HIPS blocking CAC log on to the SIPRnet

[Former Member]

I have two terminals that are having issues with CAC sipr token log on, essentially they are seemingly being blocked by HIPS. I noted the following message in the HIPS logs: Traffic  [information removed by admin]  local security process is...Blocked out going UDP source  [information removed by admin]  Destination [information removed by admin] : LDAP 389 BLOCK ALL TRAFFIC (Keep on bottom).  I get the following error message form the log in screen: We cant sign you in with this credential because your domain isnt available, make sure you are connected to your organazations network...   This issue was fixed for about 15 minuets after  common ports were set to both directions.   Any thoughts?? 

[ktankink]

This appears to be blocked network traffic by the HIPS Firewall.  You would have to ensure that your Firewall is properly configured with the right rules (as needed and designed by customers) to allow the traffic as needed.  In your Firewall Rule policy, you have a BLOCK ALL TRAFFIC matching (which is not needed since the HIPS Firewall already "blocks all unless allowed" functionality rule), which means no other Firewall rules above it matched exactly.

• If you didn't have any Firewall rules to allow that traffic, then you'd have to add a rule(s).
• If you did have a Firewall rule to allow it, then I would suggest contacting McAfee Support to have the blocked network traffic and your firewall policies reviewed further to find out why the existing rule wasn't working (e.g., might be misconfigured, etc.)