Communication problems with a parent server with more than one Network Interface Card
Question/Issue:
You are running Symantec AntiVirus Corporate Edition server on a computer with multiple Network Interface Cards (NIC). You experience communication problems. For example, Symantec System Center does not show all computers, or clients do not receive configuration or virus definition updates.
Solution:
Communication problems result when Symantec AntiVirus server is installed on a computer with multiple NICs or when an additional NIC is added to the computer after Symantec AntiVirus server is installed. The problem originates when Symantec AntiVirus requests a network address from the operating system at startup. Client communication may fail if the Symantec AntiVirus server is listening on the external IP address.
The first step to solve this problem is to confirm that the communications problem is caused by Symantec AntiVirus listening on the external NIC.
On the parent server, use the Registry Editor to find the following registry key:
HKEY_LOCAL_MACHINE\Software\Intel\Landesk\VirusProtect6\CurrentVersion\AddressCache\<server>
You see Address_0 and/or Address_1 on the right side. Address_0 corresponds to TCP/IP, while Address_1 corresponds to IPX. Starting at the ninth pair of digits, these keys show which address the server is listening on. The IP addresses are displayed in hexadecimal format. The address starts under the 8.
Examples
If the Address_1 value is 002020008241000000000804000103C6589C, then the digits 00000804 000103C6589C are the IPX address.
If the Address_0 value is 00C020000B9700009B405469, then the digits 9B 40 54 69 correspond to the IP address (in this case, the address is 155.64.84.105). Use the Windows Calculator to convert the hexadecimal value (starting at the ninth pair of digits) to decimal, but be sure to convert only two digits at a time.
Verify that the address value matches the server's internal IP or IPX address.
If the registry shows that Symantec AntiVirus is listening on the external address, then do not change the Address_0 or Address_1 values manually. To solve communication problems
Symantec AntiVirus checks for a new registry value called "OverrideIPAddress." The registry value may be manually set by the server administrator to contain the IP address that clients should use to communicate with the server. The OverrideIPAddress registry value must be created in:
HKEY_LOCAL_MACHINE\Software\Intel\LANDesk\VirusProtect6\CurrentVersion.
The registry value must be an IP address in dotted decimal form (for example, 192.168.0.1) and must be a valid IP address for the server. The registry value is ignored if it does not exist, when it is empty, or if it does not match one of the server IP addresses.
The following steps show how to set the OverrideIPAddress value in the server's registry.
WARNING: We strongly recommend that you back up the system registry before making any changes. Incorrect changes to the registry could result in permanent data loss or corrupted files. Modify only the keys specified. See the document
How to back up the Windows registry before proceeding.
To set the OverrideIPAddress value
1. On the parent server, use the Registry Editor to find the following key:
HKEY_LOCAL_MACHINE\Software\Intel\Landesk\VirusProtect6\CurrentVersion
2. Click Edit > New > String Value.
3. Type OverrideIPAddress for the name.
4. Click Edit > Modify.
5. Type the IP Address for the internal NIC.
6. Exit the Registry Editor.
7. Stop and restart the Symantec AntiVirus Server service for changes to take effect. Symantec AntiVirus server will begin to use the new registry value in the AddressCache one minute after the server is started.
Additional suggestions for communication problems when the above solution does not solve the problem.
- Change the NIC binding order
Change the binding order of the NICs to allow Symantec AntiVirus Corporate Edition Server service to listen on the internal IP Address. Use the appropriate steps for your server's operating system:
Windows 2000/XP/2003
To change the binding order
1. Right-click My Network Places, and then click Properties. The Network and Dial-up Connections window opens.
2. Click Advanced and then click Advanced Settings... from the drop-down menu.
3. Click Adapters and Bindings and then click the network adapter whose IP Address is the INTERNAL address.
4. Click the up arrow to move this NIC to the top of the list.
5. Restart the server to re-enumerate the NIC.
Windows NT 4.0
To change the binding order
1. Right-click Network Neighborhood and choose Properties.
2. Click Bindings.
3. Ensure that Show bindings for All Protocols is selected.
4. Expand a protocol, and the MoveUp button becomes available.
5. Click the second NIC and then click MoveUp.
6. Click OK, and restart the server for changes to take effect.
- Create a ParentIPAddress registry value
Note: The ParentIPAddress registry key is a client-side workaround and will not affect which NIC the server is listening on.
