topic Re: onprem Anti-Malware signature updates not working in Endpoint

onprem Anti-Malware signature updates not working

SWBW_Florian — Tue, 16 Jan 2024 13:49:28 GMT

Hi there,

were having issues with our Harmony Endpoint Security onPrem installation. Especially with the Anti-Malware Signature Download on our Clients.

We have an onPremise Installation at version 81.20 and Clients at 87.62

We dont experience any issues with policy-distribution or communication between the clients and the management engine.

The Management engine (seen through SmartEndpoint) is also reporting an updated malware signature database at "Tools -> Anti-Malware Updates" with version 202401160600

If i chose to "update now" at a clients all policy downloads and installations are fine. Everything but the Anti-Malware update through our own server.

If configured to download the signature updates through the external server (zonealarm) the update is running, even seen through the ngfw, fine over the internet. But if i disable the external source the client wont update

"Anti-Malware couldnt get updated. No connection to server"

no blocks seen in the logfiles. I have no Idea where to look for the source of this

The installed client packages are created through the SmartEndpoint Software

Thanks in Advance

Florian

Re: onprem Anti-Malware signature updates not working

PhoneBoy — Fri, 19 Jan 2024 00:22:08 GMT

Have you opened a TAC case? https://help.checkpoint.com
Might be necessary here to understand why this is happening.

Re: onprem Anti-Malware signature updates not working

the_rock — Fri, 19 Jan 2024 00:27:29 GMT

Have you tried with maybe a different version of the client to see if it makes any difference?

Best,

Andy

Re: onprem Anti-Malware signature updates not working

SWBW_Florian — Fri, 19 Jan 2024 05:58:43 GMT

Hi PhoneBoy and thanks for your reply

will try there

Re: onprem Anti-Malware signature updates not working

SWBW_Florian — Fri, 19 Jan 2024 05:59:33 GMT

because of another issue (high cpu usage on special server OS) we already have different client versions out in the field. Same issue there

regards

Re: onprem Anti-Malware signature updates not working

JamicoG — Wed, 20 Mar 2024 07:54:38 GMT

Hi Florian,

Were you able to get an answer for this issue? I get a lot of cases opened for the same issue recently.

Re: onprem Anti-Malware signature updates not working

SWBW_Florian — Wed, 20 Mar 2024 13:18:17 GMT

hi there,

yes, we found the source of all that evil. Its about checkpoints E1 and E2 kind of versions of harmony endpoint client. Its a bit complicated. (DHS, evil russia and so on ... )

at first rollout you can only roll E1 versions out. After the first rollout you can deploy E2 version through the EPS management

E1 is evil, E2 is DHS conform and therefor onprem compatible

have a look here: https://support.checkpoint.com/results/sk/sk178307