Port Scan attacked is logged

A single user logged on to day and has received an SEP message "A client will block traffic from IP address 192.168.x.x for the next 600 seconds (from 11/5/2014 11:30:15PM to 11/5/2014 11:40:15 PM) Port Scan attack is logged."

He tells me that he has received the same message twice more this morning, but nothing further

The IP address is from our own intranet server.

Are there some best known troubleshooting steps to resolve this issue (if it is an issue). Thanks.
nurturer69Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

nurturer69Author Commented:
More info:

Turns out the this workstation is trying to access Spiceworks which resides on our intranet server and his workstation is interpreting the intranet servers communication as an attack. Where can I open up the ports to allow their access to his PC?
0
btanExec ConsultantCommented:
Normally, you can check the Security Logs under Client Management for the alert to confirm the issue. In your case, you will need to add the intranet server's IP address in "Excluded Hosts."

To add the printer to "Excluded Hosts":
1.  Open your Intrusion Prevention Policy.
2.  Choose to Settings on the left.
3.  Check the box for Enable excluded hosts and then click the Excluded Hosts... button.  
4.  Add the IP address of your printer and choose Okay.

Do check the PC has latest engine and signature version as well. If there are further other intrusion alerts, you can create exception to allow a specific ID or signature as in
http://www.symantec.com/business/support/index?page=content&id=TECH97176
http://www.symantec.com/business/support/index?page=content&id=HOWTO55167
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
JohnBusiness Consultant (Owner)Commented:
If this issue is all internal, you can try the following (from Symantec Support):

In SEP, click on Change Settings (left side), then click on Network Threat Protection. In the Firewall tab, uncheck "Number of seconds to block" and uncheck "Enable port scan detection". Then click on OK. I suggest closing out and restarting and then test.

My laptop was registering port scans by my desktop and printer and this stopped it.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Anti-Virus Apps

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.