Can not access SMB any more.

[KimiM 0]

I have just installed ESET PROTECT Cloud (version: 4.4.6.1) product.

However, I can not access the network(LAN) scanner anymore.

The network scanner only needs to access SMB on the same LAN network.

Please advise me if you have any solution.

Thanks.

 

[Marcos 5,450]

ESET PROTECT Cloud is not supposed to be installed locally (unlike on-premise) so I'd rather expect the issue started after installing ESET Endpoint Security. Can you confirm? Does pausing the firewall make a difference? What network scanner are you referring to?

[KimiM 0]

Thanks for your comment, I appreciate.

I installed existing LAN that including brand new setup PC.

Only new PC is no problem to access Copier/Scanner device on same network.

I am new to ESET PROTECT Cloud therefore I need to know how can I pause the firewall at ESET PROTECT Cloud.

Please advise me.

[Marcos 5,450]

ESET PROTECT only manages ESET security products. Does pausing the firewall on an endpoint where the issue occurs make a difference?

[KimiM 0]

Actually, I disabled firewall, however still same result...

Any other method that I can try?

Thanks,

[Marcos 5,450]

Does temporarily uninstalling ESET actually make the issue go away?

[KimiM 0]

It's works fine, when uninstalled ESET from the PC.

So any ideas now?

[KimiM 0]

I just found that scanner/copier need to open port 445.

[Marcos 5,450]

SMB communication is allowed in the trusted zone so it's likely that you didn't have the trusted zone configured properly if you had to create a permissive rule.

[KimiM 0]

OK, I can try that.

BTW, where I can setup trusted zone?

Please advise me.

Thanks.

[Marcos 5,450]

You can check if your network is trusted in the Known networks list:

Alternatively you can add your local subnet to the Trusted zone in the Zones setup.

[KimiM 0]

I have tried above setting, unfortunately did not work. Registered scan/copier IP address.

When I disable all the firewall function then it;s works.

But it's looks ugly to showing security worrying.

Hopefully there's suite way to do it. Any ideas?

Thanks.

 

[Marcos 5,450]

Please carry on as follows:

1. Enable advanced logging under Help and support -> Technical support
2. Reboot the machine
3. Reproduce the issue
4. Stop logging
5. Collect logs with ESET Log Collector and upload the generated archive here.

[KimiM 0]

I have generated a log file. However it's more 250MB that over the limit for upload file size.

What should I do?

[Marcos 5,450]

You can upload it to a file sharing service, such as OneDrive, Dropbox, etc. and drop me a private message with a download link.

[KimiM 0]

OK, here is a link to download.

https://www.dropbox.com/scl/fi/1pl1sbtlqxpnbqhb0cspd/ees_logs.zip?rlkey=6wza16n0sei4t6ug3zzc5wylp&dl=0

 

 

[KimiM 0]

Any updates?

 

[KimiM 0]

So how's result of log file? 

[Marcos 5,450]

It is not clear which of the blocked communications is the desired one initiated by the network scanner especially given that we don't know the IP address of the device it was running on. I'd recommend reproducing the issue and then resolving it via this: