confused re Officescan port allocations!!??

Hello

I am about to change from C/S/M (Enterprise?) to the SMB version - but
having read the SMB notes I am even more confused re port
allocations...

Officescan clients use port 80 to communicate with the Officescan
server on the SBS 2K server? (or did I use 1234?) and Officescan
server uses port 8080 on the proxy server to get pattern file updates?

We do not run any Internet available web pages on the server.

Would appreciate some light on this!

Cheers

Geoff

Dave
Thu Apr 29 06:37:07 CDT 2004

Hi Geoff,
OfficeScan server uses 80, client port is 12345, Internet Proxy (ISA) for
pattern updates uses 8080 (unless you configured ISA to listen on a
different port). That is standard setup.
DS

"Geoff Cox" <geoff.cox@minusspam.freeuk.com> wrote in message
news:d9o19052rpuqqavm0330aksp71m6l9kmoj@4ax.com...
> Hello
>
> I am about to change from C/S/M (Enterprise?) to the SMB version - but
> having read the SMB notes I am even more confused re port
> allocations...
>
> Officescan clients use port 80 to communicate with the Officescan
> server on the SBS 2K server? (or did I use 1234?) and Officescan
> server uses port 8080 on the proxy server to get pattern file updates?
>
> We do not run any Internet available web pages on the server.
>
> Would appreciate some light on this!
>
> Cheers
>
> Geoff
>

Geoff
Thu Apr 29 07:50:38 CDT 2004

On Thu, 29 Apr 2004 06:37:07 -0500, "Dave Stoecker"
<david_stoecker@hotCOFFEEmail.com> wrote:

>Hi Geoff,
>OfficeScan server uses 80, client port is 12345, Internet Proxy (ISA) for
>pattern updates uses 8080 (unless you configured ISA to listen on a
>different port). That is standard setup.

Dave

thanks foe that...pre moving to SMB version I am still finding that
the Offiecscan server is not updating itself with the new pattern
files. I have the 8080 port etc for the proxy, plus I installed the
B1114 ofcDownload.dll ... any ideas? Is it possible to check access to
the TM server via the proxy server?

Cheers

Geoff

Dave
Thu Apr 29 10:13:21 CDT 2004

Have you looked at the tmudump.txt file in the
<OfficeScanFolder>\PCCSRV\Web\Service\Au_Log directory? It should indicate
what is happening - for instance if you are getting 407 errors, which would
mean authentication through the proxy is (still) not working. You can also
check the ISA Web Proxy logs to see what it is recorded there...

I have had enough headaches (Trend and other things) with requiring outbound
authentication on ISA that I have turned it off until I can sort out my
config to not trip over itself...what a pain. Of course, you could be
having some other issue, so check the logs. Post some relevant snippets if
you can't identify the problem.

DS

"Geoff Cox" <geoff.cox@minusspam.freeuk.com> wrote in message
news:7cu1901hikusmqf82bnm1m3chd6muv5o6l@4ax.com...
> On Thu, 29 Apr 2004 06:37:07 -0500, "Dave Stoecker"
> <david_stoecker@hotCOFFEEmail.com> wrote:
>
> >Hi Geoff,
> >OfficeScan server uses 80, client port is 12345, Internet Proxy (ISA) for
> >pattern updates uses 8080 (unless you configured ISA to listen on a
> >different port). That is standard setup.
>
> Dave
>
> thanks foe that...pre moving to SMB version I am still finding that
> the Offiecscan server is not updating itself with the new pattern
> files. I have the 8080 port etc for the proxy, plus I installed the
> B1114 ofcDownload.dll ... any ideas? Is it possible to check access to
> the TM server via the proxy server?
>
> Cheers
>
> Geoff

Geoff
Thu Apr 29 14:07:37 CDT 2004

On Thu, 29 Apr 2004 10:13:21 -0500, "Dave Stoecker"
<david_stoecker@hotCOFFEEmail.com> wrote:

>Have you looked at the tmudump.txt file in the
><OfficeScanFolder>\PCCSRV\Web\Service\Au_Log directory? It should indicate
>what is happening - for instance if you are getting 407 errors, which would
>mean authentication through the proxy is (still) not working. You can also
>check the ISA Web Proxy logs to see what it is recorded there...

Dave

I see multiple entries such as that below in the tmudump.txt file -
any clues?

Geoff

0429 1459 1207 05f8:201c Cancle/Fail ! delete file:<C:\Program
Files\Trend\OfficeScan\PCCSRV\web\service\temp\Cache\server.ini> !

0429 1559 1203 05f8:2068 HTTP Port: <0>, usename: <> !

0429 1559 1204 05f8:2068 If use proxy:<1>
0429 1559 1205 05f8:2068 Proxy:<10.58.77.253>, ProxyPort:<8080>, Proxy
User:<administrator>

0429 1559 1205 05f8:2068 HTTP download: from
<http://officescan-t.activeupdate.trendmicro.com/activeupdate/server.ini>
to <C:\Program
Files\Trend\OfficeScan\PCCSRV\web\service\temp\Cache\server.ini>

0429 1559 1206 05f8:2068 0 >> result <407>

0429 1559 1207 05f8:2068 Cancle/Fail ! delete file:<C:\Program
Files\Trend\OfficeScan\PCCSRV\web\service\temp\Cache\server.ini> !

