ESET modules update - Download interrupted

[AndreK]

Hello,

we started using ESET Endpoint Antivirus in our organization. From the initial antivirus update (around 100mb) we receive the error, "Modules update failed - Download interrupted". If we try spamming the update button, after 20+ clicks the update completes and installed successfully. From what we tried so far, it looks like Meraki AMP is blocking the upgrade process. If we disable AMP or whitelist the client computer from Meraki Client tab, the update process is running smoothly for all our clients. We are not using any proxy. Here's what we tried without any luck so far:

• Whitelist URL's in AMP (like *.eset.com, http://*.eset.com, *.eset.com/* etc) 
• Whitelist all URL's from ESET KB332 (https://support.eset.com/en/kb332-ports-and-addresses-required-to-use-your-eset-product-with-a-third...)
• Edit the hosts file in one of our computers to use specific update ESET server that  we have whitelist from AMP with IP and URL
• Packet capture with Wireshark which shows Connection Reset from ESET server to our destination
• Whitelist the full ESET update file URL, discovered from Wireshark
• Meraki firmware update to 14.42 (Latest)
• Whitelist all of the above URL's from Meraki Content filtering
• Also tried different ISP

Do you have any suggestion about the issue?

[PhilipDAth]

Try disabling AMP and see if that resolves the problem.  If it does - you 100% know it is AMP.  If it doesn't, you know you have a different issue.  Then re-enabled AMP.

You should check the MX event log to see if it has logged that it is blocking anything.

I've add a recent issue with a bug in AMP causing AMP to crash on some downloads.  Because it is crashing rather than blocking, nothing is logged.  I believe it is resolved in 14.53.  If you are running a version below this, try upgrading.

[AndreK]

I can confirm that  by disabling AMP or whitelisting the client computer from Clients menu the update process continue without problems.

We are using MX64 with the latest firmware 14.42(latest). There is no firmware update to 14.53.

Also there are no AMP logs.

I don't  understand why AMP whitelist is not working...

[PhilipDAth · Accepted solution]

I can see 14.53 ...

If it is the bug I am thinking of - it is because AMP is crashing.

[AndreK]

You are right!

I can find it in the "Stable release candidate" category but not as Stable.

I will try this and report back to you.

Thank you

[AndreK]

I would like to confirm that 14.53 Stable release candidate fixes the issue.

With this firmware there was also no need to add ESET to the whitelist.

Thank you @PhilipDAth  🙂