Windows Server 2012 R2, fully updated, physical server. Installed AMP connector version 6.2.5.10848 last night. Since then the server has crashed/rebooted twice. Seeing several event ID 36887 Schannel errors since the install - "A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.". I have since stopped and disabled the AMP service. Any help with this would be appreciated.
The issue has been narrowed down to 6.2.5 and is only being hit in rare cases. The bug has been updated but hasn't sync'd to the external version yet. If you choose to roll back to 6.2.3 (or 6.1.9 if you prefer), you would need to uninstall 6.2.5 and install the version of your choice.
How about you re-release version 6.2.3 that is stable as version 6.2.6, so we can push an automated update from the Console like it is a new version. It is quite painful to roll things back especially with a required reboot after the uninstall....
There is very little information on the bugid link but I understood that the bug triggers only during the reboot after the upgrade. If your device survived that reboot you should be OK. I wish Cisco added more information on the bugid to avoid panic and extra TAC calls.
According to TAC, there is no way to do a mass downgrade from 6.2.5 from the AMP console. We are back on 6.1.7 on the two systems we have had the bug issue on.
