device management The following policies can be applied to Knox container of Samsung devices. [Android OS, Samsung Only(Knox2+)]

Transcription

1 Knox container device management policy The following policies can be applied to Knox container of Samsung devices. System group Screen capture Clipboard Share list Google account synchronization App crash report to Google System app shutdown Set whether to allow screen capture in the Knox Container. Allow is the default value. Allow: Allow screen capture. Disallow all: Disallow screen capture. Set whether to allow clipboard in the Knox Container: Allow: Allow screen capture. Disallow force on: Disallow screen capture. Allow within the same application: Able to use the clipboard only within the same application. [Android OS, Samsung Only(SAFE4+)] Set whether to allow using share app features in the Knox Container: Allow: Allow using share list. Disallow all: Disallow using share list. Set whether to allow Google account synchronization in the Knox Container: Allow: Allow Google account synchronization. Disallow: Disallow Google account synchronization. [Android OS, Samsung Only(SAFE3+)] Set whether to report error information to Google upon application error occurrence in the Knox Container: Allow: Device users could report the error incident to Google when an application error occurs. Disallow: Device users could not report the error incident to Google when an application error occurs. [Android OS, Samsung Only(SAFE4+)] Set whether to allow users to close the system application by force in the Knox Container: Allow: Device users could quit the system application. Disallow: Device users could not quit the system application. Trusted Boot Verification [Android OS, Samsung Only(Knox2+)] Set whether to allow Trusted Boot: Allow: Allow using Trusted Boot. Disallow all: Disallow using Trusted Boot. Third Party Keyboard [Android OS, Samsung Only(Knox2+)] Set whether to allow use of third Party Keyboards: Allow: Allow using third Party Keyboards. Disallow all: Disallow using third Party Keyboards. 304

2 Domain whitelist setting Set domain whitelist used as account addresses in the Knox Container: Domain whitelist setting Domain Whitelist [Android OS, Samsung Only(SAFE4+)] Set domain whitelist used as account addresses in the Knox Container: Add: Enter a domain and click. Delete: Select an domain in the list and click X. Knox Interface group Add a new Wi-Fi network Microphone Recording Camera Set whether to allow adding a new Wi-Fi in Knox Container: Allow: Allow to add a new Wi-Fi. Disallow: Disallow add a new Wi-Fi. Set whether to allow the use of the microphone in the Knox container. Allow: Allow the microphone. Disallow: Disallow the microphone. [Android OS, Samsung Only(SAFE4+)] Set whether to allow using microphone recording in Knox Container: Allow: Allow to use. Disallow: Disallow to use. Set whether to allow use of camera. [Deny recording only] This policy allows taking pictures but denies video recording (this feature is limited to Samsung devices): Allow: Able to use the camera. Disallow all: Unable to use the camera. Disallow recording only: Allow to take pictures and save images, but does not allow video recording. It is only available for Samsung Devices. Allow USB access [Android OS, Samsung Only(Knox 2.5+)] Set whether to allow the connection of USB hardware, such as OTG printers and scanners, in Knox container. The setting is only allowed for non-storage USB hardware that is in USB accessory mode. Devices from Verizon, the US telecommunications provider, are not supported. It is disabled by default until set otherwise. Allow: Allow access of USB. Disallow: Do not allow the use of the USB Accessory Mode. 305

3 Allow access of USB devices Bluetooth Low Energy NFC control [Android OS, Samsung Only(SAFE5.1+)] Set the USB product that can be used by a specific app in a Knox container: 1. Input the package name of the app. 2. Select a USB vendor ID. 3. Input the product ID. Only the 4-digit hexadecimal character can be entered. Use a comma (,) separator when entering multiple items. - If ABCD (vendor ID)+1234 (product ID) is entered, only the product "1234" of the vendor "ABCD" will be allowed. - If ABCD (vendor ID)+1234,0909 (product ID) is entered, only the product "1234" and "0909" of the vendor "ABCD" will be allowed. 4. Click to add, or click X to delete. [Android OS, Samsung Only(Knox2.4+)] Set whether to allow the use of the Bluetooth Low Energy feature in the Knox container. This setting is only possible when the Bluetooth connection is allowed in the general area: Allow: Allow use of the Low Energy feature Disallow: Disallow use of the Low Energy feature [Android OS, Samsung(SAFE5.4+)] Set whether to allow users to control NFC: Allow: Allow to use NFC control. Disallow: Disallow to use NFC control. 306

