Policy Out of Sync
The current policy (NPC) version last reported by the agent does not match the current version generated on the cluster. This can be caused by a communications error between the agent and the cluster, the agent failing to enforce the policy with the local firewall, or the agent enforcement service not running.
Windows
-
If enforcement mode is WAF, verify there are no GPOs present on the host that would prevent the Firewall from being enabled, adding rules (with Preserve Rules Off) or setting default actions: GPO Configurations
-
Verify there is connectivity between the host and the cluster: SSL Troubleshooting
-
Verify the generated rule count is less than 2000
-
Verify the WindowsAgentEngine service is running: sc query windowsagentengine
-
Verify there are available system resources
Linux
-
Verify iptables and ipset is present with the iptables and ipset command
-
Verify there is connectivity between the host and the cluster: SSL Troubleshooting
-
Verify the tet-enforcer process is running: ps -ef | grep tet-enforcer
AIX
-
Verify ipfilter is installed and running with the ipf -V command
-
Verify there is connectivity between the host and the cluster: SSL Troubleshooting
-
Verify the tet-enforcer process is running: ps -ef | grep tet-enforcer