Data Loss Prevention

Hello,

I have an installation of Symantec Data Loss Prevention 11 that is integrated with Microsoft ISA 2006. After that I installed the filter (symc_isa_plugin.msi) everything looks fine. I can surf the web through the proxy and when I POST or PUT confidential information an incident is created.

After a while (~30-40 minutes) the web proxy is blocking internet access. After doing some research I found that the Symantec ISA filter is causing this. When I stop the filter from the ISA Management screen I can access the internet.

I have attached the logs.

The interesting part is that when the filter is enabled and I try to access the internet in Event Viewer under Application a new 'Error' line is created for every attempt to access the web.

"3/24/2011    3:28:16 PM    Microsoft Firewall    Error    None    14057    N/A    SRVISA4DLP    The Firewall service stopped because an application filter module C:\WINDOWS\system32\kernel32.dll generated an exception code E06D7363 in address 77E4BEF7 when function CompleteAsyncConnect was called. To resolve this error, remove recently installed application filters and restart the service."

For now, the web filter is disabled.

Please help me!

Attachment(s)

Event Viewer - Application.zip   17 KB 1 version

symc_isa_plugin_logs_finest.zip   70 KB 1 version

Hello,

I have managed with the help of Symantec Support to "repair" the problem.

For short, I changed the value of Connection Retries to 0 and the Stream Buffer Size to a lower value.

This thread can be closed! :)