How to troubleshoot the Threat Intelligence Exchange status "GTI Connectivity Only"
Technical Articles ID:
KB84157
Last Modified: 10/22/2020
Environment
McAfee Threat Intelligence Exchange Module (TIEm) for VirusScan Enterprise 1.x
Summary
This article contains a list of issues that can cause the TIE status on the endpoint to show GTI Connectivity Only.
Problem
When you check the TIE status on the endpoint, TIE is set to GTI Connectivity Only instead of Connected.
Cause
This issue most commonly occurs when there are communication issues with the GTI server from client devices.
Solution
NOTE: If your TIE Server appliance relies on a proxy to contact GTI, see KB87782.
Client Problem and Solution 1
Log File
Client %PROGRAMDATA%\McAfee\TIEM\TIEMVe.log
Message
Failed dxl_sync_request: 11
Setting our TIE connectivity to NO, per DXL failure
Cause
There are network problems causing the TIE client to cycle through GTI "connectivity" and "no connectivity". GTI is not reachable from the client system.
Solution
Open the firewall from the TIE server so that TIE server and GTI communication are possible, or resolve other network problems.
TIE server 2.1.x and earlier use:
tie.gti.mcafee.com(port 443)
TIE server version 2.2 and later use:
tieserver.rest.gti.mcafee.com(port 443)
To verify the communication, perform the following Telnet test:
telnet tie.gti.mcafee.com 443
This test returns:
Trying 161.69.92.21...
Connected to tie.gti.mcafee.akadns.net.
Client Problem and Solution 2
Log File
Client %PROGRAMDATA%\McAfee\TIEM\TIEMVe.log
Message
Error occurred during TS Reputation file request. Error 51
Cause
There are three possible causes:
The TIE client system was not reachable from ePolicy Orchestrator (ePO) because of network issues.
The TIE client policy is set to "Use GTI" while it is in offline mode. But, the GTI server is not reachable from the client system.
The GTI server is not consistently reachable from the TIE client system because of a network latency cause.
Solution
See the following relevant solution:
The TIE client system was not reachable from ePO because of network issues. In this case, resolve the network problems.
The TIE client policy is set to "Use GTI" while it is in offline mode. But, the GTI server is not reachable from the client system. In this case, make sure that the GTI server is reachable from all TIE clients systems. See the previous solution in this table.
The GTI server is not consistently reachable from the TIE client system because of network latency causes. In this case, resolve the network latency so that the GTI server is consistently reachable from all TIE client systems.
