Data Exchange Layer communication fails with an error: Detected invalid argument: Agent EPO guid does not match policy, ignoring policy

Technical Articles ID: KB95965
Last Modified: 2022-12-16 04:43:37 Etc/GMT

Environment

Data Exchange Layer (DXL) 6.x, 5.x
Trellix Agent (TA) 5.7.x, 5.6.x

Problem

When policy sharing is configured with on-premises ePolicy Orchestrator (ePO) and you share the TA policy to another on-premises ePO server or when you migrate policies using the MVISION Migration extension and migrate systems from on-premises to MVISION ePO, you see the following errors on the client dxl_service.log (in debug) from client systems when trying to establish a DXL connection:

[Debug] DxlPolicyWorker: Printing <guids> epoGuidMA={1551e842-6fa5-4f58-8f1e-38xxxxxx},epoid={1551e842-6fa5-4f58-8f1e-3862xxxxxx},
[Debug] DxlPolicyWorker: section=General, key=epoGUID, value={d76c739a-6d53-4730-b0e4-22xxxxxxx}
[Debug] DxlPolicyWorker: guidStr {d76c739a-6d53-4730-b0e4-22xxxxxxx}
[Error] DxlPolicyWorker: Detected invalid argument: Agent EPO guid does not match policy, ignoring policy

DXL communication stops and the above errors are logged when a communication from DXL is tried.

NOTE: For more information about policy sharing, see KB81771 - How to share policies across multiple servers in ePolicy Orchestrator.

Cause

The TA hasn't initiated a callback to update the new ePO server ID and retains the previous ePO server ID information. This causes the misconfiguration that's seen in the DXL log.

Technical Support is investigating this issue. If you experience this issue, log on to the ServicePortal and create a Service Request. Include this article number in the Problem Description field.

Workaround 1

Technical Support is investigating this issue. As a temporary measure, implement the following workaround.

IMPORTANT: Before you begin the process explained in this article, you must back up your ePO server. See the following KB articles for more information:

For policies that are shared with on-premises ePO Servers only:

Log on to the SQL Server that contains the ePO database as a user with appropriate permissions to run scripts.
Execute the following scripts on the ePO destination database:

The first script Discover_MA_Policies_With_Wrong_EPOGUID.sql identifies TA policies that have the wrong ePOGUID associated with them.

NOTE: If the above script doesn't return any results, you don't have the issue addressed by this article. Don't continue.
The second script Fix_MA_Policies_With_Wrong_GUID.sql resolves the incorrect server ID that's associated with them.

NOTE: Execute the script in off-peak hours on the SQL database that hosts ePO to avoid any latency issues.

Workaround 2

For MVISION ePO:

Duplicate ALL the TA default policies in the MVISION ePO console and assign the duplicate policy to the systems or groups that have experienced the DXL connection failure.

Log on to the MVISION ePO.
Click Menu, Policy, Policy Catalog.
Find and click the Agent policy section.
Find the McAfee Default policy
On the Actions tab to the right, click the dropdown and select Duplicate and assign a name to the policy.
Repeat these steps for the rest of the policy categories for TA.
Assign the policy to the computer and send an Agent wake-up call to apply the policy changes or wait for the next Agent-to-Server Communication Interval to take place.

Attachment

Discover_MA_Policies_With_Wrong_EPOGUID.sql
1K • < 1 minute @ broadband

Attachment ^(Secured)

Fix_MA_Policies_With_Wrong_GUID.sql
1K • < 1 minute @ broadband

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Data Exchange Layer communication fails with an error: Detected invalid argument: Agent EPO guid does not match policy, ignoring policy

Environment

Problem

Cause

Workaround 1

Workaround 2

Attachment

Attachment ^(Secured)

Affected Products

Languages:

Title

Title

Knowledge Center

Data Exchange Layer communication fails with an error: Detected invalid argument: Agent EPO guid does not match policy, ignoring policy

Environment

Problem

Cause

Workaround 1

Workaround 2

Attachment

Attachment (Secured)

Affected Products

Languages:

Choose your region

Title

Title

Attachment ^(Secured)