when the device is connected to a domain network. This is typically the most permissive profile for corporate environments. **Recommended settings:** * Default inbound action: Block * Default outbound action: Allow * Allow local policy merge: Enabled * Logging: Enabled for monitoring The Private profile applies to trusted networks like home or office networks. **Recommended settings:** * Default inbound action: Block * Default outbound action: Allow * Allow local policy merge: Enabled * Logging: Enabled for security monitoring The Public profile applies to untrusted networks like public Wi-Fi. This should be the most restrictive profile. **Recommended settings:** * Default inbound action: Block * Default outbound action: Allow * Shielded: Consider enabling for maximum security * Logging: Enabled for security monitoring ## Considerations * Settings marked "Not configured" do not override the local device configuration. * When blocking all inbound traffic with Shielded, verify that required management and update services remain accessible. * Use logging options to validate firewall behavior before rolling out strict rules fleet-wide. ## Best Practices Test firewall configurations on a small group of devices before deploying to your entire fleet. Enable appropriate logging to monitor firewall behavior and troubleshoot issues. Document any required firewall exceptions for business applications and services. Regularly review firewall logs and policies to ensure they remain appropriate for your organization's needs. ## Troubleshooting **Possible causes:** * Firewall blocking required ports or applications * Incorrect profile settings * Missing firewall rules **Solutions:** * Check firewall logs for blocked connections * Verify the correct network profile is active * Add appropriate firewall rules for the application **Possible causes:** * Firewall blocking management ports * Shielded mode enabled * Incorrect profile configuration **Solutions:** * Ensure management ports are allowed * Disable Shielded mode if necessary * Verify domain profile settings for managed devices **Possible causes:** * Logging not enabled * Insufficient disk space * Incorrect log file path **Solutions:** * Enable appropriate logging options * Check available disk space * Verify log file path is accessible ## Security Recommendations Use different firewall profiles to implement network segmentation based on trust levels. Enable comprehensive logging to monitor network traffic and detect potential security issues. Regularly review and update firewall policies to address new threats and business requirements. Test firewall configurations in a controlled environment before production deployment.