Jump to content
indrek

VPN connection problem with Endpoint Antivirus

Recommended Posts

Hello,

We're using ESET Endpoint Antivirus version 7.2.2055.0 (older 7.x versions affected too) and have random problems while connecting to our corporate Watchguard VPN. If I delete ESET completely, VPN is working OK. I added two vpn exe modules to to "Protocol Filtering" - "Excluded applications". I added our VPN IP address to "Protocol Filtering" - "Excluded IP addresses". I added also vpn address to "allowed url list".
Nothing helps, what else can be done?

 

Share this post


Link to post
Share on other sites

Does temporarily disabling Network attack protection or protocol filtering make a difference? Please open a support ticket with your local ESET distributor and provide them with details about the issue. Also enclose logs collected with ESET Log Collector after:
- enabling advanced network protection logging under tools -> diagnostics
- reproducing the issue
- disabling logging.

Share this post


Link to post
Share on other sites
28 minutes ago, Marcos said:

Does temporarily disabling Network attack protection or protocol filtering make a difference? Please open a support ticket with your local ESET distributor and provide them with details about the issue. Also enclose logs collected with ESET Log Collector after:
- enabling advanced network protection logging under tools -> diagnostics
- reproducing the issue
- disabling logging.

No, disabling network attack protection and protocol filtering does not help.
And, I see no "Diagnostic" under Tools. There are LogFiles, RunningProcesses, SecurityReport, WatchActivity but no Diagnostic.

Share this post


Link to post
Share on other sites

Thanks, I got it. I sent a logs but they most probably will not reply until Monday. I checked logs in GUI and it seems nothing was blocked at network level. HIPS log contains several "blocking" messages about VPN modules, but when I disable HIPS, nothing changes.

 

Share this post


Link to post
Share on other sites

I'm experiencing the same issue with ESET Endpoint 7.0.2091.0. Watchguard VPN works fine after uninstalling ESET. Tried excluding the program folder and exes within to no avail.

Share this post


Link to post
Share on other sites

As I wrote, the issue is being investigated. It could be because the VPN software injects as a WFP filter to filter network communication like ESET does and they clash together. Currently we are waiting for a response from users who raised a support ticket.

Share this post


Link to post
Share on other sites
8 hours ago, itman said:

Did you follow the procedure here: https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/services/tdr/tdr_exclusions_c.html?Highlight=exclusions to configure exclusion for Eset in TDR and in Eset to exclude WatchGuard directories?

We have no TDR, seems like it is some additional service. How to exclude WatchGuard directories in ESET  ?

Share this post


Link to post
Share on other sites
Posted (edited)

Actually, WatchGuard has a separate help article dedicated to configuring TDR when Eset Endpoint is installed: https://www.watchguard.com/help/docs/help-center/en-US/Content/Integration-Guides/TDR/eset_tdr.html . But as you posted, you don't have TDR installed.

Have you contacted WatchGuard about your issues with Eset Endpoint installed w/o TDR use? They already may have a solution.

Edited by itman

Share this post


Link to post
Share on other sites

Allegedly Watchguard has released a new version of the VPN client that addresses the issue. Please check and confirm.

Share this post


Link to post
Share on other sites
Posted (edited)

There hasn't been any sort of update for the client of my model XTM33. 

 

And we don't have TDR, BTW.

Edited by denzilla

Share this post


Link to post
Share on other sites
Posted (edited)
On 3/19/2020 at 1:19 PM, Marcos said:

Allegedly Watchguard has released a new version of the VPN client that addresses the issue. Please check and confirm.

Thank you for providing the link. Its working now.

hxxp://cdn.watchguard.com/SoftwareCenter/Files/MUVPN_SSL/12_5_3/WG-MVPN-SSL_12_5_3.exe

https://support.eset.com/en/kb7470-watchguard-mobile-vpn-connection-issue-with-eset-endpoint-antivirus-eset-endpoint-security

I do have concerns though that ESET Endpoint appears to be ignoring the exclusions and toggles of certain functions. If I disable a feature, it should be actually disabled.

Edited by denzilla

Share this post


Link to post
Share on other sites

What exclusions do you mean? Please provide at least a screen shot of your exclusions. Please keep in mind that using exclusions is not recommended and should be basically used only as a last resort if a particular issue cannot be resolved by any means. Also tell us why you think that the exclusions are not applied.

Share this post


Link to post
Share on other sites
On 3/24/2020 at 10:21 AM, Marcos said:

What exclusions do you mean? Please provide at least a screen shot of your exclusions. Please keep in mind that using exclusions is not recommended and should be basically used only as a last resort if a particular issue cannot be resolved by any means. Also tell us why you think that the exclusions are not applied.

Reading the previous responses in this thread tells you all you need to know. Endpoint seems to be still interfering with things even when users are adding exclusions and disabling functions. Adds additional headache when troubleshooting. 

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...