Because there is no SEPM to push definitions, ensure the local machine can reach Symantec’s public LiveUpdate servers over ports 80 and 443.