Endpoint Security Platform Errors

[aponjos613]

My EndpointSecurityPlatform_Errors.log it being filled with the following event:

mfefw(888.4736) <SYSTEM> blframework.FIREWALL.Error (_FcPpNotify.cpp:1588): CreateFile for System failed with 2

This entry is being created every few seconds.

[londonsec]

Have you tried disabling the firewall?  

We've found the integrated firewall in ENS has some potential issues which development is working on.  Especially if you're using Microsoft DirectAccess.  One thing we've done is to disable the ENS FW and just utilize the Windows FW using GPO.

If you want or need some additional assistance, I have an engineer who is fantastic with ENS FW issues.

Good luck,

Dennis

[YashT]

Hello @aponjos613 ,

We have an article referring to the error message you reported.

Endpoint Security does not work as expected with third-party software installed
Technical Articles ID: KB88302

This problem is known to occur when the third-party software Symantec Encryption Desktop is installed. The Firewall and Web Control modules do not work as expected.

The following errors display in the ENS Platform error log file:

53519      11/02/2016 01:54:30.308 PM    mfefw(2404.2948) <???????> blframework.FIREWALL.Error (_FcLeafRule.cpp:919): Failed to convert start 66.112.192.0/18 to FcIpAddress!
53520      11/02/2016 01:54:30.318 PM    mfefw(2404.2948) <???????> blframework.FIREWALL.Error (_FcLeafRule.cpp:894): Failed to convert 215.45.120.71 to FcIpAddress!
53521      11/02/2016 01:54:30.318 PM    mfefw(2404.2948) <???????> blframework.FIREWALL.Error (_FcLeafRule.cpp:894): Failed to convert 215.45.120.71 to FcIpAddress!

Solution

ENS provides an option to trust the third-party software and allow client systems to run its code within McAfee processes. If you want to trust the certificate of the third-party software, select Allow for the certificate in the certificate table.

[londonsec]

The problem is that ENS is creating the issue because of the internal ENS FW conflicting with Symantec's Encryption.  The easiest option at this point would be to disable the ENS FW and use the Windows FW which doesn't have these issues with Symantec Encryption.  Of course you could always just continue to try all the workaround options from McAfee...if you have the time and patience.

Good luck.

[aponjos613]

We don't have any of the 3 party software listed installed on this server.