ENS Adaptive Threat Protection GTI connect on Port 443 & 80

[holzfuass]

Hallo,

we have a Problem that mfeasp.exe don't use our Proxy Ports with following adresses. They always try to connect to GTI over Port 443 or 80. Proxy is set on Endpoint Security Common Policy.

35.164.62.177 Port 443

35.163.60.223 Port 443

52.41.73.69 Port 433

35.164.235.110 Port 443

54.186.175.197 Port 433

52.24.226.0 Port 443

35.166.76.47 Port 433

104.18.21.226 Port 80

54.186.225.0 Port 443

This adresses are also not on this list: https://kc.mcafee.com/corporate/index?page=content&id=KB79640

Port 443 & 80 are blocked by Firewall, therefor we have Proxy Authentication. Is there a possibility to rout this adresses to Proxy Server, wich has Ports 8080 & 9090?

thks, Daniel

[sbluemel]

Hello Daniel,

Please confirm if you see also successful connections using the proxy settings. This currently sounds like the proxy is not used at all? Which proxy setting do you use in ENS?

https://docs.mcafee.com/bundle/endpoint-security-10.6.0-common-product-guide-windows/page/GUID-AC76C...

Please test it as simple as possible with a specific IP address and a port (no host names or VIP). If this starts working you can than continue with further tests like a host name. 

If you need assistance please file a service request with a MER from your test system. We need to review the ATP debug logs for connection attempts. This log will also show the proxy values used for the GTI requests. 

How to enable ENS debug logging:

https://kc.mcafee.com/corporate/index?page=content&id=KB89058

Kind regards,

Stefan