Ah, I see, thanks for the info. I don't need to apply all security settings by myself, because our CyberSecurity is doing that for us in some cases by applying the Group Policy and their scripts etc. I'm only doing some additional things which were captured by the Vulnerabilities scan.   To the topic - I just found that Beacons have issues with communicating to the Inventory server because of denied OPTIONS:  From IIS log on the Inventory server (IPs are redacted): 2022-05-19 11:43:09 1.1.1.1 OPTIONS /ManageSoftRL - 443 - 2.2.2.2 FlexNet+Manager+Platform/16.0.1+(Windows+x86) - 404 6 0 119 At the end you can see the 404 response. And this goes for: /ManageSoftDL/ /ManageSoftRL/BeaconStatus /ManageSoftRL/Inventories /ManageSoftRL/ActiveDirectory /ManageSoftDL/ etc.   So I've left denied OPTIONS on the Default Web Page site and I've removed denial for the ManageSoftDL and ManageSoftRL sites on the Inventory servers. ... View more

Hi  Markward, thanks for the reply. I've had to apply all three points yesterday.  Regarding all questions please take into consideration that Beacons, Inventory Server, Batch server, Web server are also usually running on ISS. Not only the "Application server" which we don't have because we have large implementation. We are already redirecting users from root to /Suite on the Web server.   "HTTP Response Headers" doesn't ring a bell now...   Thanks! Regards, Pavol ... View more

Hello, FYI, Apache released information that the 2.16 was still vulnerable here and also release version 2.17. So I assume the "Removal of JndiLookup Class" didn't fix the issue. IBM didn't update the instructions for this on their web, so also their fixed installation packages will probably have the 2.16 libraries which are vulnerable. Please be cautious. In my environment I have stopped and disabled the IBM Cognos service on the Analytics server and deleted the log4j-core.jar files in both locations. FNMS is still working without this part without any issues. Regards, Pavol ... View more

Hello, in the IBM KB Security Bulletin: IBM Cognos Analytics: Apache log4j Vulnerability (CVE-2021-44228) is now a list of fixes where I see a fix for IBM Cognos Analytics which is used by the Flexera FNMS: Cognos Analytics 11.0.13 Interim Fix 3. Can we get an estimate when the hotfix will be released by Flexera for the Flexera Analytics? Thank you! Best regards, Pavol ... View more

Hello @kclausen, thank you for your insight. I believe you confirmed what I wrote: "Assuming that HTTP/Port 80 is configured, then the agent will initiate an HTTP PUT to upload inventory files TO the beacon.  This uploads inventory files from the end point to the beacon. Do download policies FROM the beacon, the agent will initiate an HTTP GET.  This downloads policy files from the beacon to the end point." So you confirmed that both PUT and GET are initiated from the Agent. And according to my knowledge that's important from the firewalls perspective to tell if the communication is one-way or bi-directional. Since in both cases the communication is initiated by the Agent then according to my knowledge it's considered as one-way from the Agent to the Beacon. And so the incoming firewall rules on the device running the Agent are not needed to be adjusted. It's not important what will happen after the connection is initiated, if it's download or upload, the connection was initiated and secured in case of HTTPS and it can go on. Don't get me wrong, I'm just trying to help other others and clear things out. ... View more

Hi @mcavanagh, can you verify if this statement is right? "NOTE: This communication will be over port 80 or 443 by default, and both directions need to be open for communication to happen.  " I think all communication is happening only from the Agent to the Beacon, so there is actually need only for one-way communication from the Agent to the Beacons. So the policy files and schedules are pulled by the Agent from the Beacon (so the network communication is started by the Agent = outgoing from the Agent and the policy/schedule is downloaded from the Beacon). And the  inventory files are pushed by the Agent to the Beacon (again the network communication is started by the Agent = outgoing from the Agent and the inventory files are uploaded to the Beacon). In both cases the network traffic is initiated by the Agent and the network communication session is kept open from the Agent to the Beacon for download or upload. So in both cases the communication (from the firewalls perspective) is only one-way from the Agent to the Beacon. This design is correct as we can have remote Agents deployed on the PCs anywhere in the world which needs to send scans over the internet to the on-premise Beacon. For this the Beacon would have the firewall opened (of course secured) for incoming connections. But the Agent doesn't have to have any incoming connections opened and that's important from the cybersecurity perspective.   And please also verify if this article is correct: https://community.flexera.com/t5/FlexNet-Manager-Blog/Data-Flow-Considerations/ba-p/195968. That one has the same language used as is used in this article.   Thank you. Have a great day. Regards, Pavol ... View more

@gposanaan That depends on the time zone of the Windows where the Batch server server is running. Default is 1am but you can change it in the Windows Scheduler. ... View more

Thanks @kclausen for info. I understand. Regards, Pavol ... View more

Hi Nicolas, thanks for the KB. I have one question which we'll need to solve before diving into Adobe reporting from FNMS. You mentioned: So, you need to integrate data from the Adobe Portal (directly from the portal through WebService integration or through an excel export or finally through Active Directory groups imports) Is this something already done by Flexera what we can use? I mean data extractor from the Adobe Portal to FNMS through API. Thank you! Regards, Pavol ... View more

We're again having the same issue. I've documented everything in reopened support case #02423354. If you can speed up the process of fixing the libraries please do so. Thank you. ... View more