Dave
Thu Apr 29 14:50:01 CDT 2004

The second to last block ending in "result <407>" indicates that proxy
authentication is failing (as referenced in that Trend KB I cited previously
in another thread).

What version of OfficeScan are you currently using?
Are you specifying credentials in Domain\User format? (doesn't appear so
from the log)


"Geoff Cox" <geoff.cox@minusspam.freeuk.com> wrote in message
news:4hk29052o64ksddlogoog9r6nscnm9pdlp@4ax.com...
> On Thu, 29 Apr 2004 10:13:21 -0500, "Dave Stoecker"
> <david_stoecker@hotCOFFEEmail.com> wrote:
>
> >Have you looked at the tmudump.txt file in the
> ><OfficeScanFolder>\PCCSRV\Web\Service\Au_Log directory? It should
indicate
> >what is happening - for instance if you are getting 407 errors, which
would
> >mean authentication through the proxy is (still) not working. You can
also
> >check the ISA Web Proxy logs to see what it is recorded there...
>
> Dave
>
> I see multiple entries such as that below in the tmudump.txt file -
> any clues?
>
> Geoff
>
> 0429 1459 1207 05f8:201c Cancle/Fail ! delete file:<C:\Program
> Files\Trend\OfficeScan\PCCSRV\web\service\temp\Cache\server.ini> !
>
> 0429 1559 1203 05f8:2068 HTTP Port: <0>, usename: <> !
>
> 0429 1559 1204 05f8:2068 If use proxy:<1>
> 0429 1559 1205 05f8:2068 Proxy:<10.58.77.253>, ProxyPort:<8080>, Proxy
> User:<administrator>
>
> 0429 1559 1205 05f8:2068 HTTP download: from
> <http://officescan-t.activeupdate.trendmicro.com/activeupdate/server.ini>
> to <C:\Program
> Files\Trend\OfficeScan\PCCSRV\web\service\temp\Cache\server.ini>
>
> 0429 1559 1206 05f8:2068 0 >> result <407>
>
> 0429 1559 1207 05f8:2068 Cancle/Fail ! delete file:<C:\Program
> Files\Trend\OfficeScan\PCCSRV\web\service\temp\Cache\server.ini> !
>

Geoff
Thu Apr 29 16:03:27 CDT 2004

On Thu, 29 Apr 2004 14:50:01 -0500, "Dave Stoecker"
<david_stoecker@hotCOFFEEmail.com> wrote:

>The second to last block ending in "result <407>" indicates that proxy
>authentication is failing (as referenced in that Trend KB I cited previously
>in another thread).
>
>What version of OfficeScan are you currently using?
>Are you specifying credentials in Domain\User format? (doesn't appear so
>from the log)

Dave

It is v5.5.

Sorry don't understand what you mean by specifying credentials in
Domain\User format?

Geoff

Geoff
Thu Apr 29 16:07:22 CDT 2004

On Thu, 29 Apr 2004 14:50:01 -0500, "Dave Stoecker"
<david_stoecker@hotCOFFEEmail.com> wrote:

>The second to last block ending in "result <407>" indicates that proxy
>authentication is failing (as referenced in that Trend KB I cited previously
>in another thread).

>Are you specifying credentials in Domain\User format? (doesn't appear so
>from the log)

Dave

In Officescan server console for the proxy settings I have

administrator and the administrator password

is this what you mean?

Geoff

Dave
Thu Apr 29 16:33:12 CDT 2004

Sorry, I was out and about for a bit, and leaving again in a few minutes.
You should have <YourDomainName>\Administrator instead of just Administrator
in the proxy settings. The short version is fine (ie you don't need the
.local or whatever extension you are using). That will probably do it. If
not......???
DS

"Geoff Cox" <geoff.cox@minusspam.freeuk.com> wrote in message
news:lhr2901lpbdeh43dpeda53hmtdcnkomtd8@4ax.com...
> On Thu, 29 Apr 2004 14:50:01 -0500, "Dave Stoecker"
> <david_stoecker@hotCOFFEEmail.com> wrote:
>
> >The second to last block ending in "result <407>" indicates that proxy
> >authentication is failing (as referenced in that Trend KB I cited
previously
> >in another thread).
>
> >Are you specifying credentials in Domain\User format? (doesn't appear so
> >from the log)
>
> Dave
>
> In Officescan server console for the proxy settings I have
>
> administrator and the administrator password
>
> is this what you mean?
>
> Geoff

Geoff
Thu Apr 29 17:27:27 CDT 2004

On Thu, 29 Apr 2004 16:33:12 -0500, "Dave Stoecker"
<david_stoecker@hotCOFFEEmail.com> wrote:

>Sorry, I was out and about for a bit, and leaving again in a few minutes.
>You should have <YourDomainName>\Administrator instead of just Administrator
>in the proxy settings. The short version is fine (ie you don't need the
>.local or whatever extension you are using). That will probably do it. If
>not......???

Thanks Dave - have added the Domain - will see if this does the trick!

Cheers

Geoff