DNS requests are sent to sp.cwfservice.net even though IPS URL Reputation is disabled

Products

• Endpoint Protection
• Endpoint Security

Issue/Introduction

When IPS URL Reputation is disabled, the SEP (Symantec Endpoint Protection) or SES (Symantec Endpoint Security) client still generates a lot of DNS requests for sp.cwfservice.net.

Cause

The feature shares a setting with Insight in the external communications configuration.

Repeat requests are due to lookup failures if the lookup is blocked.

Resolution

This issue is fixed in Symantec Endpoint Protection (SEP) 14.3 RU2. For information on how to obtain the latest build of Symantec Endpoint Protection, see Download the latest version of Symantec software here.

Additional Information

Allowing the requests instead of blocking them should prevent excessive retries.

ESCRT-5966