Host IPS 8.0 Firewall policy is not enforced correctly

Technical Articles ID: KB82597
Last Modified: 11/3/2020

Environment

McAfee Host Intrusion Prevention (Host IPS) 8.0

Problem

The Host IPS 8.0 Firewall does not enforce the Firewall policy correctly because of corruption in the registry. The registry entry for the Host IPS Firewall policy has an extra key: HKLM\SOFTWARE\McAfee\HIP\Config\Firewall\Groups\1\ChildRules\Matches. It causes the Host IPS Firewall to mismatch Firewall rules for allowed traffic. Attempts to remove this registry key manually fail.

Solution

The issue is not reproducible on demand, and McAfee and Microsoft have had limited success at debugging a reproduction.

To troubleshoot this issue, the development team requires a virtual image of a system with the corrupted registry. For details about creating a virtual system image using VMware Converter, see KB60323.

Also, obtain the following:

IMPORTANT: The following files are required for Technical Support:

Minimum Escalation Requirements (MER) files for your specific product. For information about downloading the MERs for each McAfee Enterprise product, see KB59385 - How to use MER tools with supported McAfee Enterprise products.
Other files and logs, as requested by Technical Support.

To contact Technical Support, go to the Create a Service Request page and log on to the ServicePortal.

If you are a registered user, type your User ID and Password, and then click Log In.
If you are not a registered user, click Register and complete the fields to have your password and instructions emailed to you.

Affected Products

Host Intrusion Prevention 8.0
Known Issue/Product Defect

Languages:

This article is available in the following languages:

German
English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro
Chinese Simplified

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

Host IPS 8.0 Firewall policy is not enforced correctly

Environment

Problem

Solution

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

Host IPS 8.0 Firewall policy is not enforced correctly

Environment

Problem

Solution

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title