Endpoint Protection

Hi, Symantic Endpoint protection is blocking my chrome.exe to access the internet. Please help me how to get back my access to internet in Chrome.

What the error message display while blocking?

Post the Traffic log here for review. You may need to add an exception for the port or application itself

if its from IPS with SID mentioned in the pop up. then 

go to sepm

select policy

ips

exclude the SID

HI, 

Check on SEPM what rule causing for that and add exception for the same.

Regards

Ajin

Hi,

can u pls share the screen shot.

Hello,

What version of SEP are you running?

Is that SEP 11.x OR SEP 12.1??

Secondly, let me get your question right - You are unable to get on to Internet when using the Google Chrome Browser, correct?

Are you able to access Internet via Internet Explorer Browser??

Is this happening only on 1 client machine or all client machines?

Could you open the GUI of SEP client on your client machine and check the Traffic and Packet Logs by:

1) Open SEP client

2) Click on "View Logs"

3) Under Network Threat Protection, click on "View Logs" and click on Traffic Logs

Could let us know if there is any traffic blocked?

Hello Sanghavi,

             Yes there are many things blocked in the traffic log.

             I am able to browse internet in other browsers except Chrome.exe.

             This is my personel LapTop.

             Once, when SEP prompted asking whether to allow chrome to access internet or not. Then mistakely I clicked on No button.

Please help in this case.

Regards

Hello,

It could be but port scans happen continuously on the unfiltered Internet.

For the message about chrome changing, it was likely due to Chrome updating itself. This is a symptom of network application monitoring which detects changes in executables. Can you confirm Chrome was updated? I know you said network application monitoring isn't enabled but this has been the only time I've seen this message. If Chrome was updated than it is a normal message from SEP.

For the port scan attempts, SEP is detecting these so you can create a firewall rule to block this IP if you wish. A port scan is not inherently malicious, it is just the first step in an attack, which is recon. Your PC is being scanned to see what ports are open.

Hope that helps!!

Reinstall chrome, or update sep policy. when it asks to allow as the executatble has changed, click yes