4 Knox Browser group Android browser Cookies JavaScript Autofill Pop-up block Browser proxy URL Set whether to allow using the Android browser in the Knox Container: Allow: Allow to use. Disallow: Disallow to use. Set whether to allow cookies in the Android browser of the Knox Container: Allow: Allow to accept cookies and to use the cookie menu. Disallow: Disallow to accept cookies and to use the cookie menu. Set whether to allow Javascript in the Android browser of the Knox Container: Allow: Allow to run Javascript and to use the Javascript menu. Disallow: Disallow to run Javascript and to use the Javascript menu. Set whether to allow using Autofill in the Android browser of the Knox Container: Allow: Allow to use Autofill and Autofill menu. Disallow: Disallow to save data for Autofill and to use the Autofill menu. Set whether to allow using Pop-up block in the Knox Container: Allow: Allow users to select whether to block Pop-up. Disallow: Disallow pup-up block and the Pop-up Block menu. [Android OS, Samsung Only(Knox4.0.1+)] Set the proxy setting address in the Knox Container. Enter the IP address or "Domain name:port" for the setting. Note: It does not apply at the same time as the firewall policy setting. Applicable browsers are Chrome and Samsung Basic S browse and supported version for Chrome is Knox Standard SDK 4.0.1~5.6. Note: If browser settings change, users close all browsers and run it again to apply the changed settings. 307

5 Knox Container Data group Moving an application to container Moving a file to Knox area Moving a file to General area Calendar sync setting Calendar data sync Contacts sync setting Contacts data sync Enable DLP DLP activation DLP LOCK [Android OS, Samsung Only(Knox2+)] Set whether to allow moving an application of the personal area to the Knox Container: Allow: Allow moving an application. Disallow: Disallow moving an application. [Android OS, Samsung Only(Knox2+)] Set whether to allow moving a file of General area to the Knox Container. The default is to allow moving files of the personal area to the Knox Container: Allow: Allow moving a file to Knox. Disallow: Disallow moving a file to Knox. [Android OS, Samsung Only(Knox2+)] Set whether to allow moving a file of the Knox Container to General area: Allow: Allow moving a file to Owner. Disallow: Disallow moving a file to Owner. Set whether to allow calendar data sync between the personal area and the Knox Container: Calendar data sync setting: Allow calendar data sync. [Android OS, Samsung Only(Knox2+)] Set how to sync calendar data between the personal area and the Knox Container: Allow Import: Allow to import the calendar data of the personal area to the Knox Container. Allow Export: Allow to export the calendar data of the Knox Container to the personal area. Set whether to allow contacts data sync between the personal area and the Knox Container: Contacts data sync setting: Allow contacts data sync. [Android OS, Samsung Only(Knox2+)] Set whether to allow activating Data Loss Protection (DLP): Set DLP activation whitelist: Grant view and download permissions for each file and application. [Android OS, Samsung Only(Knox2.6+)] Set whether to allow activating Data Loss Protection (DLP): Set DLP activation whitelist: Grant view and download permissions for each file and application. [Android OS, Samsung Only(Knox2.6+)] Set whether to allow DLP activation: Activate: Activate DLP activation. Deactivate: Deactivate DLP activation. [Android OS, Samsung Only(Knox2.6+)] Set whether to allow the downloading of DLP files: Lock: Disallow downloading and viewing of DLP files. Unlock: Disallow downloading and viewing of DLP files. 308

