Endpoint Protection

hai...

I am new to Symantec End point Protection. Guys help me build a GUP, i tried several steps but not suceeding. Any one plz help me....

You should make branch server and branch server1  as GUP

check this article

https://www-secure.symantec.com/connect/articles/configuring-group-update-providers-symantec-endpoint-protection-110-ru5

Here are some more:

Best Practices with Symantec Endpoint Protection (SEP) Group Update Providers (GUP)

http://www.symantec.com/business/support/index?page=content&id=TECH93813&locale=en_US

Group Update Provider: Sizing and Scaling Guidelines

http://www.symantec.com/business/support/index?page=content&id=TECH95353&locale=en_US

Configuring the Group Update Provider (GUP) in Symantec Endpoint Protection 11.0 RU5

http://www.symantec.com/business/support/index?page=content&id=TECH96419&locale=en_US

How to: Setup a Group Update Provider (GUP)

http://www.symantec.com/business/support/index?page=content&id=TECH105005&locale=en_US

Tips For Installing SEP In A Low Bandwidth Environment

https://www-secure.symantec.com/connect/articles/tips-installing-sep-low-bandwidth-environment

You can set gup "branch server 1" to same clients network of branch server 1 and "branch server 2" to same clients network 2.

(Use the location to define the gup, for this configure 2 location. One for each gup according to the network)

i already configured branch server1 as GUP for that branch but clients are yet not updated.... , the sharedupdate folder created in GUP machine but it shows empty....

Get the sylink logs from the GUP Client

i am attaching the sylink log

Attachment(s)

sylinklog_3_0.txt   8 KB 1 version

10/14 13:04:31 [2816] <GetGlobalIndex:>SMS return=500
10/14 13:04:31 [2816] <ParseHTTPStatusCode:>500=>500 INTERNAL SERVER ERROR
10/14 13:04:31 [2816] HTTP returns status code=500
 

http://www.symantec.com/business/support/index?page=content&id=TECH96531&locale=en_US

how to check the version of current SEPM

open SEPM console and click on the About click on the top right side of the SEPM console.

my SEPM version is 11.0.5002.333    is it RU5 or RU6 ?

can we update this version to 11.0.6

it is RU5, the current version is RU6 MP1. FOr that you need to upgrade first to RU6/RU6a and then to RU6 MP1.

here is the text

Migration paths

Symantec Endpoint Protection 11.0.6100 (RU6 MP1) can migrate seamlessly over the following:

Symantec Endpoint Protection 11.0.6000.550 (RU6) and 11.0.6005.562 (RU6a).

URL

http://www.symantec.com/business/support/index?page=content&id=TECH137982&locale=en_US

For upgrading ro RU6 (11.0.6) refer this KB.

Migrating to Symantec Endpoint Protection 11.0 RU6

After migrating to RU6 you can migrate to RU6MP1 also.

Migrating to Symantec Endpoint Protection 11.0.6100 (RU6 MP1).

Remember that you have to upgrade both clients and SEPM for getting the exact advantages of upgrading.

Make sure you migrate your SEPM and Clients to 11.0.6 RU6a then to RU6aMP1

thanks guys i will work on it....

if i change the Data folder to its default location, i must update the defenition manually or not?...

You mean SEPM data folder?I think it is not required .Any way have a check after installing.

what about the definition updates..

I am attaching the sylink log... plz check it if it contain any errors...

Attachment(s)

sylinklog_4.txt   61 KB 1 version

no errors as such, client is running 07/04/2010 Rev.33, may be it will request full update from SEPM( though the request is not captured as it was stopped early)

also it does not show client communication with GUP in logs

172.16.9.2--> is this client itself  the GUP?

if it is 128kbps how much time it will take for full update??

what is mean by "LU item not ready - skipping download"

yes the client itself is GUP

not sure the time taken, however 90 MB is the full definition size.

are you using the IE 9, if yes you need to downgrade as it has some issue updating the SEP client machines.

ok, you may need to wait for some more time for definitin to download in that case as the SEPM has 17/10/2010 definition, and considering you may not have kept more number of revision; the download will full and it will take sometime.

