Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a user that gets blocked from the internet periodically due to a setting within Symantec Endpoint Protection . The warning he gets is similar to:

Traffic from IP address 192.168.1.1 is blocked from 11:53pm to 12.03am.
Denial of Service is logged.

Has anyone heard of this before, or have any insite as the where the problem may lie? I checked the Symantec Endpoint Protection logs, but I was unable to find any blatant issues. The user states that it generally happens with malformed URL's, but I am unable to reproduce it at our help-desk.

share|improve this question

1 Answer 1

up vote 0 down vote accepted

Assuming you meant SEP rather than Backup Exec.

This indicates that there is inbound traffic form the IP mentioned in the alert. As the user mentions, this is usually a malformed address or it is some sort of malware creating traffic.

There are some versions of SEP that see DNS traffic from the router as a DoS. This is typically found on a router that is doing DNS forwarding from an ISP. Common on home and small business devices.

Symantec Support has info on this and it is supposed to be addresed in a release RU6 MP1. Check your version to see if it is current.

You can create an exception but you would want to be sure the traffic is legitimate. This assumes a managed client.

To create an exception for Intrusion Prevention Policy to allow a specific ID:

  1. Open Symantec Endpoint Protection Manager console .
    1. Select 'Policies' tab.
    2. Under 'View Policies', select 'Intrusion Prevention'.
    3. Select Intrusion Prevention policy, and under 'Tasks' select 'Edit the Policy'.
    4. Select 'Exceptions' tab.
  2. Click on 'Add...' button.
    1. Search and select ID blocked.
    2. Click on 'Next>>' button.
    3. Change 'Action', from 'Block' to 'Allow'. Click on 'OK' button.
    4. Check if the exception edited has been added to 'Intrusion Prevention Exceptions' list.
    5. Click on 'OK' button for save changes in the Intrusion Prevention policy.
share|improve this answer
    
Yessir, SEP. I was working on our weekly backups while typing this up. –  Kruug Dec 28 '12 at 17:22
    
Will this allow the user to move to new networks where this may occur without having to set up a new exception? The user travels a lot and we're looking for a permanent solution. –  Kruug Dec 28 '12 at 17:26
    
You will need to configure Location Awareness to manage this issue a bit more There is some info here symantec.com/connect/articles/… –  Dave M Dec 28 '12 at 17:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.