6 DLP validity(minutes) DLP creator app whitelist DLP consumer app whitelist [Android OS, Samsung Only(Knox2.6+)] Specify an app that can download the file from the Knox container using its package name: Value range: minutes [Android OS, Samsung Only(Knox2.6+)] A policy that set the app to view the attachments downloaded from the DLP enabled app in the Knox container, by specifying the package name: Add: Click, and select an app from the App list. Delete: Select the app you want to delete from the list, and click X. [Android OS, Samsung Only(Knox2.6+)] A policy which selects the app that allows you to view the DLP files that you downloaded from the DLP creator s app in the Knox container. The app is specified by the package name: Add: Click, and select an app from the App list. Delete: Select the app you want to delete from the list, and click X. 309

7 Knox Application group Application black/whitelist settings Set whether to use Application blacklist settings or Application whitelist settings in Knox Container: Application blacklist settings: Blacklist is the list of applications which should not be installed or run on the Knox Container. Application whitelist settings: Whitelist is the list of applications that could be installed or run on the Knox Container. Setting application black/whitelist: You can apply both blacklist and whitelist policy at the same time. Note: When you set to Application blacklist settings or Application whitelist settings and you add no apps, all apps except for the Knox Manage Agent and Client will be prohibited for the execution and installation. Application installation blacklist Application running blacklist Application running prohibited list [Android OS, Samsung Only(SAFE2.1+)] It manages the list of applications that should not be installed on the Knox Container. Applications on the blacklist, that are installed already, will be removed. If you add a control application registered with a wildcard (*) to the package name to the app install blacklist policy, the specific packages registered will not be installed. eg) com.*.emm / com.sds.* / com.*.emm.* An application that has already been added on the Application Whitelist cannot be added on the Application Blacklist: Add: Click and select apps in the Application List. Add entire applications: Click to add * to the list and all apps are added to the installation blacklist. Delete: Select an item you want delete and then click X. It manages the list of application banned from running on the Knox Container. Once application is placed on the blacklist, either its icon disappears from the device or the program would not run if you try to run it. As the app is not deleted, the app will be displayed again when the policy is changed. An application that has already been added on the Application Whitelist cannot be added on the Application Blacklist: Add: Click and select apps in the Application List. Delete: Select an item you want delete and then click X. [Android OS, Samsung(SAFE5+)] The policy to block an app from running in the Knox container. When enabled, users cannot run selected applications: Add: Click, and select an app from the App list. Delete: Select the app you want to delete from the list, and click X. 310

8 Application installation whitelist Application removal blacklist App installation authority whitelist settings Application installation whitelist GMS application TIMA CCM profile whitelist TIMA CCM profile application whitelist It allows to install only applications are placed on the whitelist to the Knox Container. Knox Manage Agent /Client are on the whitelist automatically. Applications that are not on the whitelist, and are installed already, will be removed. If you add a control application registered with a wildcard (*) to the package name to the app install whitelist policy, the specific packages registered will be allowed to install. eg) com.*.emm / com.sds.* / com.*.emm.* An application that has already been added on the Application Blacklist cannot be added on the Application Whitelist: Add: Click and select apps in the Application List. Add entire applications: Click to add * to the list and all apps are added to the installation whitelist. Delete: Select an item you want delete and then click X. It manages the list of applications that should not be removed on the Knox Container. An application that has already been added on the Application Blacklist cannot be added on the Application removal blacklist: Add: Click and select apps in the Application List. Delete: Select an item you want delete and then click X. Set whether to allow the application that has installation permission to install an app in the Knox container: Application installation whitelist setting: Allow the application to install an app. [Android OS, Samsung Only(SAFE2.1+)] Set the list of the application that can install an app in the Knox Container. Applications selected will be added to the View list with package name of the application: Add: Click and select apps in the Application List. Delete: Select an item you want delete and then click X. Set whether to allow to install Google mobile service (GMS) apps: Allow: Allow to install GMS apps. Disallow: Disallow install GMS apps. [Android OS, Samsung Only(Knox2.1+)] Set whether to allow apps to access TIMA Client Certificate Manager(CCM) area: Entire Application: All the application in the Knox container can access TIMA CCM. Whitelist Application: Only the applications added on the whitelist can access TIMA CCM. [Android OS, Samsung Only(Knox2.1+)] Set the application to apply TIMA Client Certificate Management (CCM) permission inside Knox container: Add: Click and select apps in the Application List. Delete: Select an item you want delete and then click X. 311

