DLP Appliance Management Extension 11.6 is not backward compatible with DLP 11.4
Technical Articles ID:
KB94962
Last Modified: 10/6/2021
Environment
McAfee Data Loss Prevention (DLP) Monitor 11.x
McAfee DLP Prevent 11.x
McAfee Network Data Loss Prevention (NDLP) Appliances (Hardware)
Problem
You observe the following when you upgrade the DLP appliance management extension to 11.6 with appliances that are running 11.4:
Failure to connect to the LDAP servers.
Policy application failures. NOTE: You see policy application failures on the DLP appliances, particularly with LDAP settings.
Cause
A change in how LDAP server information is presented to the DLP Prevent and Monitor appliances by the ePO server causes this issue. In the 11.4 software, the LDAP server information was all pre-resolved by ePO. This design was because the ePO server was always local to the DLP Prevent or Monitor appliance. In this situation, the IP addresses are the same.
In NDLP 11.6, the ePO server might be local to the DLP appliance, but might also be running MVISION ePO. The LDAP servers might be unresolvable, or resolve to a different IP than the appliances would use. As a result, we changed the behavior of the 11.6 extension to provide the host names of the LDAP servers rather than the IP addresses.
Solution
The software on the NDLP appliance and the Management extension version must match.
When you upgrade from version 11.4 to 11.6, you must upgrade both the appliance software and the Appliance Management extension.
