Data Loss Prevention

Hi,

Any one can help me with Squid test in Linux server for DLP? Currently I will be performing Beta test for V 12.5. it will be great if some one can explain in details.

thanks in advance for the time.

are you looking for network prevent?

Hi Vontu14 , are u testing squid proxy for web prevent testing

I am not sure what exactly you are planning to do but a general starting point can be the following configuration lines in squid that configure SQUID to connect to Symantec Network Prevent for Web via ICAP. The hostname of the DLP Web Prevent for Web server in this example is 'enforcedemox64.acme.com'

## icap configuration
icap_enable on
icap_preview_enable on
icap_preview_size 0
icap_persistent_connections on
icap_send_client_ip on
icap_send_client_username on
icap_client_username_header X-Authenticated-User
icap_client_username_encode on

# icap acl to only check GET and POST requests
acl icap_method_acl method GET POST

icap_service service_req reqmod_precache bypass=1 on-overload=bypass icap://enforcedemox64.acme.com:1345/reqmod
adaptation_access service_req allow icap_method_acl
icap_service service_resp respmod_precache bypass=1 on-overload=bypass icap://enforcedemox64.acme.com:1345/respmod
adaptation_access service_resp allow icap_method_acl

Hi,

Thanks for responding, I have to perform squid proxy for web prevent testing. If you can give me detail steps and configurationn, that will be great help.

thank you again for your time.

Thank you so much for your comment.

Vontu14, do you have the Symantec Data Loss Prevention Integration Guide for Squid Web Proxy? It comes with the standard doc set.

No, i don't have it. Can you please send the doc or the link to download?

Here is the Squid integration guide..

Hope this makes sense.

If this solves your questions please marked as solved.

Ronak

Attachment(s)

Symantec_DLP_12.0_Squid_Integration_Guide.pdf   352 KB 1 version

Which Linux distribution are you using for this testing scenario?? 

Hi,

I need  VONTU Standard and control documentation with architectural diagram. Please help.

ANy one can help me on DLP Error codes with step by step instruction to resolve the issue?

EVENT/ERROR

Codes are

2920
3008
3015
3019
3306
3310

Thank you in advance for the time and effort.

You can find the meaning of every code on page 157 of DLP Admin guide.

Guide here: https://www.dropbox.com/s/3ow2eiyfj5gq7zh/Symantec_DLP_12.0_Admin_Guide.pdf

Hi,

I have meaning/ code description. I am looking for step by step action to be taken when a support ticket open for those issue.

Thanks.

Hi Vontu14,

You will need to open a support ticket to get your answers. There are just too many variables to cover in a blog post.

Thanks,

Ryan

Hi Ryan,

Thank you for response. Now i know why i did not get response from some one long time. Support ticket opened for long time too. some one called and spend some time for internal research!!! and no call back yet. If you can describe the steps to resolve the issue for the following two codes that will be great. I hope if there are some one intereste, will pick up the rest.

Codes are:

Event code 3008
Event code  3015

Thank you.

Hello:

3008: Replication of document profile {0} to server {2} failed. {1} Check the monitor controller log for more details.

3015: Failed to load document profile.

Sounds like MonitorController is having trouble pushing out the indexes. Restart the Monitor Controller. Do all your systems meet the system requirements for DLP?

Look in the monitor controller logs.

Ryan