HIPS Firewall broken Sessions (Firewall dropping connection/session)

[theglot]

Got a fun one.  After the ENS OCT update, SYSCORE caused some strange things.   Now I am seeing the HIPS Firewall have an inbound connection and ID the application, IP/Port local and IP/Port remote, but then see another rule fire for the outbound traffic but without the Application.  A bad thing when you are doing port white-listing via application, port and IP.  On our new server, managed by the same ePO with the same modules and policy,  I see the inbound traffic with application/ip/port as excepted/normal with no outbound traffic (as excepted/normal).   Am I'm on the right track with thinking its a corrupt SYSCORE?

[Solidcore]

Thanks for raising your question here in the community forum,

The ENS OCT update SYSCORE does not conflict with HIPS SYSCORE,

Suggest you to check the compatibility KB of HIPS with other McAfee products.

https://kc.mcafee.com/corporate/index?page=content&id=KB70778

I suggest you to start troubleshooting from the beginning to isolate suspected component in HIPS blocking the traffic.

https://kc.mcafee.com/corporate/index?page=content&id=KB54960

We know very well HIPS works as implicit block and explicit allow,  The traffic will be allowed when it matches the rule, If the rule is already in place.

Also check in local HIPS console the Firewall rule is enforced.

Put the machine in Adaptive mode (rules are learned automatically) and check if blocked traffic is allowed.

Automatically if the Adaptive mode allows the traffic then you can configure the new adaptive rule to allow the inbound traffic.

Was my reply helpful?

If you find this post useful, Please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!