Endpoint Protection

We have End Point Protection 12.1 and we are up for renewal. We also have Symantec Network Access Control or SNAC which is due for renewal but we are only using the "Host Integrity" portion of SNAC. I was informed by our PM that we don't need to renew SNAC as long as we renew our End Point Protection license since Symantec changed their licensing process and SNAC is now included in all future releases from 12.1 and up and were told we dont have to renew SNAC. My question is what is the impact when license expires for SNAC and will Network Access Control part stop working and will any users get messages or alerts on this through the client. I appreciate input and advise on this?

Starting with 12.1.5 (due out October 6th) SNAC host integrity will be apart of SEP now.

See the post here:

https://www-secure.symantec.com/connect/forums/possible-product-replacement-snac#comment-10445021

Thanks but need some clarification. We have Symantec End Point Protection 12.1.1000.157 RU1 and currently using "Host Integrity". We were told not to renew SNAC license when we renew our End Point Protection. My question is will there be any impact when license expires for SNAC and will Network Access Control part stop working and will any users get messages or alerts on this through the client. I appreciate input and advise on this?

My assumption would be they would get rolled up into one license. But you're best off calling support for full details. I can't fully answer this since I don't work for them.

As with SEP itself, when the SNAC license expires, the HI policies continue working as normal.

You'll get nagged on the SEPM, but the users won't see any inidication its expired, and you'll still have full control of HI from the SEPM.

Hi,

There should not be any concern however I will test this in my lab & will get back to you.

Symantec Network Access Control (SNAC) End of Life FAQ for Customers and Partners

http://www.symantec.com/docs/HOWTO95154

Great, thank you Chetan.. I appreciate the input and feedback.

Hi SamAdmin,

Here are my findings:

1) When I did a fresh install of SPE 12.1 RU5 (Beta) it has following requirements under Host Integrity.

2) I did an upgrade from SEP 12.1 RU4 SNAC to SEP 12.1 RU5 (Beta). Upgrade contains these requirements.

Option " Only do Host Integrity checking through the Gateway or DHCP Enforcers is still there Probably because Symantec will continue to provide Tech Support services and bug fixes during the Limited Support period from the End of Life date until November 5, 2017 for customers with active maintenance.  

Symantec Network Access Control (SNAC) End of Life FAQ for Customers and Partners

http://www.symantec.com/docs/HOWTO95154

There was no notification pop up on client machines after SEPM & SEP client upgrade. I don't think users will get any alert after an upgrade.

SEP Client upgrade will required reboot.

However I would recommend to test the upgrade prior to roll out in your network.

Hi Chetan,

Thanks for sharing the test results and your feedback. I'm running SEP12.1 .1000 RU1 and we are renewing license End Point soon. If we dont go to SEP12.1 RU4 or 12.1 RU5(Beta) and just deicde to renew the license for SEP 12.1.1000.RU1, will we have issue on client if not renewing SNAC.  We were told not to renew SNAC license when we renew our End Point Protection license since we are using Host Integrity which is included now with 12.1 upgrades and newer versions  and will we have problem with SNAC when it expires or get the same results you got in the lab environment and no notification pop up on client machines?

Regards,

SamAdmin

As long as you don't remove the SNAC license from your SEPM, everything will work as normal.  The only difference you'll see are the SEPM console license warnings and notification emails.

Clients don't see anything at all

Hi SamAdmin, Are you using Hard Enforcement? 

Hard Enforcement work at enforcer level and when integrity fails it display error message as you do configure in compliance policy.

For Software enforcement it shows the status into the SEPM console.