Error 502: Proxy Error during Linux LiveUpdate session with reverse proxy configured on the Symantec Endpoint Protection Manager

Products

• Endpoint Protection

Issue/Introduction

Linux or Mac endpoints fail to download Symantec Endpoint Protection (SEP) definitions when using a Symantec Endpoint Protection Manager (SEPM) configured as an Apache reverse proxy. This typically occurs after network security changes disable unsecured traffic on Port 80, resulting in a 502 Bad Gateway or Proxy Error.

Symptoms:

• Linux client lux.log shows Result Code: 0x80010830 and Transport Return Code: 0x80010732.
• Manual test via curl -I http://[SEPM_IP]:8014/luproxy/masttri.zip returns HTTP/1.1 502 Proxy Error.
• Direct access to http://liveupdate.symantecliveupdate.com from the SEPM server fails, while https:// succeeds.

Environment

• Symantec Endpoint Protection
• Symantec Endpoint Protection Manager with reverse proxy service enabled

Cause

The default SEPM Apache reverse proxy configuration uses HTTP (Port 80) for upstream connections. If Port 80 is blocked by a firewall, the proxy cannot reach the Symantec LiveUpdate servers.

Resolution

To resolve this issue, reconfigure the SEPM Apache reverse proxy to route outbound requests over secure HTTPS (Port 443) using SSL proxying.

Step 1: Modify httpd.conf

1. Open Windows Services (services.msc) on the SEPM server and stop the following services:

• Symantec Endpoint Protection Manager Webserver (semwebsrv)
• Symantec Endpoint Protection Manager (semsrv)

2. Navigate to the SEPM Apache configuration directory:

[SEPM_Install]\apache\conf\

3. Create a backup copy of httpd.conf.

4. Open the original httpd.conf in a text editor.

5. Locate the custom Apache Reverse Proxy block at the end of the file (between # SEPM_APACHE_AS_PROXY_START and # SEPM_APACHE_AS_PROXY_END).

6. Ensure mod_ssl.so is loaded, add SSLProxyEngine On, and update the ProxyPass directive to use https://:

# SEPM_APACHE_AS_PROXY_START
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule cache_module modules/mod_cache.so
LoadModule cache_disk_module modules/mod_cache_disk.so
LoadModule setenvif_module modules/mod_setenvif.so
LoadModule ssl_module modules/mod_ssl.so

<IfModule mod_proxy.c>
<IfModule mod_cache.c>
<IfModule mod_cache_disk.c>
<IfModule mod_setenvif.c>

    # Enable SSL Proxy Engine for outbound HTTPS connections
    SSLProxyEngine On

    SetEnvIf Request_URI "/luproxy/" dolog
    SetEnvIf Request_URI "/luproxy/.*_livetri.zip" no-cache
    CustomLog "|| bin/rotatelogs.exe logs/access-%Z.log 25M" common env=dolog

    # Updated upstream URL to use HTTPS
    ProxyPass /luproxy/ https://liveupdate.symantecliveupdate.com/ retry=0 smax=0 ttl=60

    CacheRoot "cache-root"
    CacheEnable disk /luproxy/
    CacheDirLevels 1
    CacheDirLength 5

    CacheStoreNoStore On
    CacheIgnoreCacheControl On
    CacheStoreExpired On
    CacheIgnoreHeaders Cache-Control Pragma
    CacheMaxFileSize 1000000000

</IfModule>
</IfModule>
</IfModule>
# SEPM_APACHE_AS_PROXY_END

7. Save and close httpd.conf.

Step 2: Restart Services

1. Open services.msc.

2. Start Symantec Endpoint Protection Manager Webserver (semwebsrv).

3. Start Symantec Endpoint Protection Manager (semsrv).

Step 3: Verify Solution

1. Test locally on the SEPM server using a browser or command prompt:

http://localhost:8014/luproxy/livetri.zip

2. Test from a Linux client endpoint using wget:

wget http://<SEPM_IP>:8014/luproxy/livetri.zip

3. Confirm that the file downloads successfully without returning a 502 error.

Additional Information

• Unofficial Support: Installing and configuring a reverse proxy is beyond the scope of what support can assist with, this article is provided as-is to show an example of how it can be achieved
• SEPM Upgrades: Upgrading the SEP Manager may reset or overwrite the configurations outlined in this article. After any SEPM upgrade, ensure the changes made to httpd.conf are checked and corrected.