Endpoint Protection

 Hello

Configuration with GUP
I defined 2 hours to try to download from GUP.


  <GupItem Address="10.1.254.207" Port="2967" />
  <GupItem Address="10.4.254.195" Port="2967" />
  <GupItem Address="10.4.254.196" Port="2967" />
  <GupItem Address="10.5.254.242" Port="2967" />
  <GupItem Address="10.5.254.243" Port="2967" />
  <GupItem Address="10.6.254.195" Port="2967" />


The client in subnet present in gup files update easily and quickly


The client out subnet  ( 10.1002.X.X ) update slowly or not update !!! I would know how update client when their Ip address are out subnet GUP. 
a) The client checks if it must update from GUP
b) If  ip adress   is out subnet , must it wait two hours to update from SEPM or directly update from SEPM

Thanks

At the time of configuring multiple GUP in live update policy,downside there is an option for specifying a GUP address which clients can use for receiving the updates when there is no GUP in their subnet.Try that.

Hello,
All clients cannot take updates from Gup or some of them?

Best Regards.
Fatih.

i complete the message with  sylink.log


<mfn_MakePostUrl:>Request is: action=192&hostid=4201A9D8C0A846F8009E8C18209346F7&chk=5D7872F4CF7DAB2C174AFE202FC1175F&ck=9E2833935B3A968853A119782E3ADA59&uchk=C541480DC524C9627635BB2A79B21690&uck=5E61E28163F14141B6E9842D00E5A1A4&as=10657&cn=[hex]59524652443231333538&lun=[hex]5952393930303739&udn=[hex]5952472E59564553524F434845522E434F4D
07/02 10:08:20 [1400] <mfn_PostAgentInfo>http://????????:8014/secars/secars.dll?h=181337F94566EB94E908E80711BDA3B2C01FE10DEBFF0F25D0EEC3F31F5C011C12FD432F78C2335FF3CB4A6DCF1D984AA6C5B4C181383CE37102DB712D5AFE895DDFB654CB380830B4E6FE0E4000804C05C1EA3BA8CDCF6E157E8A101D50F945A28E195714FD6AC7F4035F916E43B40B60253779529F5CD9BA3BFBC34DB92FCC6EAF8F3355582CEA6980FAFF637EB344CA167D0BB08E6521F605960F306031CFC381A8046B109CB35D98B3E5F1F28C8B0D9BFD18FA9B79B48DADAB71AD751306B3304C3E966C37B3540719A8019EB69F49A42549EA3B4C89F127F4735EC520535A14D07F47430F462A7EB7084930658F328F99E19C03DDC1C72D43F739CFF1D01E677BCE58F4EAE524158EA61B00B809A01F79F26473CF0D72087C2F9D00D83A996B54C16824C8BE6087414CB6555B72284C6EDA034097CEDECD6B54F762C48E
07/02 10:08:20 [1400] <mfn_PostAgentInfo>POST the total size=324
07/02 10:08:20 [1400] <mfn_PostAgentInfo>Done with return code = 200
07/02 10:08:20 [1400] <IndexHeartbeatProc>===UPLOAD STAGE===
07/02 10:08:20 [1400] <PostEvent>going to post event=EVENT_SERVER_READY_TO_UPLOAD_EVENT_LOG
07/02 10:08:20 [1400] <PostEvent>done post event=EVENT_SERVER_READY_TO_UPLOAD_EVENT_LOG, return=0
07/02 10:08:20 [1400] <IndexHeartbeatProc>===PREPARE EVENT LOG STAGE===
07/02 10:08:20 [1400] <PrepareEventLog>initialized technology extension processing ok
07/02 10:08:20 [1400] <PrepareEventLog>Allow total logs to send=0
07/02 10:08:20 [1400] <IndexHeartbeatProc>Communication Mode=1(Pull mode)
07/02 10:08:20 [1400] HEARTBEAT: Check Point 8
07/02 10:08:20 [1400] <PostEvent>going to post event=EVENT_SERVER_DISCONNECTED
