cancel
Showing results for 
Search instead for 
Did you mean: 

McAfee HIPS Firewall Status showing as "Unknown' in EPO Console

Hello Everyone,

We track compliance of McAfee EPP & EPE for many machines. While tracking down defects, we found out that that EPO console displays "Unknown" under Firewall Status (Host IPS) for few machines. Have googled for finding out the root causes or if there is any patch issue but found none. Did hit and trial with HIPS services, McAfee agent GUID regeneration. None helped. :-(

The McAfee agent is running properly on the machines and is reporting to EPO everyday. McAfee agent version is 4.8. Yet, the "Unknown" issue persists. Someone, please help out.

Thanks in advance!

12 Replies
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 13

Re: McAfee HIPS Firewall Status showing as "Unknown' in EPO Console

Try running the ePO Server task "Host IPS 8 Property Translator" task manually (leave it Disabled; just run it manually once) and see if the data gets updated properly.

epository
Level 10
Report Inappropriate Content
Message 3 of 13

Re: McAfee HIPS Firewall Status showing as "Unknown' in EPO Console

Did you have any luck figuring this issue out?

Re: McAfee HIPS Firewall Status showing as "Unknown' in EPO Console

No luck in this. "Host IPS 8 Property Translator" we run manually everyday. Issue got resolved automatically after few days and we do not know how it happened. I wish I knew.. :-(

epository
Level 10
Report Inappropriate Content
Message 5 of 13

Re: McAfee HIPS Firewall Status showing as "Unknown' in EPO Console

I hate it when EPO fixes itself...you just sit there waiting for the next time it freaks out...Smiley Sad

Earlier I posted a HIPS Product Codes dashboard here in the community, try importing that into your EPO and look at the

FWStatus value.

Also License Status, Service Running...etc....it may point to something.

Also Check the "Events" folder on your EPO to see if there are any events backing up.

epository
Level 10
Report Inappropriate Content
Message 6 of 13

Re: McAfee HIPS Firewall Status showing as "Unknown' in EPO Console

Here it is

kenobe
Level 10
Report Inappropriate Content
Message 7 of 13

Re: McAfee HIPS Firewall Status showing as "Unknown' in EPO Console

Thanks for the dash.  It's showing what my queries show - IPS Product status, Service Running Status, and Host IPS Status all show UNKNOWN.

This happened to one server but resolved itself after that one was rebuilt from scratch.  Now I have another server (on a totally different net) showing the UNKNOWN status.

Frustrating.

alhaawi
Level 9
Report Inappropriate Content
Message 8 of 13

Re: McAfee HIPS Firewall Status showing as "Unknown' in EPO Console

what about "Incoming firewall status"? is it enabled or disabled?

kenobe
Level 10
Report Inappropriate Content
Message 9 of 13

Re: McAfee HIPS Firewall Status showing as "Unknown' in EPO Console

UNKNOWN as well.

I know my policies are set to Enabled on both.  If I drill down into the individual systems within the ePO and look at Products, I can see both are Enabled.

Database corruption?

kenobe
Level 10
Report Inappropriate Content
Message 10 of 13

Re: McAfee HIPS Firewall Status showing as "Unknown' in EPO Console

I found in both cases after a MS SQL update got applied, the problem went away.  I'd like to include the actual update but I don't have access to the server console.