When troubleshooting issues with SEDR you might notice that in some SEDR logs (for example "error.log") there are events of connections toward URL "central.crsi.symantec.com". Similar to these ones:
2021/05/10 09:09:04 [error] 3574#3574: *47757334 connect() failed (111: Connection refused) while connecting to upstream, client: x.x.x.x, server: , request: "GET /AVIS/getSampleStatus HTTP/1.1", upstream: "http://127.0.0.1:8009/AVIS/getSampleStatus", host: "central.crsi.symantec.com"
This URL is not listed among the URLs to allow for SEDR to work properly:
but it is listed in the Submissions URLs to allow for the SEP clients:
This is expected behavior as the SEP Endpoint is communicating with SEDR using URL "central.crsi.symantec.com", then SEDR terminates this connection and submits directly to our configured upstream server, "central.b6.crsi.symantec.com".
This is expected behavior which doesn't need further investigation.