07/02 10:08:20 [1400] <PostEvent>done post event=EVENT_SERVER_DISCONNECTED, return=0
07/02 10:08:20 [1400] <IndexHeartbeatProc>====== IndexHeartbeat Procedure stops at 10:08:20 ======
07/02 10:08:20 [1400] <IndexHeartbeatProc>Set Heartbeat Result= 2
07/02 10:08:20 [1400] <IndexHeartbeatProc>Sylink Comm.Flags: 'Connection Failed' = 0, 'Using Backup Sylink' = 0, 'Using Location Config' = 0
07/02 10:08:20 [1400] Use new configuration
07/02 10:08:20 [1400] HEARTBEAT: Check Point Complete
07/02 10:08:20 [1400] <IndexHeartbeatProc>Done, Heartbeat=300seconds
07/02 10:08:20 [1400] </CSyLink::IndexHeartbeatProc()>
07/02 10:08:20 [1400] <CheckHeartbeatTimer>====== Heartbeat loop stops at 10:08:20 ======
07/02 10:08:25 [3572] <CSyLink::mfn_DownloadNow()>
07/02 10:08:25 [3572] </CSyLink::mfn_DownloadNow()>
07/02 10:08:27 [3648] SyLinkDeleteConfig => Deleting instance: 01AFD808
07/02 10:08:27 [3648] SyLinkCreateConfig => Created instance: 01AFD808
07/02 10:08:27 [3648] Importing ConfigObject: 01BA29F0 into: 01AFD808
07/02 10:08:27 [3648] <LUThreadProc> Got ConfigObject to proceed the operation.. pSylinkConfig: 01AFD808
07/02 10:08:27 [3648] <CRandomDelay::CRandomDelay()>
07/02 10:08:27 [3648] Random delay window: 0hour 5min 0sec
07/02 10:08:27 [3648] Computed random delay:0hour 2min 17sec 0millisec
07/02 10:08:27 [3648] </CRandomDelay::CRandomDelay()>
07/02 10:08:27 [3648] <LUThreadProc>Waiting for: 137000 milliseconds to start downloading LU contents
07/02 10:09:23 [3572] <CSyLink::mfn_DownloadNow()>
07/02 10:09:23 [3572] </CSyLink::mfn_DownloadNow()>
07/02 10:10:20 [3572] <CSyLink::mfn_DownloadNow()>
07/02 10:10:20 [3572] </CSyLink::mfn_DownloadNow()>
07/02 10:10:39 [3648] <LUThreadProc>Starting LU download.
07/02 10:10:39 [3648] SyLinkCreateConfig => Created instance: 01AF1958
07/02 10:10:39 [3648] Importing ConfigObject: 01BA29F0 into: 01AF1958
07/02 10:10:39 [3648] <UpdateGUPList>Setting the session timeout on GlobalItemsSession to 2 min.
07/02 10:10:39 [3648] ************CSN=10658
07/02 10:10:39 [3648] <MakeGetGlobalIndexUrl:>Request is: action=310&hostid=4201A9D8C0A846F8009E8C18209346F7&chk=5D7872F4CF7DAB2C174AFE202FC1175F&ck=9E2833935B3A968853A119782E3ADA59&uchk=C541480DC524C9627635BB2A79B21690&uck=5E61E28163F14141B6E9842D00E5A1A4&groupid=00D1AA57C0A846F8005B99ED752B6703&as=10658&cn=[hex]59524652443231333538&lun=[hex]5952393930303739&udn=[hex]5952472E59564553524F434845522E434F4D
07/02 10:10:39 [3648] <GetGlobalIndex:>http://????????:8014/secars/secars.dll?h=9406FDEDB857D4A3F31BD6645AC5E0FBC01FE10DEBFF0F25D0EEC3F31F5C011C12FD432F78C2335FF3CB4A6DCF1D984AA6C5B4C181383CE37102DB712D5AFE895DDFB654CB380830B4E6FE0E4000804C05C1EA3BA8CDCF6E157E8A101D50F945A28E195714FD6AC7F4035F916E43B40B60253779529F5CD9BA3BFBC34DB92FCC6EAF8F3355582CEA6980FAFF637EB344CA167D0BB08E6521F605960F306031CFC381A8046B109CB35D98B3E5F1F28C8B0D9BFD18FA9B79B48DADAB71AD7513067D57BEFBE7D1F9BACAC15C422FA98920742BF9C9E6E148236170477389B5E9DBDF6B6CCAFFFD99B1D5B7BD8254E2DF6ED7BC711593C7F02BEAC81352D4901F89E62B2429F4D65DED9ED0B5E50331840CF52AD9958F71C0EED94B0E252C856F874F98FFB3620D27F914627700A28893D9EBAAEA9A6E6066F409DECC1C2F4CD13E348FFE4269C177FD093A280D7CC6CF8F3F5735E47969700C25325C38154172F27F6A294D6FD1AAB30CD13318799B722A
