Endpoint Protection

Hello,

Upgraded recently SEP manager and some clients from 14.0.3897.1101 to 14.2.758.0000.

Upgraded clients started having issues with selecting correct location - laptops that have Wi-Fi card enabled (not connected to anything) insist in picking "Wireless" location.

Althought the only IP they have is from the range approved for the "Ethernet Only" location.

After some long trail and error i saw that what helped is to change from "If all of the IP addresses of the client computer are listed below" to "If the client computer has one of the IP addresses listed below"  - but this is not good enough.

No other IP addresses exist on the client.

Any ideas?

Perhaps its a bug?

Thanks !!!!
Gennady

Y:\>ipconfig /all

Windows IP Configuration

Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Intel(R) Ethernet Connection I218-LM
   Physical Address. . . . . . . . . : 28-D2-44-65-19-FD
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 10.1.1.135(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   DHCP Server . . . . . . . . . . . : 10.1.1.59
   DNS Servers . . . . . . . . . . . : 10.1.1.59
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Ethernet 2:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Check Point Virtual Network Adapter For Endpoint VPN Client
   Physical Address. . . . . . . . . : 54-5C-A5-51-E2-07
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Wi-Fi:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Intel(R) Dual Band Wireless-N 7260
   Physical Address. . . . . . . . . : 7C-7A-91-59-60-E1
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Local Area Connection* 2:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter
   Physical Address. . . . . . . . . : 7C-7A-91-59-60-E2
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Local Area Connection* 4:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft Hosted Network Virtual Adapter
   Physical Address. . . . . . . . . : 7E-7A-91-59-60-E1
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Bluetooth Network Connection:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network)
   Physical Address. . . . . . . . . : 7C-7A-91-59-60-E5
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Please get a case opened up. They'll have you enable additional logging and send up to support for review.

Yes. Please open a case.  Provide the case number here once created.

Done - ticket #14998134 .

For Location Awarness issues please collec the following:

1. Run Symdiag on a client you are able to reproduce the issue on.
2. Accept the EULA
3. Collect Data for Support
4. Select Endpoint Protection Client
5. Select All Data and under Debug Logging select Endpoint Protection Client
6. Change timer to 0.
7. Select Advanced
8. At the top select ALS WPP Debug
9. Click Ok then Next
10. On prompt select Enable Debug Logging
11. Reproduce the issue
12. Select Next to stop debug logging and start collecting the logs.

Provide a detailed explanation of how your rules are set up and how they were working before the 14.2 upgrade.

Hey,

Following is the link to the dedug file:

https://drive.google.com/file/d/1V3Zb47Zxw-AVtcIwO0rJz4fCaqJg0UGs/view?usp=sharing

Location settings are the same before and after upgrades:

"Default" wich has no rules

"Wireless" which works when there is a wireless connection

"Ethernet" - which is also set to be default in case of conflicts - which is selected when Ethernet connection exists and client's IP is from one of the corporate ranges.

Screenshots are attached.

While connected to corporate LAN via Etherne - upgraded cliens select Defauls location, sometimes Wireless.

Not upgraded clients select correct location with no issues.

Wi didn't loose any policies after the upgrade.

Many thanks for the help !!!

Thank you. I have added your data to the case and asked the engineer assigned to advance it to Backline.

Engineering has identified the issue and will be working on a fix likley to go out in the next MP release.

Etrack 4189031 for your reference.

 

Fantastic - many thanks !!!

To track the issue:

 

https://support.symantec.com/en_US/article.TECH250794.html?

Hello Everyone,

If you have this issue, will you please open up cmd and run the following command:

netsh int ipv4 show ipaddresses

Please private message me the results.

Thanks,

John

Please note that there is also an issue where the SEP agent will crash completly if you use a «DNS lookup» condition in a location awarness. Policy. The Sepmaster service will stop and won’t start again. https://www.symantec.com/connect/forums/sep-142-crashes?list_context_id=3377631&list_context_type=symantec_product

I've installed the new 770 version the location still is not chosen correclty.

Do you wanto to collect data again?

 

I've installed the new 770 version the location still is not chosen correclty.

Do you want me to collect data again?

Please open a case with new data and let me know the case number.

 

We have this issue as well and I have opened a case with Symantec for it. I have not attempted the 770 update yet, but will be doing that and if the issue persists will collect debug symdiag to upload. 

FWIW, we updated to 770 and still have the issue.  We also have an open support ticket and this is apparently another known issue they're actively working on.

Case number please?

15782550. Also uploaded Symdiag to that case.

If there is a new link - please post it so we can followup.

If there is a new link to the issue - please post it so we can followup.

The issue fixed in 770 was a very specific issue. There are other ALS issues that are slated for our MP1 release.

What is the tentative release date for MP1?

 

What is recommended to use for location awareness if subnet and DNS are both not working properly right now in 14.2?

The same issue here (on both 758 and 770 builds of SEP 14.2). Using DNSlookup and subnet rules to set location results in having the default location set (which is a big issue since our FW rules restrict quite a lot of traffic for the Outside (default) placement).

Ticket already open (16850236), SymDiag file provided.

Upgraded to build 770 - issue still here, using subnet rules. All clients are in default location, we use this location for client outside. We need our "LAN" location for firewall rules, sharing etc. 

Do you have a support ticket opened??

Not yet. I don't have access to open ticket, request was sent.

Ticket opened: 23502681, SymDiag file added manually, becäuse SymDiag fails to upload file directly.

We are having the same issue on any machine upgraded to 14.2 on location awarness is incorrect but our is based on IP address.  On the workstations we reverted back to 14.0.3929 then the work as expected.

KB article to subscribe to:

https://www.symantec.com/docs/TECH251187

With 14.2 clients observed issue with location awareness not working and clients failing to apply updated firewall policies.

Had one firewall rule with an application defined, and that application had file description and file fingerprint information filled in. Removed all description and file fingerprint info from the rule so that only the "File Name" field was populated just the path to the executable. This fixed the issue on 14.2 clients.

Using the original firewall policy and rule on 14.0 clients they do not experience this issue.

The rule described above had nothing to do with communication to or from the management server. Process of elimination starting with a default firewall policy and testing after each change came to this result. Seems like maybe a bug.

I have noticed just now that new release is available:

14.2.0.1 (14.2 MP1)

14.2.1015.0100

October 2, 2018

Was this issue addressed there?

No.  I just discovered the issue on a couple remote Windows computers.

Getting tired of reading that accumulating issues are fixed with the newest release, when they are not fixed, and more often are introducing new issues.

We are facing the same issue with 14.2 MP1 (14.2.1015.0100.105). Any workaround available or do we know an ETA for new release with a fix for this known issue?

We have a similar issue, currently logged with Symantec, we're on 14.2.1031 and using DNS Lookup for our location. Just seems to be a few clients each day get stuck in one location and won't switch until the Symantec Client is restarted or killed, then its fine again for awhile.

Any solution? We have a similar issue

14.2.1031 is the version that we have installaed and using DNS Lookup for our location

It seems that it is fixed with this version but the problem persists (https://support.symantec.com/en_US/article.TECH251187.html)

Any solution for this one? We have same issue with DNS Lookup for location awareness. Version 14.2.1031. We have case open in Symantec.

Any update for this case? My workstation SEP Client version 14.2.1031.0100 has error connection, HTTP error 503 and status not connected. 

Update: New version of SEPM and client fixed our issues,  version 14.2.3332.1000..

It's back with 14.2 MR2!!