9 TIMA CCM Profile application access restrictions exception list setting TIMA CCM Profile application access restrictions exception list Settings for whitelisting apps allowing external SD card Whitelisted apps for external SD card Battery optimization exception apps setting Battery optimization exception apps Setting installing apps of the general area to the Knox area Set whether to allow apps to access TIMA CMM profile even when the Knox container is locked. TIMA CCM Profile application access restrictions exception list setting: Only the set applications can access TIMA CCM when the Knox container is locked. [Android OS, Samsung Only(Knox2.1+)] Set the application to access TIMA CMM profile even when the Knox container is locked. When you select Whitelist Application in the TIMA CCM profile whitelist policy, only whitelisted applications can access TIMA CCM. (However, if the TIMA CMM profile whitelist setting is set to Default(No Value) or Entire application, then the restrictions of the applied app are excluded.) Add: Click and select apps in the Application List. Delete: Select an item you want delete and then click X. External SD card is not allowed to used inside Knox container, but administrator can set whether to allow use of an external SD card with the policy: Settings: Set the app whitelist. [Android OS, Samsung Only(Knox2.2+)] Set the app whitelist to use an external SD card: Add: Click and select apps in the Application List. Delete: Select an app and click X. This is a policy to set applications not to do battery optimization functions. If an application is set to this policy, this application can cause battery loss. So set this when you are sure to need. This is for Android N (Nougat) later. The Knox Manage are not the battery optimization target. Battery optimization exception apps setting: You can set an application to be excluded from limited CPU and network targets to optimize battery usage. [Android OS, Samsung Only(SAFE5.7+)] Doze mode, App Standby mode, and power saving mode is used to lengthen a battery cycle on Knox Manage. Set applications not to do these modes. Add: Click and select an application in Application List window. Delete: Select an application from the selected applications and click X. This policy allows you to install apps that are installed in the general area to the Knox area. Setting installing apps of the general area to the Knox area: Register app within the general area and install it in the Knox area. 312

10 Knox area setup app App Data deletion control setting App Data deletion protection list App Data deletion protection exception list Show ProgressBar when installing apps [Samsung Only(SAFE5.1+)] Select app within the general area to install to the Knox Container area. A list of apps registered for Android platform in Applications > Control Applications is displayed. Add: Click and select an item in App List window Delete: Select the app you want to remove from the list and click X. Set whether to allow users to delete internal app data in Knox container. App Data deletion protection list: To protect app data, set the apps which data cannot be deleted. [Samsung Only(SAFE5.1+)] You cannot delete the internal app data on designated apps. The internal data delete button is disabled so a user cannot arbitrarily delete the app data. You can add the registered app, with a wildcard character (*) in the package name, to the app data deletion protection list. Then the app data for a specific registered package cannot be deleted. E.g.) com.*.knox Manage / com.sds.* / com.*.knox Manage.* Add: Click and select the app from the App List window. Add entire applications: Click to add * to the list and all apps are added to the app data deletion protection list. Delete: Select an app to delete from the list and click X. [Samsung Only(SAFE5.1+)] You can delete the internal app data for designated apps. A user can click Delete button to delete the internal app data. Add: Click and select the app from the App List window. Add entire applications: Click to add * to the list and all apps are added to the app data deletion protection exception list Delete: Select an app to delete from the list and click X. [Android 1.0(SDK1.5)+] When a user downloads an app from the App store in Knox Manage, the progress of the download is displayed. Use: The progress of the app download is displayed on the user s device. Do not use: The progress of the app download is not displayed on the user s device. 313

