topic Re: App-ID Mismatch for symantec-endpoint-manager in General Topics

App-ID Mismatch for symantec-endpoint-manager

chrislss — Wed, 01 Nov 2017 19:31:32 GMT

Is there any experience with 'symantec-endpoint-manager' over tcp/8014 being mis-identified as web-browsing?

We have a 5260 firewall in a datacenter environment, with hosts that need to access a Symantec-Endpoint-Server for AV updates. Clients access the server on port tcp/8014. Tha pport is associated with app-id 'symantec-endpoint-manager' per the app-id with SSL and web-browsing dependencies. A policy rule was created for the client to server communication with the three app-id's using the 'application default' ports.

When the clients attempt to access the server, they are blocked by the inter-zone rule, with tcp/8014 identified as 'web browsing'. At this point an application override has been created allowing tcp/8014, ideally we'd like to use the built-in rule to permit the traffic through.

Any input that can be provided by the community would be appreciated.

Re: App-ID Mismatch for symantec-endpoint-manager

Feldiasti — Thu, 02 Nov 2017 08:29:49 GMT

Hi chrislss,

which version of PAN-OS you'r using in PA 5260 firewall ?

Re: App-ID Mismatch for symantec-endpoint-manager

chrislss — Thu, 02 Nov 2017 18:57:14 GMT

The latest release, 8.0.5, is being used. App/Threat update release is 745-4296 (10/24/17).

Re: App-ID Mismatch for symantec-endpoint-manager

Feldiasti — Thu, 02 Nov 2017 19:29:34 GMT

If there is an application default configured as a service on the Security Policy that allows symantec-endpoint-manager traffic, the Palo Alto firewall will deny web browsing traffic on destination port 8014.

There are two possible resolutions:

1- Allow any service in the Security Policy.

2- Allow web browsing traffic on destination port 8014.

for more details kindly find below URL:

https://live.paloaltonetworks.com/t5/Management-Articles/Symantec-Endpoint-Protection-Manager-SEPM-Uses-Web-Browsing/ta-p/53224

Re: App-ID Mismatch for symantec-endpoint-manager

chrislss — Thu, 02 Nov 2017 19:49:32 GMT

Thank you! I have to say i don't like the solution, but that definitely explains the issue. Appreciate the reference.

Chris