07/02 10:10:39 [3648] 10:10:39=>Send HTTP REQUEST
07/02 10:10:39 [3648] 10:10:39=>HTTP REQUEST sent
07/02 10:10:39 [3648] <GetGlobalIndex:>SMS return=200
07/02 10:10:39 [3648] <ParseHTTPStatusCode:>200=>200 OK
07/02 10:10:39 [3648] <FindHeader>Sem-Signatue:=>0999E2790701D333BC43389B8C1F94949B21FACC30DA4657777FAAE4F47D664CB38521DA7D1B33E6D80F03583DE41249F5DBB788BE668BA61CAC4298577FD64FF5F867EE6DAAFA93EC17C40A529131CCB8B16DAC007D1EA7A709A3DCE1406543916BF9BE6A4D031F009F4930D2BF0C9F3F2DE15832859DBAE6D90504C9216A4C
07/02 10:10:39 [3648] <DoGetGlobalIndex200>Content Lenght => 196
07/02 10:10:39 [3648] <DoGetGlobalIndex200>Got Global Index from server, read bytes=196
07/02 10:10:39 [3648] <DoGetGlobalIndex200>completed
07/02 10:10:39 [3648] <GetGlobalIndex:>RECEIVE STAGE COMPLETED
07/02 10:10:39 [3648] <GetGlobalIndex:>COMPLETED
07/02 10:10:39 [3648] ************CSN=10659
07/02 10:10:39 [3648] <mfn_MakeGetGupListUrl:>Request is: action=320&hostid=4201A9D8C0A846F8009E8C18209346F7&chk=5D7872F4CF7DAB2C174AFE202FC1175F&ck=9E2833935B3A968853A119782E3ADA59&uchk=C541480DC524C9627635BB2A79B21690&uck=5E61E28163F14141B6E9842D00E5A1A4&groupid=00D1AA57C0A846F8005B99ED752B6703&as=10659&cn=[hex]59524652443231333538&lun=[hex]5952393930303739&udn=[hex]5952472E59564553524F434845522E434F4D
07/02 10:10:39 [3648] <GetGupList:>http://?????????:8014/secars/secars.dll?h=721919F16D553A1FC2E46B886920B497C01FE10DEBFF0F25D0EEC3F31F5C011C12FD432F78C2335FF3CB4A6DCF1D984AA6C5B4C181383CE37102DB712D5AFE895DDFB654CB380830B4E6FE0E4000804C05C1EA3BA8CDCF6E157E8A101D50F945A28E195714FD6AC7F4035F916E43B40B60253779529F5CD9BA3BFBC34DB92FCC6EAF8F3355582CEA6980FAFF637EB344CA167D0BB08E6521F605960F306031CFC381A8046B109CB35D98B3E5F1F28C8B0D9BFD18FA9B79B48DADAB71AD7513067D57BEFBE7D1F9BACAC15C422FA98920742BF9C9E6E148236170477389B5E9DBDF6B6CCAFFFD99B1D5B7BD8254E2DF6E6B76C3DAA5C8B58736130A95B29FE3B9E62B2429F4D65DED9ED0B5E50331840CF52AD9958F71C0EED94B0E252C856F874F98FFB3620D27F914627700A28893D9EBAAEA9A6E6066F409DECC1C2F4CD13E348FFE4269C177FD093A280D7CC6CF8F3F5735E47969700C25325C38154172F27F6A294D6FD1AAB30CD13318799B722A
07/02 10:10:39 [3648] 10:10:39=>Send HTTP REQUEST
07/02 10:10:39 [3648] 10:10:39=>HTTP REQUEST sent
07/02 10:10:39 [3648] <GetGupList:>SMS return=200
07/02 10:10:39 [3648] <ParseHTTPStatusCode:>200=>200 OK
07/02 10:10:39 [3648] <mfn_DoGetGupList200>Content Lenght => 372
07/02 10:10:39 [3648] <mfn_DoGetGupList200>Got Gup List from server, read bytes=372
07/02 10:10:39 [3648] <mfn_DoGetGupList200>completed
07/02 10:10:39 [3648] <GetGupList:>RECEIVE STAGE COMPLETED
07/02 10:10:39 [3648] <GetGupList:>COMPLETED
07/02 10:10:39 [3648] SyLinkDeleteConfig => Deleting instance: 01AF1958
 