11 Knox Security group Password policies Set whether to use password to lock Knox containers. Note: The use of the camera is prohibited in a screen lock state. Enterprise Identity Authentication Domain Address Setup file Enable FIDO Request URL Response URL FIDO App Installed List [Android OS, Samsung Only(SAFE5.4+)] The Unlock Knox Container function is controlled by a company ID. Use: Allow to use an enterprise identity. Forced use: Device users should login with an enterprise identity. [Android OS, Samsung Only(SAFE5.4+)] Enter the domain address of the enterprise identity sever. Omit the http(s) prefix to the Domain Address. [Android OS, Samsung Only(SAFE5.4+)] Select a file to install inside Knox for corporate ID connection. Use Samsung SSO Authenticator (com.sec. android.service.singlesignon) or similar application. To select an application form the application list, the application must be enrolled either on Application > Internal application or Application > Public application. Add: Click and select apps in the Application List. Delete: Select an app and click X. [Android OS, Samsung Only(Knox2.7+)] If you are using a company ID interworking, it specifies whether to use My FIDO interworking function in the Knox container. Use: When you log in to the Knox container, you are allowed to use the FIDO with your company ID. [Android OS, Samsung Only(Knox2.7+)] Set the URL to request for FIDO interworking. [Android OS, Samsung Only(Knox2.7+)] Set the URL to respond to FIDO interworking [Android OS, Samsung Only(Knox2.7+)] For FIDO interworking, it specifies a FIDO application that you want to install in the Knox area is specified from among the ones in the general area. The essential app required for FIDO authentication is automatically added to the list, and it can also register additional apps for installation. Add: Click, and from the App list window, select an app to add. Delete: Select an app to delete from the list, and click X. 314

12 Minimum strength Maximum failed attempts Action for failing allowed count to retry password Expires after (days) Manage password history (times) Minimum length Set the minimum strength of password used on the screen: Pattern: Set a pattern or a password with a higher complexity such as Pattern, 4 Digit Pin, Must be alphanumeric, and Must include special characters. 4 Digit Pin: 4 digit number is available. The screen can be locked using 4 Digit Pin, Must be alphanumeric, and Including special character. Must be alphanumeric: Both letters and numbers must be included. The screen can be locked using Must be alphanumeric, and Including special character. Must include special characters: Special characters must be included. Set Maximum failed attempts. If the maximum failed attempts is reached, control actions will be performed: Value range: 0-10 times Specify control actions to be performed when a set number of failed attempts is reached. If it is for the Samsung group, only the Knox container locking is available. If not set, the Knox container is deleted. Transfer a container control command to unlock the container. Lock Knox Container: When a set number of password attempts is reached, lock the Knox Container. Wipe Knox Container: When a set number of password attempts is reached, delete the Knox Container Set Password validity period. If set period is exceeded, the password is reset: Value range: days Set the minimum number of new passwords that must be used before a user can reuse the previous password.: Value range: 0-10 times Set the minimum length of the password. If the Minimum strength is the Pattern, one more character is required. In the case of the Must include special characters, it must be equal or greater than the sum of the Minimum number of letters and the Minimum number of non-letters. If the Minimum strength is Number: - Value range: 4-16 words Including english and number: - Value range: 4-16 words Including special character: - Value range: 5-16 words 315

