Symantec Endpoint Protection Manager preventing access to the internet

Trevor KHS's picture

Some of the computers on my network are being blocked from running Firefox or IE and I am recieving this message: Traffic from ip address 172.16.87.2 ( my server) or 172.16.87.1 (my proxy server)  is blocked for eg. from 29.10. 2009 AM to 29.10.2009 PM unsolicited incomming ARP reply detected could be a kind of MAC spoofing that could be harmful to computer. I need help to deal with this issue. I do not think that there is any MAC spoofing gooing on. The other computers are ok. I am able to ipconfig and see my ip addresses and gateway but I am unable to ping my server or proxy server. Recently I installed Spiceworks network mangement software could this cause the problem. How can it be corrected?

Cycletech's picture

It is most likely Spiceworks

It is most likely Spiceworks that is causing you issues. There has been known issues with Spiceworks and AV products working together.

UPDATE from SW: As of Spiceworks version 3.5 we have a new way to gather product keys that "shouldn't" get flagged by Anti-Virus software.

See the Spiceworks thread - http://community.spiceworks.com/topic/5759?query=p...

If you uninstall Spiceworks, do you still have issues?

trevorkhs's picture

Symantec Endpoint Protection Manager preventing access to the in

 Thanks for replying.  I uninstalled Spiceworks but I still have the same issues. I used the Intrusion Prevention System to Enable Excluded hosts-both my server and Proxy and unchecked Automatically unblock an attacker's IP address but things have remained the same. What still puzzeles me also is that this is only affecting a few computers in different labs.

AravindKM's picture

Whether all these pcs are

Whether all these pcs are belongs to a particular group.?If that is the case there may be some issue related to your policies which is applied to that group...

trevorkhs's picture

SEP manager prevent access to the internet

All the PCS belong to the same domain not separate groups and they all recieve the same policies. Therefore the issue should affect them all.

Bijay.Swain's picture

If using windows vista

If using windows vista disable IPV6 and reboot the machines and wait for 10 minutes.
Just Give a try to this
this should do the job for you.

Bijay.Swain's picture

did your problem solved . if

did your problem solved . if yes what was the cause

trevorkhs's picture

SEP manager prevent access to the internet

Sorry guys I was not around for a little while. I got the problem solved. I am not using vista my server is Windows 2003. Some other technicians had worked on my machine and made some changes to the policies.. I changed the Intrusion Prevention policy settings and unchecked Automatically block an attackers IP address. 
I also Changed the Appication and Device Control - Application Control - unchecked  Block programs from running from removable drives.
I think that policy clashed with my Turn off Autoplay on All drives that is enabled in Active Directory. Its ok now but I am still checking things out.