Endpoint Protection 14 for Mac AutoUpgrade process fails to download install package.

Products

• Endpoint Protection

Issue/Introduction

Symantec Endpoint Protection (SEP) 14 for Mac features now include the ability to upgrade clients from one version of SEP 14 to another via the AutoUpgrade process from the SEP Manager. After applying the install package to the SEP for Mac client group, the SEP for Mac client downloads the config.xml file and creates an AutoUpgrade directory, but never downloads the install package.

There is no error associated with this issue.  The SEP for Mac client will download a config.xml file to /private/tmp, and an AutoUpgrade directory will be created in the /Library/Application Support/Symantec/ directory. However, the client upgrade will not complete.

Cause

This can occur when the SEP for Mac client group is configured to use only port 443 for communication to the SEP Manager. To verify:

1. Check the Management Server Configuration list applied to the SEP for Mac client's group to see if the clients are configured to use port 443.
2. Sylink debug logging will confirm that clients are attempting to download the install package with HTTP over port 8014.

Here is an example from the smc_debug.log file:

[03-10 06:00:00.1000]<AutoUpgrade CSyLink::mfn_DownloadNow> Download URL:http://xxx.xxx.xxx.xxx:8014/ClientPackages/GroupGUID/Full.zip

The client will not be able to complete the download because this communication is not allowed with the SEP Manager as per the Management Server List.

Resolution

This issue is fixed in Symantec Endpoint Protection 14 MP2  For information on how to obtain the latest build of Symantec Endpoint Protection, see Download the latest version of Symantec Endpoint Protection. Be aware that, as this is a client side fix, customers who upgrade from either RTM or MP1 to MP2 will experience the same issue. This issue will be resolved when upgrading an MP2 client to a newer version.

The following workaround can be used to resolve the issue:

1. Remove previous install packages from the SEP for Mac client's group.
2. Add a new install package and use the custom URL option.
3. Use a URL that points to the SEPM server and directory with the install package as observed in the sylink logging.
   • Ensure the link is using HTTPS over port 443.
4. The clients should now complete the upgrade.