13 Note: Minimum length of the pattern password means the number of lines connecting each dots. For example, if the policy value is 4, more than 4 lines which connect 5 dots must be entered to satisfy the policy. Minimum number of letters Minimum number of lowercase letters Minimum number of capital letters Minimum number of non-letters Minimum number of numeric characters Minimum number of special characters Maximum length of repeated characters Maximum length of sequential numbers Set the minimum length of letters of the password. If the Minimum strength is the Must be alphanumeric, the number 1 must be entered. In the case of the Must include special characters, the default value is the number 3. If you want to enter another number, the number must be equal or greater than the sum of the Minimum number of lowercase letters and the Minimum number of capital letters: Including Letters and numbers: Default value is 1 Including special character: Default value is 3 Set the minimum length of lower case of the password: Set the number of capital letters in password: Set minimum length of numbers or special characters of the password. If the Minimum strength is the Must include special characters, the default value is the number 2. If you want to enter another number, the number must be equal or greater than the sum of the Minimum number of numeric characters and the Minimum number of special characters: Including special character: Default value is 2 Set minimum length of numbers of the password. Including special character: Default value is 1 Set the minimum length of special characters of the password. Including special character: Default value is 1 [Android OS, Samsung Only(SAFE2.2+)] Set maximum number of duplicated characters: [Android OS, Samsung Only(SAFE2.2+)] Set the maximum number of consecutive numeric characters that users may enter: 316

14 Maximum length of sequential characters Minimum length of character change Prohibited words Set prohibited words Time to lock screen Password visibility settings Pattern lock visibility settings Smartcard Browser Authentication [Android OS, Samsung Only(SAFE4+)] Set the maximum number of consecutive characters that users may enter: [Android OS, Samsung Only(SAFE4+)] Set the minimum length of letters that users must change from the previous password. If the Minimum strength is the Number, Must be alphanumeric, or Must include special characters, it must be less than the Minimum length: Set whether to use prohibited words in password: Prohibited words setting: You would set prohibited words in password. [Android OS, Samsung Only(SAFE2.2+)] Set prohibited words in password: Add: Enter an word and click. Delete: Select an word and click X. Set the maximum time allowed for users to access the container before locking the screen: 15 Sec 30 Sec 1 Min 2 Min 5 Min 10 Min 30 Min [Android OS, Samsung Only(SAFE4+)] Set whether to display the password when entering it: Allow: Allow password visibility. Disallow: Disallow password visibility. [Android OS, Samsung Only(SAFE3+)] Set whether to display the pattern when entering it: Allow: Allow pattern visibility. Disallow: Disallow pattern visibility. [Android OS, Samsung Only(Knox1+)] Set whether to allow smartcard authentication within the internet browser. Bluetooth smart card-related Apps must be installed on the device. The policy can be used after registration in Settings > Security smart cards. The Bluetooth security mode is applied while the device is connected to the smart card reader and will not accept other Bluetooth connections: Allow: Allow using Smartcard Browser Authentication. Disallow: Disallow Smartcard Browser Authentication. 317

15 Unlock with fingerprint unlock with iris Enforce Multi factor Authentication Block function setting on lock screen Block functions on lock screen [Android OS, Samsung Only(SAFE5.1+)] Set whether to allow or not allow use of finger print unlock control. Allow: Allow to unlock screen with finger print. Disallow: Disallow to unlock screen with finger print. [Android OS, Samsung Only(SAFE5.2+)] Set whether to allow or not allow use of iris unlock control. Allow: Allow to unlock screen with iris. Disallow: Disallow to unlock screen with iris. [Android OS, Samsung Only(SAFE5.2+)] When the Knox container is created, it is set to select only twofactor authentication on the password setup stage. Even when the manager chooses to ban the Unlock with fingerprint or Unlock with Iris, you can still use your fingerprint or iris for twostep verification. Use: Forces the screen lock to release via fingerprint or iris recognition. Do not use: Disables the two-step authentication settings via your fingerprint or iris recognition. Set whether the function to be blocked when the screen is locked. Apply: Blocks the function set in the lock screen. [Samsung Only(SAFE5.4+)] Set the lock screen function options. Trust Agent: Set whether to use the Knox Quick Access on the lock screen. Knox Firewall group The firewall supports IPv6 for SDK 2.6 or later. Even if the IPv4 and the IPv6 indicate the same address, a separate configuration is required. You can configure an IP or a domain firewall policy for each application. To enable or prohibit a specific firewall on all applications, enter a wildcard character (*) for the package name. If multiple firewalls settings exist, the restricted control has the higher priority. If firewall settings for all apps and individual apps exist, the setting for individual apps has the higher priority. 318