Or can you manually update the system using the jdb file.

im using IE6...

where did you see this message "LU item not ready - skipping download"?

on the client side or on the LUA ?

shown in the sylink.log which is generated from the GUP

hi, if you are referring to sylink logs posted,

10/18 12:44:08 [2836] SyLinkDeleteConfig => Deleting instance: 0134E178
10/18 12:44:08 [2836] <LUThreadProc>LU item not ready - skipping download.

there is instance created and has been deleted but i could not make for the content it has skipped..

10/18 12:44:16 [4956] <MaintainPushConnection:>http://192.168.1.111:8014/secars/secars.dll?h=8917B8F5BCD45652FE1D0218CD0B7D340C7437BCAE8131367206E033CF5E949F7DBD25F53058948542EAD8DFAA0579F136591AE4E893E8375AA1FCFDEC798288398A512A76557E79422A69CB90F68E2D0D298DE34B71CA174E0D838ADBFF0F9521E14B213AE91862632D4C253A5980EEDA7201C07B366405AACF83E8382300F32B5F7BDFF84E6CA99F5FE999DA1372E3A6B6FAE6A13C22FB4B6625695B1E326C774FCDBDBE83E8A32306AA6CD7592EC2617DD4B94A5BBE6CF1BD91C6504527F7A1F0F422A52A72C2FDBA30D961C1655E7EB4F650027CF455716E0A56B2A6C86122FF2FDCCD6728C1165E89D73A43C3A06DDC33FDD33BE380CE389DA0075E1739BF1B309D3669E72410678F2F651C20B2
10/18 12:44:19 [2828] <CSyLink::mfn_DownloadNow()>
10/18 12:44:19 [2828] </CSyLink::mfn_DownloadNow()>
10/18 12:45:08 [2836] SyLinkCreateConfig => Created instance: 0133B998
10/18 12:45:08 [2836] Importing ConfigObject: 01E124F0 into: 0133B998
10/18 12:45:08 [2836] <LUThreadProc> Got ConfigObject to proceed the operation.. pSylinkConfig: 0133B998
10/18 12:45:08 [2836] <LUThreadProc>Starting LU download.
10/18 12:45:08 [2836] SyLinkCreateConfig => Created instance: 0134E178
10/18 12:45:08 [2836] Importing ConfigObject: 01E124F0 into: 0134E178

Do you reconfigured the server and changed the data location to default place?

one branch successfully updated... but the other branch which i attached the sylink file has not updated till now.....

yes..and the sylink log from the GUP after the reconfiguration is attached...

Attachment(s)

sylinklog_5.txt   61 KB 1 version

Wait for some time and observe.Whether  new files are appearing in shared updates folder?

can you check what is value on the GUP machine???

HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\Content\{C60DC234-65F9-4674-94AE-62158EFCA433}\CurrentSequenceNum

0x00000001

only one file GUP.dat

its sound odd, can you check on the other GUP machine which is been updated, whether it has the same entry. If i compare with my machine , it is different.

no other machines are updated in this group ....this machine still have the old signatures 07/04/2010 and this is the gup all other systems having the update 11/10/2010 which i updated manually...but i cant update the gup machine with the downloaded update .....i'll check other group and update

usually the entry should be the definition version like "101017003"

Are you using a dynamic GUP list of the single GUP settings?

Are the clients all RU5 or above?

Below RU5 the you can only use a single GUP per group.

RU5 and above added support for dynamic GUP's based on computer name wildcards, IP address, registry key, Operating systems, etc.

On RU5 and above a SEP client checks its own IP address and subnet mask and will only get updates from GUP's that fall in the same range.

Attach the scm-server-0.log which is present in Program Files \Symantec\Symantec Endpoint Protection Manager\tomcat\logs

What files do you see under  C:\Program Files\Symantec\Symantec Endpoint Protection\LiveUpdate\?

What is the size of these?

No files in Live update...

attaching file

Attachment(s)

scm-server-0_20.txt   1 KB 1 version

single gup, all clients are RU5

not much of information..:-(

however did you compare the registry values from this machine to working machine :-), is it different?

Look like a bug in RU5 which is fixed in RU6.Any way just change something in the LU policy which is corresponding to that problematic branch.?

Do you see 9 byte dax file under  SEPM\Inetpub\content\{C60DC234-65F9-4674-94AE-62158EFCA433}

three folders in SEPM\Inetpub\content\{C60DC234-65F9-4674-94AE-62158EFCA433}, inside the folders there are some *.dax files the size is around 500kb

sounds to be okay, these are the delat file generated. do you still see full and full.zip files?

