Endpoint Protection

Hello, 

I have an network scanner and we do a Vulnerability scan on the random computers. Now as you all know the IPS would block any Port scan attemps for 600 seconds. 

So I have added the Scanner IP address to the IPS policy > Excluded Host > IP Address of the Scanner

I have also created a Firewall Rule to Allow all Traffic and Selected the Local/Remote combination to allow all Remote traffic from the Scanner's IP address. 

Now when I check the IPS Attack logs I see that the 3 events 

1) Active Response: The client will block the IP Address

2) Port Scan: Somebody is scanning your computer

3) Active Response that started at (Date) (Time)is disengaged.

And the scanner is not yeilding the expected results. 

Any help would be appriciated. 

Thanks, 

Is the vulnerability scanner a Windows box, and, if so, is the IPS blocking its traffic on the vulnerability scanning box?

Hey Brian, 

Yes its an OVA installed on a Windows Machine, 

No the IPS is blocking the Traffic on the client machines with SEP which the scanner is trying to scan.

And the clients have the updated policy from SEPM after you made the policy changes?

Creating the firewall rule is what would be needed first as it would be processed before IPS rules:

http://www.symantec.com/docs/TECH226408

Right the clients have taken the latest policy serial number as well, 

I have created both Firewall as well as IPS Rules, but does seem to be helping. 

I guess its passing thorough the Firewall but when IPS tries to do a Deep packet inspection that is when it blocks it or may be it is not able to hoour the exculded host IP address

Yes, if IPS is flagging it than the firewall rule took affect.

Seems host exclusion is not being honored. What is the exact version of SEP and SEPM here?

SEPM and SEP both are on 12.1.6 RU6 MP5 (12.1.7004.6500)

Any thing else we can try here?

It doesn't sound like these exceptions are being honored than. Without seeing screenshots or further detail, I'd suggest getting a case open so a support representative can remotely access your SEPM to troubleshoot further.

Please let me know what screenshots would you need? 

I have case opened with Symantec but that does not seem to be taking me nowhere.

@Rafeeq, No I have checked that those are normal client machines with a Single NIC on them 

Hello All, 

I was able to resolve the issue by changing the location Setting to Server Control as it was set to Client control which was not honouring the Firewall rules.