DAT download blocked by SonicWALL Gateway scanning

Technical Articles ID: KB58039
Last Modified: 2022-11-21 15:56:11 Etc/GMT

Environment

ePolicy Orchestrator (ePO) 5.x

SonicWALL PRO Series Firewall and VPN
Any Firewall or Gateway product

Problem 1

ePO Repository Pull task fails.

The Task Log file records the following Repository Pull tasks errors:

ERROR: Failed to download file Current\(...)\0000\dat-XXXX.zip from site ftp.nai.com:21, error code 10054
(An existing connection was forcibly closed by the remote host)

Problem 2

The EpoApSvr.log displays the following:

E #5536 naInet FTP session 1 socket 8128 RecvTimeout() failed on recv, WSAGetLastError() = 10054
E #5536 naInet FTP session 1 socket 6416 RecvTimeout() failed on recv, WSAGetLastError() = 10054
E #5536 naInet FTP session 1 Socket error occurred: 10054
I #5536 SIM_InetMgr Download file dat-4670.zip failed in session 1, nainet ret=0
e #5536 SiteMgr CheckInMirrorPackage: Download file dat-4670.zip from site McAfeeFtp::Current\VSCANDAT1000\DAT\0000 failed, hr=-2147467259
I #5536 McUpload Start http session login...
I #5536 McUpload End http session login, status=0
I #5536 McUpload Http response status code = 200
I #5536 naInet HTTP Session closed

Problem 3

Antivirus scanning is enabled on the firewall or gateway.

Cause

The gateway is triggering on our DAT (.zip) or (.tar) file because the ReadMe.txt file contains the EICAR antivirus test string (www.eicar.com).

NOTES:

Products other than SonicWALL can cause the same issue with the DAT download.
Any AV Gateway that incorrectly detects the EICAR test string as part of another file triggers on the DAT ZIP file.

To verify the issue, do the following:

Confirm the current DAT version on our Security Updates site.
Open Internet Explorer on your ePO server, copy the following URL, replacing the XXXX with the correct numbers for the current DAT version:

https://update.nai.com/Products/CommonUpdater/Current/VSCANDAT1000/DAT/0000/avvdat-XXXX.zip
The download progresses until it reaches 99%, and then displays the following error:

Internet Explorer cannot download avvdat-XXXX.zip from update.nai.com.
The connection with the server was reset.

The above message confirms that the download of the DAT file is intercepted or corrupted.

Solution

Disable detection of the EICAR test file on the SonicWALL Firewall:

Connect to the web configuration for the SonicWALL Firewall.
Click Security Services, Gateway Anti-Virus. Configure Gateway AV Settings.
Click Disable detection of EICAR test file.

NOTE: Or, add update.nai.com to the Gateway AV Exclusion List:

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

DAT download blocked by SonicWALL Gateway scanning

Environment

Problem 1

Problem 2

Problem 3

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

DAT download blocked by SonicWALL Gateway scanning

Environment

Problem 1

Problem 2

Problem 3

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title