DAT download blocked by SonicWALL Gateway scanning

Technical Articles ID: KB58039
Last Modified: 7/7/2020

Environment

McAfee ePolicy Orchestrator (ePO) 5.x

SonicWALL PRO Series Firewall and VPN
Any Firewall or Gateway product

Problem

ePO Repository Pull task fails.

The Task Log file records the following Repository Pull tasks errors:

ERROR: Failed to download file Current\(...)\0000\dat-XXXX.zip from site ftp.nai.com:21, error code 10054
(An existing connection was forcibly closed by the remote host)

Problem

The EpoApSvr.log displays the following:

E #5536 naInet FTP session 1 socket 8128 RecvTimeout() failed on recv, WSAGetLastError() = 10054
E #5536 naInet FTP session 1 socket 6416 RecvTimeout() failed on recv, WSAGetLastError() = 10054
E #5536 naInet FTP session 1 Socket error occurred: 10054
I #5536 SIM_InetMgr Download file dat-4670.zip failed in session 1, nainet ret=0
e #5536 SiteMgr CheckInMirrorPackage: Download file dat-4670.zip from site McAfeeFtp::Current\VSCANDAT1000\DAT\0000 failed, hr=-2147467259
I #5536 McUpload Start http session login...
I #5536 McUpload End http session login, status=0
I #5536 McUpload Http response status code = 200
I #5536 naInet HTTP Session closed

Problem

Antivirus scanning is enabled on the firewall or gateway.

Cause

The gateway is triggering on the McAfee DAT (.zip) or (.tar) file because the ReadMe.txt file contains the EICAR antivirus test string (www.eicar.com).

NOTES:

Products other than SonicWALL can cause the same issue with the DAT download.
Any AV Gateway that incorrectly detects the EICAR test string as part of another file triggers on the DAT ZIP file.

To verify the issue, do the following:

Confirm the current DAT version by going to the following website: http://www.mcafee.com/apps/downloads/security-updates/security-updates.aspx.
Open Internet Explorer on your ePO server, copy the following URL, replacing the XXXX with the correct numbers for the current DAT version:

http://update.nai.com/Products/CommonUpdater/Current/VSCANDAT1000/DAT/0000/avvdat-XXXX.zip
The download progresses until it reaches 99%, and then displays the following error:

Internet Explorer cannot download avvdat-XXXX.zip from update.nai.com.
The connection with the server was reset.

The above message confirms that the download of the DAT file is intercepted or corrupted.

Solution

Disable detection of the EICAR test file on the SonicWALL Firewall:

Connect to the web configuration for the SonicWALL Firewall.
Click Security Services, Gateway Anti-Virus.
Click Configure Gateway AV Settings.
Select Disable detection of EICAR test file.

NOTE: Or, add the following two McAfee download websites to the Gateway AV Exclusion List.

update.nai.com
ftp.nai.com

Affected Products

ePolicy Orchestrator 5.9
ePolicy Orchestrator 5.10.x
Install/Uninstall

Languages:

This article is available in the following languages:

English United States
Japanese

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

DAT download blocked by SonicWALL Gateway scanning

Environment

Problem

Problem

Problem

Cause

Solution

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

DAT download blocked by SonicWALL Gateway scanning

Environment

Problem

Problem

Problem

Cause

Solution

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title