Data Center Security

Hi All,

I have csp client installed on remote location which is connecting to central csp server via internet.

In CSP if i check the client details..it shows public IP address which is used by the remote client to connect to internet instead the actual private Ip of the csp client.

Dhasan

This is happening as per the product design.

CSP is grabbing the IP address from the source IP part of the NAT'ed network packet from the CSP agent. thats y you see public IP on the console for that client. 

Then how do i find out the exact IP address of that client.

I have even checked agent report..but didn't find it......any report ?

As far as i know..there is no report on csp where you can find the exact IP of the external clients connecting from outside network..

This concern can be added to product enhancement http://www.symantec.com/docs/TECH215657

If you run a Get Agent Info via the Diagnostic Detection Polcy, all the interface's properties will be reported in the output.  Not very elegant, but it works

Hi,

I have enabled Diagnostic Detection Policy to run get agent info and applied the policy to the client

Now i see the below detection error on events

PE_0107: Execute command action blocked (not found in commands.txt):  Command \""C:\csp\IPS\tools\sdcss_agent_mgmt.bat" -collect_info\"  Policy: SDCSS_Agent_Diagnostics  Rule: Execute_Agent_Management

Didn't get any logs uploaded to \Program Files\Symantec\Critical System Protection\Server\logfiles