You are seeing a FAIL_BINDING_ERROR on your Enforce Server after Cloud Services enrollment

Products

• Data Loss Prevention Cloud Detection Service for ICAP
• Data Loss Prevention Cloud Detection Service for REST
• Data Loss Prevention Cloud Detection Service
• Data Loss Prevention Cloud Service for Email
• Data Loss Prevention Cloud Package
• Data Loss Prevention

Issue/Introduction

You have been issued a replacement Enrollment bundle, and it appeared to have enrolled successfully.

However, after a service restart, the following event appears on the Enforce Server:

 

 

General
Type	Warning		Time	Oct 24, 2022 3:40:14 PM
Server or Detector	DLP-WSS		Host	gw.csg.dlp.protect.symantec.com

Message
Code	2715
Summary	Cloud Service is not available because of an account issue
Detail	Error [FAIL_BINDING_ERROR]. Cloud Service is not available because of an account issue. Contact Symantec Support (https://support.symantec.com/en_US/contact-support.html).

 

 

Environment

Release : 15.x-16.x

Cause

The Detector was not unbound from the old Enforce Server.

Even if Enforce has been decommissioned or experienced a hard failure, the Cloud Detector remains bound and prevents new Enforce Server from connecting to the service.

Resolution

Normally, Support follows steps to "unbind" a Detector before re-issuing an Enrollment bundle:

1. Delete Detectors from old Enforce
2. Using internal support tools, unbind Detector(s)
3. Using internal support tools, issue bundle(s) and add to new Enforce Server

However, in some cases (e.g., hard fail or crash of old Enforce) it's actually not possible to perform step #1.

And as a result, sometimes step #2 gets skipped, and no unbind is performed, and a new bundle gets issued and used to re-enroll the Detector (step #3).

In such instances, Enforce will usually produce the error in this KB.

In this case, if all circumstances match:

• Old Enforce decommissioned prior to Detector deletion
• New bundle issued and enrollment performed
• Error Code above seen on Enforce

Support teams can perform the Unbind operation AFTERWARD.

The usual result will be that the Detector will be unbound from the old Enforce, and await a call from the new one.

 

Note: The unbind operation needs to be performed on EACH Detector that was previously bound or enrolled to the old Enforce.

Additional Information

If the MonitorController is restarted afterward, the connection and bind result should occur right away. 

But even if it isn't, the MC will usually have a reason to "reach out" - daily disconnect and reconnect, EDM indexing updates, etc., and the Detector will then bind to the new Enforce.