cancel
Showing results for 
Search instead for 
Did you mean: 

EPO agent shows localhost IP 127.0.01

Hi,

I have installed the EPO agent on a server 2003 with the configured LAN IP 172.100.50.5. But the EPO shows the IP 127.0.0.1:

IP_Setting.jpg

I have also updates the view using "Collect and Send Props" Button within the "McAfee Agent Monitor" on the server. No Result.

I also reinstalled the EPO agent, but the IP 127.0.0.1 appears again! The locale windows firewall is OFF.

What can I do to solve this IP problem?

Gregards Janni

15 Replies
IanH
Level 10
Report Inappropriate Content
Message 2 of 16

Re: EPO agent shows localhost IP 127.0.01

Does the server have multiple network cards?

If so check MacAddress within HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Agent\ to see which NIC is registered to ePO.

You may find that you have the primary NIC set to the other network card. To check/change this in 2003 do this

1. Open Network Connections

2. Click Advanced from the explorer window menu

3. Click Advanced Settings

4. Now you should see a list of Network Connections and the order they are used. Set the correct network connection to the top of the list.

nic.JPG

5. You then need to restart McAfee Framework service and send and collect props

Regards,

Ian

Re: EPO agent shows localhost IP 127.0.01

Hi IanH,

thank's for the answer. This server has installed only one NIC:

NIC.jpg

The current REG setting on this server is:

REG.jpg

Can I change the "IPAdress" setting in HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Agent\ from 127.0.0.1 to the current IP address 172.22.169.246? IPCONFIG shows the current configured IP address 172.22.169.246.

But why the locale host IP 127.0.0.1 is currently be used by the McAfee agent?

Regards Janni

IanH
Level 10
Report Inappropriate Content
Message 4 of 16

Re: EPO agent shows localhost IP 127.0.01

You can't just change the reg file it will get overwritten when you click collect and send props, because its the XML file nextprop that has the information.

Just out of curiosity if you restart the McAfee Framework Service but not the server does this temporarily fix the issue until a reboot?

Regards,

Ian

Re: EPO agent shows localhost IP 127.0.01

Hi,

I have restartet der McAfee Framework service and "Collect and Send Props" again. The IP 127.0.0.1 is the current shown agent IP.

I have also restarted the server and "Collect and Send Props". The IP 127.0.0.1 is the current shown agent IP.

If I "reactivate" the server using the EPO console, the props will be updates. But Iif I open the agent log, I see the agent log of my current client PC. It means the "reactivate" function in EPO works and connects to the server, but the agent log viewing shows the agent log of my desktop PC, using the localhost IP.

One hint: The serbver is a VMWare client machine like the other servers.

What can I do or check next?

Regards

Janni

IanH
Level 10
Report Inappropriate Content
Message 6 of 16

Re: EPO agent shows localhost IP 127.0.01

You can check the agent log file but it probably won't show anything because it looks like a case of McAfee Agent is getting what it believes to be the correct information.

C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\DB\Agent_*Computername*.log

A successful line will be something like "Collecting IP address using Internet Manager"

Regards,

Ian

Re: EPO agent shows localhost IP 127.0.01

Hi,

thanks for your answer. I have done the following. I set the server IP in the registry to the correct IP. Then I "Collect and Send Props" in the server. The agent logfile shows the following information (see attached file Agent.log). The 10.10.10.10. is the IP of our EPO server.

After this procedure the IP of the server in the registry was set to the wrong IP 127.0.0.1. I get crazy ...

Regards

Janni

McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 8 of 16

Re: EPO agent shows localhost IP 127.0.01

The agent gets the IP address information from the operating system, using very standard methods. Clearly here it is not getting a valid answer, or it's being given the loopback address. I'd open a support case for this one as it'll require further investigation.

HTH -

Joe

IanH
Level 10
Report Inappropriate Content
Message 9 of 16

Re: EPO agent shows localhost IP 127.0.01

Hi Joe

Does it use API call to get the information using Iphlpapi.dll or WMI call?

Janni has tried WMI and windows is reporting correctly.

Janni - If its API you might want to log a call with McAfee, maybe they have a little tool to replicate the IP address call.

Regards,

Ian

Message was edited by: IanH on 24/01/11 15:57:34 GMT
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 10 of 16

Re: EPO agent shows localhost IP 127.0.01

It's actually an API call - the agent uses a slightly convoluted method to get the address, as it's trying to identify the IP address that is capable of communicating with the server (to handle multi-nic machines.)

HTH -

Joe