McAfee vscan connection terminates

[mheimberg]

System configuration:

McAfee version for storage 1.0

on Windows Server 2008 SP2

directly connected to storage1 (10.x.x.x)

with Ontap 7.3.2P3

another storage connected via network (129.x.x.x)

with Ontap  8.0.1P3 7-mode

Vscan on the direct connected storage works fine

Vscan on the network connected storage says

"

Thu May 26 14:02:32 CEST [storage2: vscan.server.connecting.successful:info]: CIFS: Vscan server \\vserver registered with the filer successfully."

and 10 minutes later

"

Thu May 26 14:02:32 CEST [storage2: cifs.server.infoMsg:info]: CIFS: Warning for server \\vserver: Connection terminated.

Thu May 26 14:02:32 CEST [storage2: vscan.server.connectError:error]: CIFS: An attempt to connect to vscan server \\vserver failed [0xc000005e]."

We have registered the same domain user on the storage as given in the McAfee plug in (group Administrators), NetBios is enabled, the NTAPVSRQ pipe is allowed anonymous access and configuration was checked against KB2011317....

SMB2 is disabled on both storage systems.

Any hint why the storage is not able to communicate with the vscan server?

Thx

Markus

[brauntvr2swiss]

Hi Markus

Perhaps the following helps:

Changes in security settings from Windows 2003 to Windows 2008.

1. Go to Local Security Policy > Local Policies > Security Options.

2. look for “Network access: Let Everyone permissions apply to anonymous users”.

3. Change this policy from disabled to enabled.

4. Restart the Server.

Greetz

Thomas

[mheimberg]

This option was already enabled.

Thanks anyway.

Mark

[shaunjurr]

Do you have a firewall between the filer and the vscan server on the "not-directly connected" vscan-filer combination?

It might just be the dynamic opening in the firewall timing out after 10 minutes (if it happens pretty consistently after 10 minutes).  If you do have a fw between vscan server and your filer(s) this will probably be a continued source of headaches in the future and you probably really want to avoid this.

Good luck.

[mheimberg]

Would this also apply to the built-in Windows firewall?

AFAIK there is no FW, but I have to check (also status of Windows FW).

thanks

mark

[amarendranath]

Mark,

Even I am facing the problem.

Were you able to find any solution ?

thanks,

Amar

[mheimberg]

It seems that it was a bug in 8.0.1

We updated to 8.0.2 and everything is fine now.

Mark

[SAIDLOPEZ]

Hello Markus

We have the same problem,

After you updated to 8.0.2, have you experimented the problem again?

Thanks

[kukania13]

Hi Guys,

I had the exact same problem, update didn't work for me as well.

I am currently running version 8.7.0i

What worked for me was the following , after sniffing the connection to the mcafee server i noticed that the vscan is trying to access port 139;

on the default windows firewall on the "Inbound Rules" i added "New Rule" that allowed access on port 139 TCP ;

Once that happened everything started falling in place and working as it suppose.

Hope it helps you guys

_A_