Firewall – Symantec Endpoint Protection toggle of firewall rules by script

I have replicated Symantec Endpoint Protection from the Symantec Server to the Clients in the past, and it worked great on a LAN enviroment. I wonder if the VPN is the catch. I would be willing to bet this weird port action isn't allowed by your VPN tunnels. What you may look at is just coping the files off the server from the \'YourSymantecServerIPAddress'\vphome\CLT-INST share folder that shold be setup on the Symantec Server. You can hope that once you install the files from the share, it should point back to the server for updates and these take place on only a single port, much eaiser to track down what needs to be opened up.

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007071909500548 says:

"What ports do clients use to communicate with the Symantec Endpoint Protection Manager? Clients use the default ephemeral ports (1024 to 65535) for TCP for network communications. The ephemeral port range that is used, however, rarely exceeds 5000."

Solution : http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/684e821eb0b394f8882575070060f2a4?OpenDocument

To manually enable clients to browse for files and printers

1. In the client, in the sidebar, click Status.
2. Beside Network Threat Protection, click Options > Configure Firewall Rules.
3. In the Configure Firewall Rules dialog box, click Add.
4. On the General tab, type a name for the rule and click Allow this traffic.
5. On the Ports and Protocols tab, in the Protocol drop-down list, click TCP.
6. In the Remote ports drop-down list, type 88, 135, 139, 445.
7. Click OK.
8. In the Configure Firewall Rules dialog box, click Add.
9. On the General tab, type a name for the rule and click Allow this traffic.
10. On the Ports and Protocols tab, in the Protocol drop-down list, click UDP.
11. In the Remote ports drop-down list, type 88.
12. In the Local ports drop-down list, type 137, 138.

13. Click OK.

    To manually enable other computers to browse files on the client

14. In the client, in the sidebar, click Status.
15. Beside Network Threat Protection, click Options > Configure Firewall Rules.
16. In the Configure Firewall Rules dialog box, click Add.
17. On the General tab, type a name for the rule and click Allow this traffic.
18. On the Ports and Protocols tab, in the Protocol drop-down list, click TCP.
19. In the Local ports drop-down list, type 88, 135, 139, 445.
20. Click OK.
21. In the Configure Firewall Rules dialog box, click Add.
22. On the General tab, type a name for the rule and click Allow this traffic.
23. On the Ports and Protocols tab, in the Protocol drop-down list, click UDP.
24. In the Local ports drop-down list, type 88, 137, 138.
25. Click OK.

Somehow I missed that during my initial searching. The version I'm using (5.1) didn't match the steps exactly, but once I implemented the rules, I was able to access my share.

I basically ended up creating 4 rules rather than the one that I was trying to do as well as adding the rules for port 88 (according to wikipedia this is Kerberos, which seems a little odd). Once this was done I was able to access my share as intended..