I have installed the EPO agent on a server 2003 with the configured LAN IP 18.104.22.168. But the EPO shows the IP 127.0.0.1:
I have also updates the view using "Collect and Send Props" Button within the "McAfee Agent Monitor" on the server. No Result.
I also reinstalled the EPO agent, but the IP 127.0.0.1 appears again! The locale windows firewall is OFF.
What can I do to solve this IP problem?
Does the server have multiple network cards?
If so check MacAddress within HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Agent\ to see which NIC is registered to ePO.
You may find that you have the primary NIC set to the other network card. To check/change this in 2003 do this
1. Open Network Connections
2. Click Advanced from the explorer window menu
3. Click Advanced Settings
4. Now you should see a list of Network Connections and the order they are used. Set the correct network connection to the top of the list.
5. You then need to restart McAfee Framework service and send and collect props
thank's for the answer. This server has installed only one NIC:
The current REG setting on this server is:
Can I change the "IPAdress" setting in HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Agent\ from 127.0.0.1 to the current IP address 172.22.169.246? IPCONFIG shows the current configured IP address 172.22.169.246.
But why the locale host IP 127.0.0.1 is currently be used by the McAfee agent?
You can't just change the reg file it will get overwritten when you click collect and send props, because its the XML file nextprop that has the information.
Just out of curiosity if you restart the McAfee Framework Service but not the server does this temporarily fix the issue until a reboot?
I have restartet der McAfee Framework service and "Collect and Send Props" again. The IP 127.0.0.1 is the current shown agent IP.
I have also restarted the server and "Collect and Send Props". The IP 127.0.0.1 is the current shown agent IP.
If I "reactivate" the server using the EPO console, the props will be updates. But Iif I open the agent log, I see the agent log of my current client PC. It means the "reactivate" function in EPO works and connects to the server, but the agent log viewing shows the agent log of my desktop PC, using the localhost IP.
One hint: The serbver is a VMWare client machine like the other servers.
What can I do or check next?
You can check the agent log file but it probably won't show anything because it looks like a case of McAfee Agent is getting what it believes to be the correct information.
C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\DB\Agent_*Computername*.log
A successful line will be something like "Collecting IP address using Internet Manager"
thanks for your answer. I have done the following. I set the server IP in the registry to the correct IP. Then I "Collect and Send Props" in the server. The agent logfile shows the following information (see attached file Agent.log). The 10.10.10.10. is the IP of our EPO server.
After this procedure the IP of the server in the registry was set to the wrong IP 127.0.0.1. I get crazy ...
The agent gets the IP address information from the operating system, using very standard methods. Clearly here it is not getting a valid answer, or it's being given the loopback address. I'd open a support case for this one as it'll require further investigation.
Does it use API call to get the information using Iphlpapi.dll or WMI call?
Janni has tried WMI and windows is reporting correctly.
Janni - If its API you might want to log a call with McAfee, maybe they have a little tool to replicate the IP address call.
IanMessage was edited by: IanH on 24/01/11 15:57:34 GMT
It's actually an API call - the agent uses a slightly convoluted method to get the address, as it's trying to identify the IP address that is capable of communicating with the server (to handle multi-nic machines.)