Endpoint Protection

Hello, 

I use Lansweeper to inventory my networks.  I created an exception, obviously incorrectly, within SEP for Mac.  My Mac users are getting popups and getting worried.  What is the proper way to disable the popups/create an exception for when Lansweeper scans their computers?

Is this coming from the Mac IPS component? Can you share a screenshot?

I'm unable to zoom in on the pictures. Can you upload as an attachment?

Attached

Are you setting up an 'Excluded Hosts' exception? If so, are you doing it by IP address, range, or subnet? For Mac clients, this is the only accepted method.

SEP for Mac does support Excluded Hosts for IP addresses (including IP range and subnet). However, it does not support MAC addresses, hostnames or domain names.

Yes, the IP address is in the excluded hosts section.  See attached

You're in the wrong policy.

You need to be in the IPS policy under Excluded Hosts:

I had the host in there as well. see attached

I attached the pictures below. I had added that ip address to the IPS policy under excluded hosts.

Which version of SEP you are using ?

Does Lansweeper and end points are in same domain and have an reverse DNS Lookup configured ? In older SEP Version 12.1.4, we had an defect related to revese DNS. Which is fixed in 12.1.6

Regards,

Manickam

Hi,

"Brute force remote login" in particular (signature ID 99995) is absent from the SEPM exception list by design. Brute force attack is detected by monitoring system log on client, and it is a detection only---no traffic is blocked.

If IPS detections are OK but the Macintosh pop-ups are a nuisance then disable Network Protection Security Event Notifications at the SEPM, in client group Policy, Location-specific Settings.

If IPS is not a requirement in the customer's environment, IPS policy may also be completely disabled at the SEPM. 

Solution is to upgrade to Symantec Endpoint Protection 12.1 RU6.  See Download the latest version of Symantec Endpoint Protection. Host exceptions work as expected in that version.

Reference:

http://www.symantec.com/docs/TECH227991