cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Highlighted

GTI File Reputation Unreachable

Hi All,

I am getting alert on one sensor that GTI file reputation is not reachable.However I have configured same DNS server ip that are configured on other sensors on which GTI is woring fine.Now I have checked from sensor CLI and it tells me that GTI server connection in not ok and gti server is not initialized.Connection test from manager for sensors dns are ok.I want to ask Will I have to reboot the sensor to take new affect with new config of gti?

5 Replies
Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 6

Re: GTI File Reputation Unreachable

Hi ! @User27622125 

 

GTI file reputation errors are popped when the Sensor is unable to communicate to GTI Server over Port 53 UDP (DNS). Allow DNS traffic for the Sensor and error should be gone.

GTI Server connection Not Ok is for GTI IP Reputation. This feature works when Inspection policy is applied to the Sensor with correct configurations.

No, it is not required to reboot the Sensor for GTI configuration changes. These changes are pushed in real time to the Sensor.

 

Regards,
Faizan

Was my reply helpful?
If you find this post useful, please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!
Highlighted

Re: GTI File Reputation Unreachable

Kindly check in attached file and let me know what is the issue?Also is there any way to check port 53 from sensor cli?

Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 6

Re: GTI File Reputation Unreachable

Hi @User27622125 

This error indicates the Sensor is unable to communicate to GTI Server as DNS traffic hence  you are getting the faults. Kindly get the output of command show gti config and look for the GTI Server IP. The Sensor is trying to reach that IP over DNS channel. Allow the DNS traffic from Sensor to that IP and fault should be cleared.

If the GTI Server IP is public IP, try replacing it with your DNS server with command set gtiserver ip x.x.x.x and then monitor.

No, it is not possible to check the DNS connectivity from the Sensor via CLI because it requires backend access of the device.

 

I hope this answers your question.

 

Regards,
Faizan

Was my reply helpful?
If you find this post useful, please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!
Highlighted

Re: GTI File Reputation Unreachable

Hi Faizan!

I have tried to changed gti ip by setting command and sensor cli says that gti server connection is ok.At time of configuration sensor shows that gti server ip is my local dns server ip.But issue is after few minutes or hour gti server ip changed automatically from local dns ip to public ip of subnet 161.x.x.x and I also got following error given below:

 

Fault Detail
Fault Type: GTI File Reputation DNS Error
Source: srvlheklp01:Malware Artemis DNS Error
Condition Type: Unreachable
Alarm Type: Communication
Severity: Critical
Last Occurrence Time: 2020-Jun-09 09:19:25 GMT+05:00
Acknowledged:
Additional Text: Error connecting to local DNS server.
Creation Time: 2020-Jun-08 15:07:35 GMT+05:00

McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 6 of 6

Re: GTI File Reputation Unreachable

Hi @User27622125 

Once the GTI IP is configured manually it is unlikely to get changed automatically.

The error was reported because the Sensor couldn't connect to GTI Server IP 161.x.x.x over Port 53 UDP. Kindly allow the DNS traffic for Sensor and the error will be gone.

 

 

Regards,
Faizan

Was my reply helpful?
If you find this post useful, please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!
You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community