Endpoint Protection Client fails to detect a Port Scan

Products

• Endpoint Protection

Issue/Introduction

A Symantec Endpoint Protection (SEP) Client does not detect Port Scan tests.
 

Environment

A Firewall Rule exists that allows traffic from the computer that executes the Port Scan.

Resolution

SEP only detects a port scan for blocked traffic. To allow port scans to be detected as expected:

1. Identify the Firewall Rule that allows the intended port scan traffic
2. Disable or remove that Firewall Rule that allows the intended port scan traffic