Configuration changes aren't applied to McAfee Agent through a Cisco firewall

Technical Articles ID: KB72227
Last Modified: 2023-06-07 06:18:53 Etc/GMT

Environment

ePolicy Orchestrator (ePO) 5.x
McAfee Agent (MA) 5.x

Cisco firewall or Cisco firewall module

Problem

Communication between ePO and MAs is disrupted when a Cisco firewall exists between the ePO server and MAs.

Though it seems like the agents are communicating, configuration changes aren't applied and tasks aren't propagated to the agents.

If this issue occurs, communication disruption occurs only with traffic that flows through the Cisco firewall. Communication that doesn't flow through the Cisco firewall isn't affected.

The agent_<host name>.log file records the following errors:

E	#3956	NaiInet	Error trace:
E	#3956	imsite	[uploadFile,,/spipe/pkg?AgentGuid={914B2B03-E32C-4978-96F7-A2D9E2A8537F}&Source=Agent_3.0.0,pkg00129520021341710000_2215.spkg,C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Unpack,C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Unpack\pkg00129520021343750000_17713.spkg]->
E	#3956	NaiInet	Socket read timed out after: 600 secs
E	#3956	imsite	Error trace:
E	#3956	imsite	[uploadFile,,/spipe/pkg?AgentGuid={914B2B03-E32C-4978-96F7-A2D9E2A8537F}&Source=Agent_3.0.0,pkg00129520021341710000_2215.spkg,C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Unpack,C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Unpack\pkg00129520021343750000_17713.spkg]->
E	#3956	imsite	NaInet library returned code == -13
E	#3956	imsite	Error trace:
E	#3956	imsite	[uploadFile,,/spipe/pkg?AgentGuid={914B2B03-E32C-4978-96F7-A2D9E2A8537F}&Source=Agent_3.0.0,pkg00129520021341710000_2215.spkg,C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Unpack,C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Unpack\pkg00129520021343750000_17713.spkg]->
E	#3956	imsite	NaInet library returned code == -13
E	#3956	imsite	Error trace:
E	#3956	imsite	uploadFile,,/spipe/pkg?AgentGuid={914B2B03-E32C-4978-96F7-A2D9E2A8537F}&Source=Agent_3.0.0,pkg00129520021341710000_2215.spkg,C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Unpack,C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Unpack\pkg00129520021343750000_17713.spkg]->
E	3956	imsite	The naInet library returned an error. [Parent error: NaInet library returned code == -13]

Cause

Cisco firewall is inspecting traffic between the ePO server and the agents:

ePO is configured to use default ports (port 80 for agent-server communication intervals (ASCI)) and has disabled encryption (Secure Sockets Layer (SSL)).
HTTP packet inspection is enabled on the Cisco firewall.

The Cisco firewall detects the Secure Pipe (SPIPE) traffic as malformed HTTP traffic. It drops the packets, which results in a lack of communication between ePO and the agents.

Solution 1

Enable SSL for the ASCI.

Solution 2

Change the default ASCI port from 80 to a dedicated port that's not used by any well-known protocol.

Knowledge Center

Configuration changes aren't applied to McAfee Agent through a Cisco firewall

Environment

Problem

Cause

Solution 1

Solution 2

Workaround

Affected Products

Languages:

Title

Title

Knowledge Center

Configuration changes aren't applied to McAfee Agent through a Cisco firewall

Environment

Problem

Cause

Solution 1

Solution 2

Workaround

Affected Products

Languages:

Choose your region

Title

Title