Anyconnect DAP/hostscan issue with Norton security

[JG1978]

We use Anyconnect with hostscan posture validation to ensure our clients are running a current OS and AV with real time scanning enabled.

About a week ago our users that have Norton Internet Security reported being denied on VPN when they to login. Debug shows it is having problems with detecting real time scanning for Norton. I am using the latest hostscan package available. Has anyone else experienced this or have any ideas how to resolve?

DAP_TRACE: endpoint.av["NortonAV"] = {}
DAP_TRACE: endpoint.av["NortonAV"].exists = "true"
DAP_TRACE: endpoint.av["NortonAV"].description = "Norton Security with Backup"
DAP_TRACE: endpoint.av["NortonAV"].version = "22.12.0.104"
DAP_TRACE: endpoint.av["NortonAV"].activescan = "internalerror"
DAP_TRACE: endpoint.as["NortonAS"] = {}
DAP_TRACE: endpoint.as["NortonAS"].exists = "true"
DAP_TRACE: endpoint.as["NortonAS"].description = "Norton Security with Backup"
DAP_TRACE: endpoint.as["NortonAS"].version = "22.12.0.104"
DAP_TRACE: endpoint.as["NortonAS"].activescan = "internalerror

[NANCY TURNER]

We started having the same problem.  Did you find a solution?

[JG1978]

Not a real solution, as a workaround I have disabled the "realtime scanning" enabled check for Norton.

[Rahul Govindan]

This is most cases is a bug on the hostscan software. Probably came about with the new version of Norton. I would suggest opening a TAC case with the debug dap trace and DART ( with hostscan logging set to debugging) as outputs to the TAC engineer. I could not find an open bug for this issue yet. 

[NANCY TURNER]

Thanks for the quick response.  I thought about doing the same but when I checked her laptop, Norton was disabled and there was no antivirus active.  Made me a little nervous.  I will open a TAC case. 

[NANCY TURNER]

I opened a ticket and it took a while to convince him there is a bug with Norton but he eventually got there.  Here is his final response:

Problem Description:

=================

Hostscan Antivirus End Point Norton activescan=internalerror

Resolution:

=========

-Checked and reviewed config for DAP for VPN.

-Found Machine running Norton Security 22.12.0.104.

-Informed Nancy that the there is an internal Bug for the error received for this DAP.

[Rahul Govindan]

Do you have the Cisco bug id provided by the TAC engineer? I would add that to the thread here so that anyone else searching for the same fix can reference that.

[NANCY TURNER]

I asked, here is his response:

Hi Nancy,

 The Bug is an Internal one and cannot be shared.

 However, I have already attached it to the case for any cisco employee visibility.

[Rahul Govindan]

That is a really really stupid response from TAC !! This bug clearly should not be internal only as you (a customer) are hitting this issue.

Since the TAC engineer has attached the bug to your case, you can actually go to your case on Support Case Manager and find the bug id in the Case summary section.

[NANCY TURNER]

LOL!  I gave up years ago trying to talk sense into TAC.  I told him the exact problem with debugs and an hour later he put me on hold and came back and said this a bug relating to the latest version of Norton.  My response was...Ohhh, I see.  :)

Bug:  CSCuz85109 (Insufficient Permissions to View Bug)

[JG1978]

TAC has really gone downhill the last few years IMO. Whenever I open a case I always include a "show tech", logs showing the issue etc. and the first question/request I get from every tech is "please send me a show tech and describe the problem"

This is the reason I started this post in the first place, TAC was clueless when I opened a ticket so I turned to the community.

[JG1978]

Has anyone had any updates or luck in resolving this? I opened a TAC case today but have not spoken with Cisco yet.

[NANCY TURNER]

What version of hostscan are you running?  A new version was released on 3/7 4.3.05050.  I had a workaround in place that I have not yet removed so I am not sure if this fixes it, but the new Norton version is now listed as supported whereas it was not before.  

[JG1978]

hostscan_4.3.05038-k9.pkg so it looks like I am one behind......the initial response from TAC case I opened today was that it is not fixed yet and he was checking with peers for workarounds or status.

[NANCY TURNER]

Can you load the latest hostscan and see if it works? I would like to know as well. Since my workaround involves our physician community I have been dragging my feet in testing as if it is not fixed it will break things again.