onprem Anti-Malware signature updates not working

[SWBW_Florian]

Hi there,

were having issues with our Harmony Endpoint Security onPrem installation. Especially with the Anti-Malware Signature Download on our Clients.

We have an onPremise Installation at version 81.20 and Clients at 87.62

We dont experience any issues with policy-distribution or communication between the clients and the management engine.

The Management engine (seen through SmartEndpoint) is also reporting an updated malware signature database at "Tools -> Anti-Malware Updates" with version 202401160600

If i chose to "update now" at a clients all policy downloads and installations are fine. Everything but the Anti-Malware update through our own server.

If configured to download the signature updates through the external server (zonealarm) the update is running, even seen through the ngfw, fine over the internet. But if i disable the external source the client wont update

"Anti-Malware couldnt get updated. No connection to server"

no blocks seen in the logfiles. I have no Idea where to look for the source of this

The installed client packages are created through the SmartEndpoint Software

Thanks in Advance

Florian

[PhoneBoy]

Have you opened a TAC case? https://help.checkpoint.com 
Might be necessary here to understand why this is happening.

[SWBW_Florian]

Hi PhoneBoy and thanks for your reply

will try there

[the_rock]

Have you tried with maybe a different version of the client to see if it makes any difference?

Best,

Andy

[SWBW_Florian]

because of another issue (high cpu usage on special server OS) we already have different client versions out in the field. Same issue there

regards

[JamicoG]

Hi Florian,

Were you able to get an answer for this issue? I get a lot of cases opened for the same issue recently.

[SWBW_Florian · Accepted solution]

hi there,

yes, we found the source of all that evil. Its about checkpoints E1 and E2 kind of versions of harmony endpoint client. Its a bit complicated. (DHS, evil russia and so on ... )

at first rollout you can only roll E1 versions out. After the first rollout you can deploy E2 version through the EPS management

E1 is evil, E2 is DHS conform and therefor onprem compatible

have a look here: https://support.checkpoint.com/results/sk/sk178307