Endpoint Protection

Hello,

I have SEPM 12.1 with the following configuration:

1 x Master Server which connects to Internet and gets the updates

1x  Backup Server which receives data from Master at a scheduled time. It replicates all the data from Master at a certain time.

1 x Child server per remote site which receives data from Master or from Backup in the event of Master failure

N x endpoints / client PCs which connect to a Child server per remote site

We have implemented this configuration to allow any client PC connect to it's corespondent Child Server for being updated instead of connecting to Master or Backup due to bandwidth limitations and to avoid extra WAN network traffic.

Problem:

- Many Client PCs / endpoints connect directly to Master instead of their Child Server. This causes heavy traffic load and connectivity problems!

- Despite all our efforts, we have not been able to know why this happens.

Can you please help us out?

What are your recommendations?

Thank you very much.

Kind regards,

NS

Management Server List?

http://service1.symantec.com/SUPPORT/ent-security.nsf/2326c6a13572aeb788257363002b62aa/e2ac3b646ae21969882573c20063533f?OpenDocument

Using GUP's instead of a SEPM at each remote location will save you more bandwidth as you will not have to replicate to each of these remote servers. What you would end up with is the Master and Backup SEPM at your main site (so you still have failover) then with GUP's setup at remote locations only those GUP's would be going over the WAN to download content from Master/Backup SEPM.

Hi Cameron,

What do you mean like using GUPs instead of SEPM? We do not want clients to connect to WAN because of bandwidth, we want them to connect to local server to get updates. Only local servers will connect to Master and get updates at certain times...

Do you have any other ideas?

Thanks.

Kind regards,

NS

GUP at the local location will help clients to get the updates and save bandwidth.

http://www.symantec.com/docs/TECH93813

Hi Pete,

This was the configuration I had:

On remote location we have one server acting as a GUP and then having a policy in LiveUpdate to configure all the SEPs from that location to update from the local GUP.

Problems:

- In certain GUPs, several SEPs appear offline in the SEPM when in fact they are online.

- We also have several clients that after installing the correct software package, we can see that they are not pointing the the correct GUP. If we try to uninstall, deleting registry entries and then install again it with the correct package it does not work!

What can this be?

Thank you.

Kind regards,

NS

The GUP's will function excatly as you described except that you wont have to have the additional SEPM's installed. A GUP will be the only machine at the location that will connect back to the master server and download conent. When the clients check in with the master server, the master will check the GUP list and tell the client to download content from a GUP in its local subnet.

So the GUP will function exactly like your additional SEPM's do now (being the only machine to download content from master) while avoiding having to install an additional DB, replication partner and not to mention the resources that a SEPM requires to run (not a lightweight application as it is designed to host thousands of clients).

Are your clients able to telenet GUP on port 2967 ?

Are these GUPs downloading content from SEPM ? 

The liveupdate policy which mentions that GUP should be applied on the group where the GUP client reports to.

Hi NS,

Just a quick note: this Connect Forum works on a voluntary peer-to-peer basis, with admins helping one another out.  If you have an urgent caase and require professional assistance to ensure that your network remains protected, please do contact Symantec Technical Support.  

All the best!

Mick