To try to correct this issue:
- Modify the GTI policy settings in the following ways. Make the changes in ePolicy Orchestrator in the Endpoint Security Common Options policy. Click the Show Advanced, Proxy Server for McAfee GTI section:
- Try to use browser proxy settings.
- Try to manually specify a proxy server and configure user authentication. Try user authentication in each format below:
- domain/user
- user@domain.com
- Verify the value for Network security: LAN Manager authentication level. This value is found in Control Panel, Admin Tools, Local Security Policy, Security Settings, Local Policies, Security Options. Set this value to Send LM & NTLM – use NTLMv2 session security if negotiated.
- Check whether SSL inspection is used. ENS Web Control doesn't work if packets to the GTI server are SSL-inspected. Configure an exclusion for SSL traffic to sae.gti.mcafee.com. You can find IP addresses for available servers of sae.gti.mcafe.com by doing an nslookup on saelist.gti.mcafee.com. These IP addresses aren't static and can change.
- Perform the following basic connectivity checks:
- DNS check (using nslookup) for resolution of sae.gti.mcafee.com.
- Connectivity check (telnet on the configured proxy port) for any proxy system.
- Connectivity check (telnet on port 443) for sae.gti.mcafee.com.
- Connectivity check (telnet on port 443) for tunnel.web.trustedsource.org.
NOTE: If your firewall requires authentication, ENS Web Control can't provide those credentials to the firewall; it can only provide them to a proxy. You must configure the firewall to
not require authentication to
sae.gti.mcafee.com.
If none of these troubleshooting steps resolve the issue, perform the following steps to collect diagnostic data for Technical Support:
- Make sure that debug ENS Web Control logging is enabled in the Endpoint Security Common Options policy when you reproduce the issue.
- Download and run the Minimum Escalation Requirements (MER) tool. For detailed instructions on how to run the MER tool, see KB59385 - How to use MER tools with supported Trellix products.
- Download and run Wireshark to obtain a network trace at the same time the debug logs are generated.
- Note the version of the proxy and the type of authentication used. Determine whether the proxy decodes SSL traffic. SSL traffic inspection doesn't allow Web Control to get a GTI rating.
- Note the proxy settings in the web browser and how the proxy is configured. For example, automatically detect settings, the PAC file, or a manually specified proxy.
- Note the ENS Common Options policy values for proxies.
- Contact Technical Support.
- If you are a registered user, type your User ID and Password, and then click Log In.
- If you are not a registered user, click Register and complete the fields to have your password and instructions emailed to you.