16 If you use the wildcard character (*) on an enable policy to allow all access, the access to a specific IP address or domain is allowed even when it is entered into a prohibited policy. Firewall Firewall type Permission Prohibition Set whether to use firewall in the Knox Container. Permission has priority over Prohibition. Because it is allowed by default, the Permission is used to allow the IP and port excepted from the Prohibition : Use: Use firewall in the Knox Container. Do not use: Do not use firewall in the Knox Container. Set the firewall type if the firewall function of the Knox container is set to Use. All Packages: If selected, the firewall function will be set for all container packages. Set the Allow and Disallow policy below. By Application: If selected, the firewall function is set for each individual app in the container. Set the details of the following items: - Permission (By Application) - Prohibition (By Application) - Permission (Domain) - Prohibition (Domain) - DNS setting Set the target IP and port to be allowed through the firewall. To allow the target IP and port, set the prohibition policy to * to allow all ports to be opened. If you want to allow only specified IP and port, enter * to the Host Pattern and the Port (range) of the Prohibition. Ant the Permission will be applied after blocking entire IP and port: 1. Enter the Host pattern, Port. 2. Select the Port Range: Local: Allow the port in the user devices. Remote: Allow to access to the specified port of server. 3. Click. Set the target IP and port to deny access through the firewall. If set as Local, the use of specified port is denied on the device. If set as Remote, access to target IP and port is blocked: 1. Enter the Host pattern, Port. 2. Select the Port Range: Local: Disallow the specified port in the user devices. Remote: Disallow to access to the specified port of server. 3. Click. 319

17 Permission (By Application) Prohibition (By Application) Permitted policy (Domain) [Android OS, Samsung Only(SAFE5.5+)] Set the target IP and port to allow. To allow a specific IP and port only, set * as the IP Address (range) and Port (range) of the disallow policy to block all IP addresses and ports, and specify the allowed IP address and port. 1. Enter the IP address (range) and port (range). 2. Setting value of the applicable port range: All Local: Allow the use of the specified port in the device. Remote: Allow access to the port of the target sever. 3. Enter the package name of the application to allow or click to search the package, and add by clicking. [Android OS, Samsung Only(SAFE5.5+)] Set the target IP address and port number to disallow. If you set a local IP address, the use of the port from the device is prohibited. If you set a remote IP address, the access to the target is prohibited. 1. Enter the IP address (range) and port (range). 2. Setting value of the applicable port range: All Local: Disallow the use of the specified port in the device. Remote: Disallow access to the port of the target sever. 3. Enter the package name of the application to disallow or click to search the package, and add by clicking. [Android OS, Samsung Only(SAFE5.6+)] Set a domain address to permit. When entering the domain address, use a wildcard character (*) to allow the use of a specific domain. A wildcard character (*) must be placed before or after the domain name, and not in the middle of the domain name. E.g.) *android.com or To only allow limited domains, use a wildcard character for the prohibited policies to block all domains first. 1. Enter the package name of application to allow or click to search and select. 2. Enter the range of the domain address and click to add. 320

18 Prohibited policy (Domain) DNS setting [Android OS, Samsung Only(SAFE5.6+)] Set the domain address to prohibit. When entering the domain address, use a wildcard character (*) to disallow the use of a specific domain. If you set as Local, the domain in the device is prohibited. If you set as Remote, the access to the target domain is prohibited. 1. Enter the package name of the application to prohibit or click to search and select. 2. Entering the domain address (range) click to add. [Android OS, Samsung Only(SAFE5.7+)] Set the domain server address used when the app with the registered package name operates. You can assign a single DNS to an app and it is effective only when there are no VPN or proxy policies assigned to the app. 1. Enter the package name of application or click to search and select. 2. Enter the primary DNS in DNS1 and the secondary DNS as IP address format in DNS2, and click to add. 321