Endpoint Protection

Good morning,

We are dealing with an odd issue here.  We have a production FTP server that is configured for passive FTP connections.  Before we installed the SEP client, everythign was working OK.  It is our standard practice to only install basic SEP protection on servers, excluding the additional features such as Network Threat Protection.  However, after the install, we were no longer able to connect to the FTP server when using Passive FTP.  We finally reverted the server to a snapshot taken before the SEP install, and Passive FTP connections work again.  

So, what gives?  Does SEP install network-related protection even if you don't install NTP?  If so, how do you work around it?

Assuming you only installed the AV component, the NTP components should not be there.

Is it possible the component was installed but not assigned a policy?

The NTP component was definitely not installed.  

I've seen issues in the past with ftp and the IPS component but doesn't seem to be the issue here.

So you can't connect at all? Do you have any remote scanning of files enabled on the SEP side? Does ping work?

Correct.  The connection errors out after a few seconds.  The only remote scanning of files that is enabled is Auto-Protect scans of files on remote computers, but I don't see how that would prevent it from simply establishing a connection.

Regular FTP connections that use ports 20 and 21 work OK.  It is just passive connections, which us a random higher-numbered port for the data channel that are failing.  In order to get Passive FTP working before SEP was installed, exceptions had to be added to the Windows Firewall.  It is almost as if SEP is actively blocking traffic on those ports even though it does not have a firewall setup.

I am starting to wonder if the Adcanced Download Protection may have something to do with this.  I think I will take it from that angle (especially since Symantec phone support is now 20 minutes overdue for theit callback - I believe they call that "overpromise and underdeliver".)

You could disable to download protection to see what the result is. I've never seen an issue with this but who knows.

What's the exact 12.1 version out of curiosity?