Skip to content
  • There are no suggestions because the search field is empty.

'NWEAgent.exe /testnet' failed even dedicated network ports are opened

Issue

NetWitness Endpoint Agent with NAT couldn't communicate with NetWitness Endpoint Server.
Network team confirmed that all ports for Endpoint server/agents are opened and network test tools(nmap) shows that it can communicate via the dedicated ports.
But 'NWEAgent.exe /testnet' results failure.


User-added

Cause

The agent with NAT is in the same Endpoint sources group with other non-NAT agents, and same policy is applied. 
Endpoint Agents with NAT should have an independent policy and group with Endpoint Server Forwarder configuration.


Resolution

  1. Go to Netwitness UI - Admin - Endpoint Sources page, and click Policies tab.
  2. Create a new policy for the Agents with NAT. Make sure you select 'Endpoint Server Settings' and enter the correct Forwarder information.
    User-added
  3. Go to Groups tab, and create a new group with the agent with NAT and the policy you create at step2.
  4. Go to Agent Packager page(Admin - Services - Endpoint Server - Config - Agent Packager tab). And enter the Endpoint Server Forwarder, then click 'Generate Agent Packager'.
  5. Move the packager file to the agent machine.
  6. Remove the old NWEAgent.
    C:\> msiexec /x {63AC4523-5F19-42F0-BC43-97C8B5373589}
  7. Run the AgentPackager.exe as administrator, then run the nwe-agent-package.exe.
  8. Check the connectivity with 'NWEAgent.exe /testnet'

Product Details

NetWitness Product Set: NetWitness Platform
NetWitness Product/Service Type: Endpoint Advanced Agent
NetWitness Version/Condition: 11.X,12.X
Platform: CentOS 7 / Alma

Approval Reviewer Queue

Technical approval queue