Endpoint Protection

Hi All,

I have came across a small issue. I pushed out the Symantec RU6 client (32-bit - Windows 7 Pro) to a VPN user (used clientremote.exe). The user is having problems connecting to the VPN. When I checked the SEPM, I noticed something strange. The SEPM is reporting the IP address of user as 10.x.x.x (the IP of the local network). However, the VPN IP is listed right below, but the MAC address is all zeros (00:00:00:00:00:00). Anyone ever see anything like this? All of the other VPN users have the VPN IP address first and the local IP second and both MAC address have numbers.

Also, when we uninstall the Symantec client, the user can connect without issue. I have all three components installed - Antivirus, PTP, and NTP (without DoS protection).

Thanks for the time.

Mike

Does it get fixed once you disable NTP ?

Hi Vikram,

Nope. I tried with just Antivirus as well. Same issue.

Mike

All of the other VPN users have a MAC address of 00:53:45:xx:xx:xx along with the VPN IP address. The problem user has a MAC address of 00:00:00:00:00:00 along with the VPN IP address. How is endpoint finding the mac addresss?

Mike

Does your Remote user have Windows Firewall Enabled?
I don't know for sure, but most of the time, querying a MAC address would be done through ports 137 to 139...  Not sure if Symantec uses the same standard...
I would say it's either a bad install of the Teefer2 driver or Windows Firewall issues... 
But since, when you remove SEP it goes back to normal, I would think teefer2... 
* * * * * * *
Before trying to connect via VPN, does this person have an IP address?  Are they receiving via DHCP or Static?