mcafee and firewall - wireless printing

[Former Member]

I find i cannot print to a wireless printer with mcafee Endpoint Security 5.0 unless I disable the firewall.  

Exactly what setting(s) could i adjust to allow firewall to be enabled AND wireless printing?

Thanks so much!

Michael

[alaskar]

Hi @Former Member ,
Please share the McAfee firewall activity log from C:\ProgramData\McAfee\Endpoint Security\Logs and we shall see which rule is getting violated.

You can also enable the adaptive mode and see if you can print? This will create an auto rule with which you can later create a rule in your firewall rules policy

Also please specify if the machine is EPO managed or standalone? And what is the version of ENS installed?

cheers!

[Former Member]

See attached.  thank you so much!

Michael

[alaskar]

Hi @Former Member 

Thank you for sharing the log and screenshot. Additionally, could you also please share FirewallEventMonitor.log

This is will help to point us in the right direction. Also please specify the day so that I can narrow down the search.

Regards

[Former Member]

i've tryied the wireless printer connections this week. see attached.

[alaskar]

Hi @Former Member 

The event logs has a lot of block events. Please advise the IP address/ mac address of the wireless printer.

[Former Member]

192.168.86.2

[alaskar]

Hi,

I see that there are incoming UDP blocks found for this IP address.

Time: 04/01/2020 01:33:21 PM
Event: Traffic
IP Address: 192.168.86.2
Description: DEVICE ASSOCIATION FRAMEWORK PROVIDER HOST
Path: C:\Windows\System32\dasHost.exe
Message: Blocked Incoming UDP - Source 192.168.86.2 : (3702) Destination 192.168.86.36 : (51074)
Matched Rule: Block all traffic

Time: 04/01/2020 01:33:21 PM
Event: Traffic
IP Address: 192.168.86.2
Description: DEVICE ASSOCIATION FRAMEWORK PROVIDER HOST
Path: C:\Windows\System32\dasHost.exe
Message: Blocked Incoming UDP - Source 192.168.86.2 : (3702) Destination 192.168.86.36 : (51074)
Matched Rule: Block all traffic

Time: 04/01/2020 01:33:21 PM
Event: Traffic
IP Address: 192.168.86.2
Description: DEVICE ASSOCIATION FRAMEWORK PROVIDER HOST
Path: C:\Windows\System32\dasHost.exe
Message: Blocked Incoming UDP - Source 192.168.86.2 : (3702) Destination 192.168.86.36 : (51074)
Matched Rule: Block all traffic

Solution:

- create a new rule and select allow

- set direction to inbound

- set transport to UDP and put remote as 3702 and local port as 51074

- save the rule and move this all the way to the top of the list

this should resolve the issue for you.

[Former Member]

Thank you Alaskar for you help.  this is the first time i've done this.  can you check the attached to see if i've implemented this correctly?

thanks,

michael

[alaskar]

Hi @Former Member 

Looks good to me! Try printing and we can get a confirmation.

I am assuming this system is a standalone and not managed by McAfee EPO?