We are having a Windows Cluster Environment with Two nodes connected. We have installed SEP 14 MP2 on both the servers on local drive and we have implemented the customized firewall policy based on our requirement.

Few days later we come to know that the standby node in the cluster got down. After a dig deeper we found that the SEP is causing this issue. When we disable the SEP by smc -stop the cluster is working fine.

To isolate this issue we have applied any any rule in Firewall Policy, it started working fine, but the customized policy contains the necessary ports for the Windows Cluster. Even though it is not working properly.

How we can proceed further to fix this issue?

 

 

Regards

Sathiyapprakaash, A.K

 

You need to check the firewall logs to check the rule which is blocking and then tweak it accordingly.

Use advanced debug logging options for the Symantec Endpoint Protection client in SymDiag

https://support.symantec.com/en_US/article.TECH207795.html

Check your Traffic log and add the allow rules accordingly. Start here:

http://www.symantec.com/docs/TECH203497

Windows Cluster Environment used IPv6. Disable all rules which blocked IPv6.

@ Rafeeq @Brian @ AndreyP

 

For testing purpose I have applied the following rule in the first position, even though it is not working.

 

Local IP : Node 1 IP address , Node 2 IP address, Cluster IP Address

Remote IP : Node 1 IP Address. Node 2 IP Address, Cluster IP Address

Port : any

Application : any

Communication : all types

 

 

Cluster IP Address - IPv4 - ? You must allow IPv6 inside Cluster.

Also, have you installed correctly per their best practice guide?

http://www.symantec.com/docs/TECH91154

@Andrey After a reboot IPv6 is getting changed. How should I address this. Share me your email ID. If you are okay with it.

@Andrey After a reboot IPv6 is getting changed. How should I address this. Share me your email ID. If you are okay with it.

Hello,

you can mail me to andrii.pupynin@ukrsotsbank.com