cancel
Showing results for 
Search instead for 
Did you mean: 

ePo update pull failed

My newly installed ePO 4.6.6 could not update from the internet. I could browse the internet from the computer.

From the browser, i can connect to http://update.nai.com/products/commonupdater/cataolg.z

Below are the excerpts from the EpoAPserver.log.

20130405104835 I #06652 NAINETHTTP Session initialized
20130405104849 I #06652 NAINET   Connecting to HTTP Server using Microsoft WinInet
20130405104849 I #06652 NAINET   Trying to connect to Proxy Server isaserver-002:8080 using INTERNET_OPEN_TYPE_PROXY
20130405104849 I #06652 NAINET   Connected to Server: update.nai.com on Port: 80 using WinInet
20130405104849 X #06652 NAINET   Socket getting closed, Handle -1
20130405104849 I #06652 INETMGR  Started download session 1 for site McAfeeHttp
20130405104849 I #06652 SITEMGR  MirrorThreadProc: Downloading file catalog.z from McAfeeHttp
20130405104849 I #06652 INETMGR  Downloading file catalog.z from session 1, LocalDir=C:\Windows\TEMP\naiACAC.tmp\00000000, RemoteDir=
20130405104849 I #06652 NAINET   Open URL: http://update.nai.com:80/Products/CommonUpdater/catalog.z
20130405104849 I #06652 NAINET   Trying to download using Microsoft WinInet library
20130405104849 I #06652 NAINET   Conneting to Proxy Server isaserver-002:8080 using INTERNET_OPEN_TYPE_PROXY
20130405104849 I #06652 NAINET   No resume download needed, calling InternetOpenUrl
20130405104849 X #06652 NAINET   Internet status detecting proxy
20130405104849 I #06652 NAINET   Resolving name isaserver-002 to address
20130405104850 I #06652 NAINET   Name resolved to 10.10.X.X
20130405104850 X #06652 NAINET   Sending request
20130405104850 X #06652 NAINET   Receiving response
20130405104851 X #06652 NAINET   Response received
20130405104851 X #06652 NAINET   Receiving response
20130405104851 X #06652 NAINET   Response received
20130405104851 X #06652 NAINET   Receiving response
20130405104851 X #06652 NAINET   Response received
20130405104851 X #06652 NAINET   Receiving response
20130405104851 X #06652 NAINET   Response received
20130405104851 X #06652 NAINET   Receiving response
20130405104851 X #06652 NAINET   Response received
20130405104851 X #06652 NAINET   Receiving response
20130405104851 X #06652 NAINET   Response received
20130405104851 X #06652 NAINET   Internet status detecting proxy
20130405104851 X #06652 NAINET   Sending request
20130405104851 X #06652 NAINET   Receiving response
20130405104851 X #06652 NAINET   Response received
Response received
20130405104851 E #06652 NAINET   HTTP Server returned Error : 502
20130405104851 X #06652 NAINET   Closing connection
20130405104851 X #06652 NAINET   Connection closed
20130405104851 I #06652 NAINET   Failed to download the URL /Products/CommonUpdater/catalog.z using Wininet
20130405104851 I #06652 NAINET   Trying to download using windows socket library
20130405104851 I #06652 NAINET   Connecting to Real Server: update.nai.com on port: 80
20130405104851 I #06652 NAINET   Connecting to Proxy Server: isaserver-002 on port: 8080
20130405104851 X #06652 NAINET   Socket created, Handle 5796
20130405104851 I #06652 NAINET   Connected to Proxy Server: isaserver-002 on port: 8080
20130405104851 I #06652 NAINET   Authenticating Proxy Server with user: domain\username and password ***
20130405104851 X #06652 NAINET   Response Header: HTTP/1.1 407 Proxy Authentication Required ( The ISA Server requires authorization to fulfill the request. Access to the Web Proxy filter is denied.  )

20130405104851 X #06652 NAINET   HTTP Server returned status code 407
20130405104851 I #06652 NAINET   Proxy Server needs authentication, HTTP return code: 407
20130405104851 X #06652 NAINET   Response Header: Via: 1.1 ISASERVER-002

20130405104851 X #06652 NAINET   Response Header: Proxy-Authenticate: Negotiate

20130405104851 I #06652 NAINET   WWW Authentication Requested: Negotiate

20130405104851 X #06652 NAINET   Response Header: Proxy-Authenticate: Kerberos

20130405104851 I #06652 NAINET   WWW Authentication Requested: Kerberos

20130405104851 X #06652 NAINET   Response Header: Proxy-Authenticate: NTLM

20130405104851 I #06652 NAINET   WWW Authentication Requested: NTLM

20130405104851 X #06652 NAINET   Response Header: Connection: Keep-Alive

20130405104851 X #06652 NAINET   Response Header: Proxy-Connection: Keep-Alive

20130405104851 X #06652 NAINET   Response Header: Pragma: no-cache

20130405104851 X #06652 NAINET   Response Header: Cache-Control: no-cache

20130405104851 X #06652 NAINET   Response Header: Content-Type: text/html

20130405104851 X #06652 NAINET   Response Header: Content-Length: 4118 

20130405104851 X #06652 NAINET   Response Header:

20130405104851 E #06652 NAINET   Error sending authentication request to server, bytes to send 347, bytes sent -1, system error 502
20130405104851 X #06652 NAINET   Socket getting closed, Handle -1
20130405104851 I #06652 INETMGR  Download file catalog.z failed in session 1, nainet ret=502
20130405104851 e #06652 SITEMGR  MirrorThreadProc: Download file catalog.z from McAfeeHttp failed, hr=-2147467259
20130405104851 X #06652 NAINET   Socket getting closed, Handle -1
20130405104851 X #06652 NAISIGN  CServerKeyManager::UnloadKeys

These are the sitelist.xml excerpt. I observed that the username column has no servername despite having an entry on the epo proxy

Type="fallback"><RelativePath>Products/CommonUpdater</RelativePath><UseAuth>0</UseAuth><UserName></UserName><Password Encrypted="0"></Password></HttpSite><SpipeSite ID="handler_1" Enabled="1" Type="master" Name="ePO_SERVERNAME" Server="servername.domain.com:80" ServerIP="10.x.x.x:80" ServerName="SERVERNAME:80" Version="4.6.6" SecurePort="443"

Kindly assist

3 Replies
Tristan
Level 15
Report Inappropriate Content
Message 2 of 4

Re: ePo update pull failed

Your issue is with the ISA proxy server you have inbetween your internet and your ePO server and authentication.

You can browse the internet and visit update.nai.com because your browser is passing the correct username and password to the proxy server but for what ever reason ePO doesn't pass the credentials in a way ISA understands.

I've similar issue with ePO and our TMG Proxy (ISA 2010 to all intense purposes).

You have two options

1. Install the proxy client on your ePO server. This should handle the authentication correctly and allow ePO through.

2. Configure the proxy server to not require authentication for all McAfee update addresses.

Re: ePo update pull failed

Thanks Tristan

For option 1,are you referring to McAfee Client Proxy?

Tristan
Level 15
Report Inappropriate Content
Message 4 of 4

Re: ePo update pull failed

no the Mircosoft ISA proxy client

http://www.microsoft.com/en-us/download/details.aspx?id=10504

Message was edited by: Tristan on 05/04/13 13:45:32 IST