VirusScan Enterprise for Storage scanner is regularly disconnected from the NetApp filer

Technical Articles ID: KB71662
Last Modified: 4/28/2020

Environment

McAfee VirusScan Enterprise (VSE) 8.8
McAfee VirusScan Enterprise for Storage (VSES) 1.x (add-on module for VSE 8.8)

Microsoft Windows Server 2008
NetApp Filer

For details of VSE supported environments, see KB51111.
For details of VSES supported environments, see KB74863.

Problem

The VSES scanner constantly unregisters and registers from the filer. Virus scan (vscan) requests to Windows Server 2008 can fail because the ticket expires.
The Wireshark trace log reports the following error:

0xc000035c STATUS_NETWORK_SESSION_EXPIRED

The Syslog messages log on the filer reports that filers are being disconnected:

[serverxr: cifs.server.infoMsg:info]: CIFS: Warning for server \\serverx: Connection terminated.
[serverx: vscan.dropped.connection:warning]: CIFS: virus scan server \\serverx: (10.48.76.139) has disconnected from the filer.
[serverx: vscan.server.connecting.successful:info]: CIFS: Vscan server \\serverx: registered with the filer successfully.

The NetAppScanLog.txt on the scanner reports:

Warning - vscan.dropped.connection - Virus scan server \\serverx (10.48.76.139) has disconnected from the filer.
Error - vscan.server.connectError - An attempt to connect to vscan server \\serverx failed
Info - cifs.server.infoMsg - Warning for server \\serverx: Connection terminated.
Info - vscan.server.connecting.successful - Vscan server \\serverx registered with the filer successfully.

Cause

Microsoft SMB2 (Server Message Block 2.0) has an Authentication Expiration timer that checks whether the session ticket of a client has expired.

Every time a client session expires, the client must reauthenticate to continue accessing the remote resources. This event drops connections between the filer and the scanner.

Solution

Disable SMB2 on the VSES scan server.

For instructions to disable Windows Server 2008 using SMB2, see NetApp article 470972. (https://now.netapp.com/NOW/cgi-bin/bol?Type=Detail&Display=470972).

NOTE: You must log on before you can access this link.

Related Information

Microsoft KB (SMB) Version 2 Protocol Specification:	http://msdn.microsoft.com/en-us/library/cc246482.aspx
[MS-SMB2]: Server Message Block (SMB) Version 2 Protocol Specification:	http://download.microsoft.com/download/9/5/E/95EF66AF-9026-4BB0-A41D-A4F81802D92C/%5BMS-SMB2%5D.pdf
Wireshark:	For information and downloads, see KB72766.

Affected Products

VirusScan Enterprise 8.8 (EOL)
VirusScan Enterprise for Storage 1.2.x (EOL)
VirusScan Enterprise for Storage 1.3.x (EOL)

Languages:

This article is available in the following languages:

German
English United States
Spanish Spain
French
Italian
Japanese
Korean
Dutch
Portuguese Brasileiro
Chinese Simplified
Chinese Traditional

Knowledge Center

VirusScan Enterprise for Storage scanner is regularly disconnected from the NetApp filer

Environment

Problem

Cause

Solution

Related Information

Affected Products

Languages:

Title

Title

Knowledge Center

VirusScan Enterprise for Storage scanner is regularly disconnected from the NetApp filer

Environment

Problem

Cause

Solution

Related Information

Affected Products

Languages:

Choose your region

Title

Title