Endpoint Security Firewall (Linux) ERROR msgbus

[Randy_Bell1]

Recently upgraded from McAfee FW for Linux (HIPS) to Endpoint Security Firewall 10.6.5. On the hourly agent to endpoint communication, I'm getting the following error (as seen in mfefirewall.log):

Oct 07 18:30:03 fcc1014 INFO msgbus [12094] Received Timer event to read msgbus config file
Oct 07 18:30:03 fcc1014 INFO msgbus [12094] msgbus connectvity status : Connected
Oct 07 18:30:03 fcc1014 ERROR msgbus [12094] failed to even fallback approach for credentials, 512
Oct 07 18:30:03 fcc1014 ERROR msgbus [12094] exchanged information are not matching, rejecting connection.
Oct 07 18:30:03 fcc1014 ERROR msgbus [12094] Connection Failed

The effect is the firewall will not accept new options/rules via ePO.

[ktankink]

Hi @Randy_Bell1 

Please upgrade to the ENS Linux Firewall 10.6.6 version that is releasing today.

https://docs.mcafee.com/bundle/endpoint-security-10.6.6-threat-prevention-release-notes-linux/page/G...

Firewall
Reference Resolution
TSDE-2298 Firewall blocks any in/out packets during policy enforcement. This release resolves the issue.
TSDE-2658 Firewall incorrectly updates policy during partial policy enforcement. This release resolves the issue.

---

[Randy_Bell1]

I tried to install 10.6.6 FW on 6 hosts using the oasoff command line option, but it failed on all with the message:

Sent Run Now task "McAfee Agent > Product Deployment" to "mmc0701"
Run now task McAfee Agent > Product Deployment received.
Run now task started.
Run now task McAfee Agent > Product Deployment failed.
Details: Product "ENDP_FW_1060LYNX" installation failed, reason "Unknown error"..
Task Completed

[Randy_Bell1]

Additional info: agent version is 5.6.1.157. The upgrade to 10.6.5 for Threat Prevention & Firewall was successful.

[ktankink]

If possible, please submit a Service Request to Support with Agent  & ENSLFW MER files to review the install failure further.  I'm wondering if the command line options being used may be the cause.

[Randy_Bell1]

I tried both installing without the oasoff option and also pushing a policy out w/oas disabled, then installing, but again, both failed with "unknown error"

[Randy_Bell1 · Accepted solution]

I ended up installing all the latest extensions, then upgraded Threat Prevention to 10.6.6 first, then was able to successfully upgrade FW to 10.6.6. So it appears that FW 10.6.6 is not compatible with Threat Prevention (and Platform) 10.6.5.