Endpoint Protection

when you have 2 NICs attached to computer, 1 for private network 1 for public network,
in symantec endpoint protection manager console, does there be a 2 same computer records?

for ex:


host1   192.168.5.5
host1    7.7.7.7

if you have 2  nics, symantec records both of nics.but clear mention what do want from symantec.

all i wan to know is that if the host is one,
why does it keep 2 records in console?

SEP client si registered with hardware key id. if that client has generated multiple at that time it might show duplicate in SEPM console?

are you seeing two records in SEPM? Does both of them show online?

yes i see 2 records in SEPM console, but with different IP Addresses....
both are online as well

right click on computer and select properties, do you see different Unique ID  for each of these? if yes then you will have two entries

yes Pete,
they are different...

in this case it is normal, isn't it?

It is normal.[ Although it is not supposed to be. ]

When you install the SEP client on the machine, then it will check in the internal routing table of TCP/IP stack to identify how to contact the SEPM.

Probably, using the IP address of SEPM from Sylink.xml and comparing it with routing table.

In your case, if you have multiple SEPMs on different networks, it may happen.

Aniket

yes, i have read it earlier in the forum, sorry, i cannot find the link at this moment. However someone from SYmantec can confirm

and what about 2 NICs in PC?

for this reason may it happen?

If you have 2 NIC cards, even then you have 2 IP addresses. So its possible that there may be more than one way to contact SEPM. So the client will check in the routing table again and then contact SEPM. that is how the client machine will decide which NIC to use for contacting SEPM.

As you said you have 2 NIC cards for internal and external.

So for external NIC card, the hop count to reach SEPM must be greater than internal.

Even in that case, if your client is registering with both IP addresses, may be that could be a bug.

Aniket

"Even in that case, if your client is registering with both IP addresses, may be that could be a bug."


i think so


thanks guys for sugestions