Use the following steps to create the ParentIPAddress registry key:
WARNING: We strongly recommend that you back up the system registry before making any changes. Incorrect changes to the registry could result in permanent data loss or corrupted files. Modify only the keys specified. See the document How to back up the Windows registry before proceeding.
To create the ParentIPAddress registry key
1. On an affected client, use the Registry Editor to find the following key:
HKEY_LOCAL_MACHINE\Software\Intel\Landesk\VirusProtect6\CurrentVersion
2. Click Edit > New > String Value.
3. Type ParentIPAddress for the name.
4. Click Edit > Modify.
5. Type the IP Address for the internal NIC.
6. Exit the Registry Editor.
7. Restart the computer for changes to take effect.
If you find that creating the ParentIPAddress registry value restores communication for some of your clients, you can use the following steps to create the registry key on the parent, and then distribute it via the Grc.dat file to all clients.
To distribute the ParentIPAddress registry value to all clients using Grc.dat
1. On the parent server, use the Registry Editor to find the following key:
HKEY_LOCAL_MACHINE\Software\Intel\Landesk\VirusProtect6\Currentversion\ClientConfig
2. Click Edit > New > String Value.
3. Type ParentIPAddress for the name.
4. Click Edit > Modify.
5. Type the IP Address for the internal NIC.
6. Exit the Registry Editor.
7. Restart the Symantec AntiVirus Server service to add this value to Grc.dat.
When managed Symantec AntiVirus clients next check in with the parent server, the modified Grc.dat is then copied to the client and the ParentIPAddress change is added to the client registry. If necessary, manually copy the Grc.dat to the client computer as described in the document for your product version:
- Changing a Symantec Client Security 3.x or Symantec AntiVirus Corporate Edition 10.x client installation from unmanaged to managed
- Changing a Symantec AntiVirus 8.x olr 9.x client installation from unmanaged to managed
- Physically swap the NICs.
On Windows NT 4.0, you can physically swap the NICs (assuming only two are installed). This will place the NIC with the IP Address that Symantec AntiVirus Server service is looking for at the top of the enumeration list.
For additional troubleshooting steps, read the document for your product version:
You can find additional information in the Microsoft document
DNR Now Sorts IP Addresses for a Multihomed Host Before Returning the List to Winsock Applications (article ID 182644).
References:
For additional troubleshooting steps, read the document for your product version:
You can find additional information in the Microsoft document
DNR Now Sorts IP Addresses for a Multihomed Host Before Returning the List to Winsock Applications (article ID 182644).
Document ID: 2002091816400248
Last Modified: 10/31/2008
Date Created: 09/18/2002
Operating System(s): Windows NT 4.0 SP6a, Windows 2000 Professional, Windows XP Professional Edition, Windows Server 2003 32-bit Edition
Product(s): Symantec AntiVirus 10.1, Symantec AntiVirus 10.2, Symantec AntiVirus Corporate Edition 10.0, Symantec AntiVirus Corporate Edition 8.0, Symantec AntiVirus Corporate Edition 9.0
Release(s): SAV 10.0, SAV 10.0 [All Releases], SAV 8.0, SAV 8.0 [All Releases], SAV 8.01, SAV 9.0, SAV 9.0 [All Releases], Symantec AntiVirus 10.1, Symantec AntiVirus 10.1 [All Releases], Symantec AntiVirus 10.2, Symantec AntiVirus 10.2 Client for Vista, Symantec AntiVirus 10.2 [All releases], Symantec AntiVirus for Linux 1.0, Symantec AntiVirus for Linux [All Releases]
Cart
PRINT THIS PAGE