System Health shows as critical "Device is encountering persistent connection failures", affected are *.brightmail.com domains

Products

• Endpoint Detection and Response
• Advanced Threat Protection Platform

Issue/Introduction

ATP:N System Health shows as critical with message "Device is encountering persistent connection failures"

Verifying this with status_check following can be observed:
Connectivity to Servers:
[...]
                                AzTec Server is NOT reachable. (https://register.brightmail.com)
                                Software Update Server is NOT reachable. (https://swupdate.brightmail.com)
[...]

Verifying connection to any of the servers above via tcp_check, connection is shown as "Connected".
 

Resolution

It is possible that Symantec Advanced Threat Protection:Network (SATP:N) is connecting via HTTPS/SSL filtering device (Firewall, Proxy Server etc) to the remote systems. If so, filtering of HTTPS connections from SATP:N system must be disabled on these devices.


Please note: It is recommended not to filter any ports or protocols as far as connections from SATP:N device to remote backend servers are concerned.



Please contact Symantec support for further assistance.