Forum Discussion

maple85's avatar
maple85
Brass Contributor
Mar 10, 2020
Solved

Error installing Azure ATP Sensor on DC

We have the ATP Sensor installed on 2 DCs. Both worked till last week. Since there just one Sensor is working. On the Other DC it stopped communicating. When i RDP on the Server i saw the Service w...
  • SathishKumarPatchaiappan's avatar
    SathishKumarPatchaiappan
    Jul 02, 2020

    JTUKTECH Proxy was the issue. 

    I followed these steps https://docs.microsoft.com/en-us/azure-advanced-threat-protection/configure-proxy#configure-the-proxy  and finally it fixed couple of weeks back.

     

     

maple85's avatar
maple85
Brass Contributor
Mar 12, 2020

Hi,
thanks for your answer!
I saw this with SSL inspection but fact is that I installed the sensor with the same setup 2 month ago.
Also on my 2nd Domain Controller on the same Network everything is fine.

That´s why i can´t understand why it is suddenly not working.
Problem began with automatically stopped service. First restart of the service helped but on one point it doesn´t . So i decided to reinstall the sensor but with no luck.

 

edit: also auto update on this DC to new version did not work.

on 2nd DC no problem.

EliOfek's avatar
EliOfek
Icon for Microsoft rankMicrosoft
Mar 12, 2020

maple85 try to capture a network trace to see where it fails.

Tip: I saw a case earlier this week where the client had issues with CRL. could it be that this machine does not have updated crl while the other has so it fails ?

If not, a network trace should tell you more, but it has to be something environmental...

  • maple85's avatar
    maple85
    Brass Contributor
    Mar 23, 2020

    EliOfek

    Problem solved.

    I tried it again today with live log on our FW.

    Found the Azure IP who was decrypted.

     

    Thanks, Philip  

    • Razmi_Patel's avatar
      Razmi_Patel
      Copper Contributor
      May 13, 2020

      maple85, hijacking this conversation as it mentions a CRL:-)

      @Eli Ofek

       

      I don't see any mention of ports required for the CRL
      https://docs.microsoft.com/en-us/azure-advanced-threat-protection/configure-proxy

      https://docs.microsoft.com/en-us/azure-advanced-threat-protection/atp-prerequisites#ports



      SSL (*.atp.azure.com) TCP 443 Azure ATP cloud service Outbound


      SSL(localhost) TCP 444 localhost Both

       

      Is there more detail available?

      Thanks.
      Razmi

      • EliOfek's avatar
        EliOfek
        Icon for Microsoft rankMicrosoft
        May 13, 2020

        Razmi_Patel , you don't normally need open ports for CRLs as far as I know as long as they are updated correctly .
        I am not an SME on this one, but I think those are usually updates by windows updates...
        If anyone knows otherwise please feel free to correct me 🙂

Resources