Capture Client enforcement

RedNet

Hi,

Is there a more detailed explanation on the enforcement for capture client on the sonicwall.

https://www.sonicwall.com/support/knowledge-base/capture-client-enforcement-through-firewall/180424061807489/

I am trialling at the moment and have enabled as above. I had already installed the capture client (v3.0.11) on my test laptop from the captureclient.sonicwall.com cloud portal.

When I put myself in the zone behind the on prem SonicWALL with Client AV enforced it asks me to install the agent again and does not recognise that I already have it installed.

The on prem SonicWALLs SN is associated correctly in the same captureclient.sonicwall.com tenant as a registered firewall.

I would like to get some detailed info on how this operates.

Thanks

shiprasahu93

@RedNet,

What firmware is present on the firewall? Please make sure it is also on 6.5.4.6.

Also, if you manually add the IP to enforcement list under client AV, does it still show you that error?

What browser are you testing with and have you tried restarting the end machine?

As far is goes technically, the SonicWall uses UDP based probing to check for the agent and redirects to the install page if it does not find the agent installed.

If you can collect the TSR and logs from the end machine, support should be able to determine the root cause of the issue.

https://www.sonicwall.com/support/knowledge-base/how-to-export-logs-from-the-capture-client-console-and-the-endpoint/180404145130292/

https://www.sonicwall.com/support/knowledge-base/how-do-i-send-capture-client-tsr-to-tech-support/180330065513452/

Please mention the Tenant ID and hostname if you are sending the TSR directly to support.

Thanks!

RedNet

@shiprasahu93

Firewall is currently on 6.5.4.4-44n

Settings on the firewall and the Capture tenant were all present and correct.

I removed the Capture client and installed from the firewall enforcement prompt/browser redirection (which seems to only work in IE).

Once it was installed using the on prem firewall prompt to download capture client it worked as expected.

I am going to try another uninstall and install from the capture portal (instead of the on prem firewall prompt) and see if it was an anomaly or only works when installing from the fw prompt.

I assume it is supposed to work in both cases?

shiprasahu93

@RedNet,

If Capture Client is already installed on a machine and it is sitting behind a zone where Client AV enforcement is turned ON, it should not ask you to install again and let you through.

I remember an issue like this in the past where the connectivity to software.sonicwall.com was failing on 6.5.0.x version. But, since you are on 6.5.4.4 that issue should be fixed.

Please try another machine and let us know how that goes.

Thanks!