Endpoint Protection

I have seen some of my clients loosing network connectivity. when i remove sep from the client it starts communication in network again but after installing sep again and updating ,it again looses network connectivity. whats happening.

i am using sep11mr4mp2

Can you check your Firewall rules if anything might be blocking it....
Does turning off NTP help ?

Hi Bijay.Swain,

I have a few questions:

-What OS's are the clients that are losing connectivity?
-What do you mean by network connectivity? (i.e. shared drives/network drives, internet, lan?)
-Open one of the clients, click Help and Support in the upper right and choose About. What is the exact version number?

Thanks!

client os:- win xp sp2
loosing network connectivity means :- I am not able to ping its gateway also .can self ping but can't ping anyone else.
version :- 11.0.4000.2295

Hi Bijay.Swain,

Our earlier releases of MR4 did have some networking issues with them, I don't believe they were specific to the issue you are describing though. Did you make any kind of changes to the firewall policy?

If so we can export your policy to take a look at whats being blocked.

If not, as a test though I would suggest updating at least one of the clients to the latest (11.0.4202.75) that has some changes to our code. With that we can see if its just upgrading that will fix it or some other environmental thing.

You can grab a copy of the 4202.75 at https://fileconnect.symantec.com

You want Endpoint Protection International English, and then only CD1 of 4202. After you download and extract CD1 there will be a folder called SEP, copy this folder to one of the clients having this problem. Afterwards you can uninstall the older client and run this install to see if the network issues goes away.

Bijay,

If you disable Network Threat Protection on the client, are you able to then ping the Gateway or any other computer on the network? If not, try doing an ipconfig /release then ipconfig /renew and try again. If you are able to, what I assume then is that it is possibly a firewall rule issue. What you can do is edit the firewall policy rule set by putting a blank allow all rule at the top of the rule list and apply that rule set. After you have verified the client has received the new firewall policy, enable Network Threat Protection and see if you are still blocked from network connectivity. If you have network connectivity still, then that means it was indeed a rule issue and you can move that blank rule down the list one by one -- testing after each move until the issue comes back. Once the issue comes back then the rule just above the blank rule will be your culprit.

I may also suggest looking into the following document:

Symantec Endpoint Protection 11.0 Network Threat Protection (Firewall) Overview and Best Practices White Paper
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007121714495348