HostScan Firewall check fails with McAfee HIPS 8.0 Patch 6 (and later)

[AlistairGillespie]

Hi

We're using a HostScan Posture check to look for (amongst other things) Firewall enabled.

The Firewall is McAfee Host Intrusion Prevention 8.x

This has been working fine with McAfee 8.0 Patch 5

However - with McAfee 8.0 Patch 6 (and later) it fails.

"Windows Firewall Support Chart for HostScan 4.2.02075" show Shows McAfee Host Intrusion Prevention 8.x is supported and it can check Enabled Status.

I suspect the reason it fails is because McAfee changed the implementation of HIPS in patch 6.

Unlike previously it no longer uses the "McAfee Firewall Core Service".
Whilst that service is still present the service is not started.

Can someone from Cisco confirm

- Have version of McAfee HIPS 8.0 Patch 6 (or later) been tested with this check?
- What is the endpoint check *actually* looking for ? (does it look for the service "McAfee Firewall Core Service"?)
- How can we fix / workaround this issue?

Thanks
-AL

[Philip D'Ath]

More than likely you are going to need to open a case with Cisco TAC about this one.

Have you tried upgrading your AnyConnect client to a newer version in the hope that it has added support for the new McAfee software?

[Philip D'Ath · Accepted solution]

Not good news.  Known issue - and Cisco are not planning to fix it.

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuy17396/?referring_site=bugquickviewredir

[Philip D'Ath]

You should still open a Cisco TAC case, and have it linked to the above issue.  The more cases that get linked to it the more likely Cisco are to consider doing something about it.  I see three cases linked to it at the moment.

[Philip D'Ath]

pps.  You could also start a discussion from that bug report so it gets linked against it, and continue this thread in that.

[AlistairGillespie]

Thanks for the reply - ironically I found the same bug report you mention literally just after posting this article! ;-)

Agree - it totally confirms what we've seen / suspected.

It's kindof "unfortunate" that McAfee changed the behaviour (although it's totally within their remit to do that). However - if Cisco say they support a particular version, then they should test for that and properly support it (not rely on a workaround like this being put in-place).

Not fixing this properly means more people hitting the same problem as they roll onto later versions of McAfee HIPS (and the associated pain for troubleshooting it etc)