Group Update Providers (GUPs) are not caching complete content and Endpoint Protection clients not updating from GUPs

Article Id: 170083

Status: Published

Updated On: 01-09-2017 14:34

Legacy Id: TECH247464

Products:

Endpoint Protection

Issue/Introduction:

You noticed that your Symantec Endpoint Protection (SEP) 12.1.x clients are no longer able to get content definitions from their Group Update Providers (GUPs). When looking at the GUPs SharedUpdates folder, many of the full and delta definitions show as 1 KB in size.

GUPs SharedUpdates folder location:
C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\<version>\Bin\SharedUpdates\

SEP client debug.log from GUP:

2017/08/25 11:58:56.261 [6352:5928] GUProxy - **downloadHelper.CreateUrlRequest Succeed to GET://<SEPM IP Address>:8014/content/TempCache/{07B590B3-9282-482f-BBAA-6D515D385869}/170723008/xdelta170723008_To_170824021.dax, begin from 0 with size 1048576

2017/08/25 11:58:56.261 [6352:5928] GUProxy - Download failed GET://<SEPM IP Address>:8014/content/TempCache/{07B590B3-9282-482f-BBAA-6D515D385869}/170723008/xdelta170723008_To_170824021.dax ResponseStatus=416

HTTP/1.1 416 Requested Range Not Satisfiable

Connection: close

Cause:

In this case, customer using a Layer 7 firewall appliance that does HTTP Header checking that manipulated the traffic between the Symantec Endpoint Protection Manager (SEPM) and the GUPs.

Resolution:

The Layer 7 firewall appliance was configured to ignore HTTP Header checking for traffic between the SEPM and the GUPs.