Network Connection Lost After Settings Change on Advanced Threat Protection Scanner

Products

• Endpoint Detection and Response
• Advanced Threat Protection Platform

Issue/Introduction

After making a change to any of the Advanced Threat Protection (ATP) Scanner settings, network work connectivity through the Inline interface(s) is lost, then reestablished.

Environment

ATP 3.1.0 or ATP 3.2.0 installed as a management server with one or more ATP network scanners.
 

Cause

A version mismatch occurred between the configuration provided by the ATP manager and the ATP scanner.  This version mismatch causes the scanner to request a 'full configuration' from the ATP manager.  During the 'full configuration' the ATP scanner takes the bridge, and associated ports, offline.

Resolution

Symantec included repair code for this issue starting in Symantec Endpoint Detection and Response (SEDR) 4.0.0.

Please update the management server and all scanners to SEDR 4.0.0 or later.