Update SEP 15 Client using LUA

[Orlando Martinez]

Hi guys!

I'm trying to update the definition content from an internal LUA but the client just download the catalog and then show that there are no updates available.

I'm using Endpoint Security Console, Client 14.2.5280.2000, and LUA 2.3.7.51

Hope anyone could help me.

Regards!

[TonyS]

It might be that the LUA files are corrupted.

Try followig this steps - https://support.symantec.com/us/en/article.tech247914.html

[GeoGeo]

Have you put the 14.2 defintions in the LUA into your distribution centre? An have you applied them to the download and distribution jobs? 

Config > distribution centre > check all the 14.2 content has been applied to this. 

If clients are still not picking this up make sure they can all see the clu-prod location on port 7070

[Orlando Martinez]

Hi Tony, this is a new fresh installation of LUA, I don't think the definitions are corrupted but I'll try that.

 

Hi GeoGeo, we configured the default distribution center with this products:

Caption

And the clients do connect to the LUA and download the catalog, but it shows that there are not definitions available.

This is what LiveUpdate shows on clients:

The following Symantec products and components are installed on your computer:

> AP Portal List
> Intrusion Prevention Signatures
> SEP Client Security Updates
> Symantec Endpoint Protection Client
> Common Network Transport Library and Configuration
> Symantec Whitelist
> Centralized Reputation Settings
> Power Eraser Definitions
> AdvML (Static) Win64
> Application Control Data
> Policy and Command Handler
> SEPC Error Submission Control Data
> Extended File Attributes and Signatures
> Submission Control Thresholds
> Endpoint Detection and Response
> Revocation Data
> Virus and Spyware Definitions SDS Win64 (Reduced)
> WSS Traffic Redirection
> Windows Host Integrity Content
> Vulnerability Remediation
> SONAR Definitions
> Symantec Endpoint Protection Upgrade Win64

Initializing...
Connecting to HTTP://172.16.20.91/clu-prod...
Connected to LiveUpdate server successfully.

Files to be downloaded: 19
Downloading catalog file (1 of 19) finished.
Downloading catalog file (2 of 19) finished.
Downloading catalog file (3 of 19) finished.
Downloading catalog file (4 of 19) finished.
Downloading catalog file (5 of 19) finished.
Downloading catalog file (6 of 19) finished.
Downloading catalog file (7 of 19) finished.
Downloading catalog file (8 of 19) finished.
Downloading catalog file (9 of 19) finished.
Downloading catalog file (10 of 19) finished.
Downloading catalog file (11 of 19) finished.
Downloading catalog file (12 of 19) finished.
Downloading catalog file (13 of 19) finished.
Downloading catalog file (14 of 19) finished.
Downloading catalog file (15 of 19) finished.
Downloading catalog file (16 of 19) finished.
Downloading catalog file (17 of 19) finished.
Downloading catalog file (18 of 19) finished.
Downloading catalog file (19 of 19) finished.

Session summary: 0 update(s) available, 0 update(s) installed.
LiveUpdate session is complete.

I tried to test connections to LUA via Telnet at 7070 port and it was succesful.

[SMLatCST]

The catalog file is merely indication that there is a LiveUpdate server at the location, not that the LUA has published anything as yet.

I'd recommend investigating your LUA logs.  While we can see that the correct content is assigned to a Distribution Centre, we don't yet know if the Download job managed to grab the defs from Symantec LiveUpdate, or if the Distribution Job managed to successfully push the content to the Distribution Centre.

[GeoGeo]

Hi Orlando so the good news is the client is communicating properly I can see from your information so looks like the issue is with the LUA 

In Configure > Distribution Centers > at the bottom do you get ticks next to all the distributed products in the list like below? 

[Orlando Martinez]

Yes, all the products have the green checks. The only difference that I see is the "Symantec Advanced Endpoint Protection", I don't download that product...

[Orlando Martinez]

Here's the configuration on the LUA.

Hope anyone could help me.

Regards!

[SMLatCST]

Quick thought, I don't see your SEP Client's build number in the below article:

TECH154475
Released versions of Symantec Endpoint Protection
Last Updated October 15, 2019
https://www.symantec.com/docs/TECH154475

The build number you provided suggests you're running 14.2RU2 (I assume a beta).  You could try looking for this in the LUA's Catalog, but it's possible defs for this version are not yet available via LUA (this won't be the first time this has happened.)

[Orlando Martinez]

Now that you mention it, I tried another client 14.2.4815.1101 and it does download the definitions from the LUA. However, the packages I download from the console are version 14.2.5280.2000, do you know of any way to download an earlier version?

[SMLatCST]

You should be able to simply download SEP 14.2RU1MP1 from MySymantec.

After that, it's just a matter of changing the sylink file (https://www.symantec.com/docs/HOWTO81179) or enrolling it in your cloud console (https://www.symantec.com/docs/TECH253178), after the client install

[Edward HF]

Please disable the "Run in low Bandwidth Mode" option in the update policy (e.g. DEFAULT - System) .