One folder Full and file full.zip

Why cann't you try for upgrading?

Upgrade SEPM and problematic branch clients to RU6 .

Migrating to Symantec Endpoint Protection 11.0 RU6

thanks, it means there is no issue with the SEPM.

did you get a chance to compare the registry entry from working GUP to non working GUP

HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\Content\{C60DC234-65F9-4674-94AE-62158EFCA433}\CurrentSequenceNum

if i upgrade to RU6 how can i upgrade the exsiting branch clients?

not yet the branch is located at next district... line speed is 64kbps ...yes i will look in to it. thanks

You can use auto upgrade feature .For more information refer the KB in the earlier post

Also have look at this article

How to Auto-Upgrade Remote Site Clients using IIS

Hi,

Check wither your GUP is properly communicating with your SEPM server. You can check this by analyzing the SEP logs on your GUP.

Is your GUP is Updated, and check wither Xdelta files are downloaded by your GUP.

is there any monitoring tool to identify that client machines are updating

some of my Branch client computers are trying to contact the management server... this makes the line speed very slow.. is there any way to block this..

check this download

https://www-secure.symantec.com/connect/downloads/sep-content-distribution-monitor

clients need to connect to SEPM for policy updates, however for content update you need to assign GUP at the remote location.

helpful links

http://www.symantec.com/business/support/index?page=content&id=TECH96419&locale=en_US

http://www.symantec.com/business/support/index?page=content&id=TECH95353&locale=en_US

http://www.symantec.com/business/support/index?page=content&id=TECH102541&locale=en_US

which port GUP connects the management server...

GUP connect to IIS Hosted port on SEPM, but client will connect GUP on port 2967

is there any Third party Management tools to get contents

LUA is the other option for an source to update.

you need to point the clients/SEPM to LUA to get the updates.

"some of my Branch client computers are trying to contact the management server... this makes the line speed very slow"---All client will contact SEPM for updating its status,for uploading logs,For policies etc..But it will not create much traffic.The major part of the traffic will be updates.Only GUP will be downloading it.have a look at this link

How to confirm if Clients are receiving LiveUpdate content from Group Update Providers (GUPs)

8014 port ?

I am not getting what exactly you mean.8014 port is used by clients(including GUP) to contact SEPM.....

by default the SEPM site is hosted on 8014, you can right click on IIS manager and check for the port the SEPM is open.

from the earliler read logs, your SEPM is on port 8014

http://192.168.1.111:8014

is there any option to shedule time that GUP will contact Management server...

No it is not possible.

But you can limit bandwidth

Have a look at this article...

Tips for installing SEP in Low Band width.

you cannot schedule time, you can set the bandwidth

http://www.symantec.com/business/support/index?page=content&id=TECH96419&locale=en_US

after configuring GUP in the branch... still problems... some of the clients systems are not showing full updates only the branch server and one or two clients systems..

Total branch  - 20

15 clients systems per branch

can you post the sylink logs from the client machine not updated through GUP?

Have you looked at the GUP distribution monitor? It might help get some insight as to the GUP status?

Also to clarify, these systems that aren't updating are on the same subnet and port 2967 is open?

Did you check the Windows Firewall? Make sure either by GPO or by manually adding rules for the SMC service (SMC.EXE)?

GUP Distribution Monitor:

https://www-secure.symantec.com/connect/downloads/sep-content-distribution-monitor

problems in updating definitions in 64kbps line branch.. is their any way to push live update files from a ftp server to the client sever system. is there any way to download the full.zip files from the symantec server

@van

Not that I know of, for the GUP to push out updates, the updates need to come from the SEPM.  So you can't use ntelligent updater to install the latest defs either.

Is your GUP not getting updated?

some of the client systems are not getting updated... server get updated but some clients does'nt.

:-), may be the sylink logs would give the reasin for failure.

@Van,

Is the GUP on the inside lan and the same subnet as the clients that are not updating?

I'm sorry if this was answered before, what what OS is the GUP? Is it a server OS?

After some effort GUP successfull working... thanks for helping me guys.. thanks all of u.......

Special thanks for Prachand   pete_4u2002 AravindKM and Vikram Kumar

Happy to hear that your problem got solved..