 

Hello Fati

All client , where Gup is configured , update correctly
When i have a subnet where not gup is present , the client don't update or slowly !

Both subnets are present in same location?or it is two different locations connected using  WAN?

No it s physicaly different location using Wan . My server SEPM is configure with ipadress 10.1.X.X

My client in the same location where SEPM is present ,  are  adress IP 10.100,X.X 10.102.X.X. --> Update is slowly or blocked

My client in other location using Wan are address IP 10.X.10.X with GUP present is the location ---> update : ok

Policie update ; 
use default management server is selected
use a liveUpdate server is not selected
Group provider is selected

How many clients are present in the same location of the SEPM?
 In my opinion  there is no GUP is required if the clients are present at same location unless the number of clients are more.

in your Case I think the problem is the clients are trying to use the GUP which is present in the another location causing the problem.For local clients create a separate group and in LU policy of that select only use default management server and see any difference is present.....

Aravindkm, I tested this solution , and it 's ok but i m not satisfied. I don't want create a new  policie because my client are not to be able to update when i have group provider actived.

I though that client were  to be able to detect if they didn't find a GUP in their subnet , then they would go to upload from SEPM directly.

is it not the functionality of SEPM with GUP  ?

thanks

As far as I know if a client is not able to find a GUP in it's subnet it will wait until it finds a GUP .How ever it will by pass it after the time set for bypassing a GUP in the LU policy.
If am wrong somebody pls correct me....

Hi

Two questions ?

SEPM address I p must be in the end File's GUP ?

In Server with Gup role , have two network Card

a) Network card is 192.168.0.2 (SAN)  
b) Network card is 10.1.252.1  ( Local network )

In my file globalist.xml for the gup , Ip  address record with 192.168.0.2 and this address is not correct ( SAN )
Where in gup Server , i can force the good address ?

Thanks

Hello Mikael, sorry i write late i wast at office :)
There are a solution about your issue. I hope this help,
First of all your GUP have 2 address therefore your update policy should be with ip addres not machine name. Cause DNS can send ip packages to another Ip address. Therefore will be problem with connection. Change your Live update polic for GUP Ip address (10.1.252.1)
this will help your last question :)

SEP Manager And GUP must not to same Ip addressi For example my SEP Manager 10.20.30.40 But my gup can be 10.20.50.120 (255.255.255.0) package transferin is important when subneting.

And your another posts if you need more live update policy and more rules you can create second group. and you can give rules for changes. For example If client ip address change go to Internet for updates, or if client cannot access to sep manager use this update policy etc.
I have  a article about how to create second group (out of office rule)
I hope it will be help you: ) https://www-secure.symantec.com/connect/articles/how-create-out-office-locations-rule


Best Regards.
Fatih

Hi

in my configuration network card in  server GUP , i desactived the record DNS on my Card ( 192.X.X)  and i have only one address Ip and not two address in my DNS server

I don't know How the GUP detects and records the Ip address  in the file GlobalList.xml ? The Server GUP checks all card and records in the globallist.xml ?

If i Change my Update policy with ipaddress instead of machine name , im not certain that resolved my problem .
and i can' t change this policy because it's too impact a lot of client !!
i think , to contact support Symantec to help me if i mnot finding anything about configuration GUP

Thanks for help