2 Replies Latest reply on Feb 28, 2011 3:45 AM by harris_s

    HIPS 8 and ePO 4.5 Patch 3

    harris_s

      Has anyone successfully removed HIPS 7 from ePO and installed HIPS 8 in it's place?

       

      I've tried but feel something isn't quite right.

       

      To remove HIPS 7 I went to:

       

      Menu > Software > Master Repository and deleted all 3 HIPS instances (including Patch 8).

       

      I then removed the HIPS extensions by doing the following:

       

      Menu > Software > Extensions > McAfee > Host Intrusion Prevention then removing all extensions.

       

      After this I went through installing HIPS 8 by checking in the package HostIPS_Client800LML.zip, then installed the extension HOSTIPS_8000_45.zip.

       

      Now when I goto HIP Dashboard all the panes show 'This query cannot be displayed because it is in an invalid state.' apart from the last pane which is showing 'HIP: Top 10 NIPS By Source IP', although when I open these reports there are no systems attached to the threats.

       

      Another more worrying issue since installing HIPS 8 is that the system which has it installed is unable to connect to the ePO server, am getting an error in the McAfee Agent Monitor saying:

       

      Agent Subsystem > Agent failed to communicate with ePO Server.

       

      Am finding the administration of HIPS very difficult due to lack of documentation on this kind of issue.  Product and Installation guide doesn't seem to cover this strangely as I would of though migrating HIPS versions is done far more often that a clean install.

       

      Why is it never easy with McAfee (Sorry, mini rant).

       

      Hope someone can help,

       

      Thanks in advance.

       

      Message was edited by: harris_s on 25/02/11 10:23:46 CST
        • 1. HIPS 8 and ePO 4.5 Patch 3
          Kary Tankink

          Sounds like you did the uninstall/reinstall of the HIPS extension by the documented procedures in the HIPS 8.0 Installation Guide.  So I'm not sure why the (default?) HIP Dashboard would be failing.

           

          Another more worrying issue since installing HIPS 8 is that the system which has it installed is unable to connect to the ePO server, am getting an error in the McAfee Agent Monitor saying:

           

          Agent Subsystem > Agent failed to communicate with ePO Server.


          I would open a McAfee Service Request with the ePO Support team to troubleshoot this.  Can the system successfully ping/resolve the ePO server IP/DNS name?  I have not seen a HIPS 8 install cause this issue.  One circumstance where HIPS might cause the McAfee Agent to fail to communicate with ePO would be a HIP7 NDIS install failure, which might leave the system without network connectivity (but it would be more than just the Agent failing).

          • 2. HIPS 8 and ePO 4.5 Patch 3
            harris_s

            Hi,

             

            Am able to ping machine from ePO server and vice versa and NDIS driver seems to be ok.  Is there a cost associated with logging service requests with McAfee?