TCP Connections To "ent-shasta-rrs-symantec.com"

[flutti]

We have found an enormous amount of blocked traffic on our proxies that is going to tcp://ent-shasta-rrs.symantec.com

I know what the URL is used for, that is not the question.
The big question mark for me is the TCP:// connection that is being blocked. This is expected behaviour by the proxy. Question is why TCP?

The client as in the configuration is using the IE proxy config, which is a PAC-file in the end.
After testing with the URLs listed under https://support.symantec.com/en_US/article.TECH163042.html, I can tell that one of the links is being blocked and the other works.

Is there anyone with an idea why these connections happen?

[ℬrίαη]

Not sure what you're asking. It uses the TCP protocol to connect. Why is the link not allowed on the proxy?

[flutti]

Just have been wondering why it is logged as TCP request and not HTTP request explicitly. I know HTTP is TCP, but it seems to be a proxy "issue".

And it is not allowed since it has been decided not to send any information to the outside world.

Which then leads to the other question: Which components are affected when blocking this URL? Most likely the download protection and SONAR - But does this blocking then rendering the affected components completely worthless?

[ℬrίαη]

SEP isn't proxy aware in that it can't see true source/destination when it comes to the IPS and firewall, has been like this every since 11.x. I can't say for sure in this case, but, it may also apply. Support may need to confirm.

[Mithun Sanghavi]

Hello,

Could you try Testing connectivity to Symantec's Download Insight and licensing servers

https://support.symantec.com/en_US/article.TECH163042.html

Regards,

[flutti]

The solution to actually get rid of all this traffic is to disable the Insight Lookups in External Communication Settings.

Nevertheless, it's obviously not the best idea to do that as it reduces the functionality of Download Insight and SONAR.
But ever since the directive is not to communicate with these services, that's the only thing to do.

Question now is if it is possible to configure the whole system that clients are not contacting these Insight servers directly but via SEPM and from there the requests are being sent in a consolidated way.

[pete]

clients reach to insight servers directly or through the Symantec ATP for EndPoint.