Endpoint SWAT: Protect the Endpoint Community

Can anyone provide the Pro's and Con's using a Replication server and what does a replication server really do?

Will it provide a place where policies and logs get received and then sent to the primary SEPM later on? What is the impact on network bandwidth>will it assist or merely a backup if the primary SEPM fails?

Running SEP 12RU4a with +- 28000 clients, 4 SEPM's . Site A (HQ) and Site B(remote site with about 3000-5000 clients max)

What are the requirements? Can it provide definition updates as well?

Some articles here:

http://service1.symantec.com/SUPPORT/ent-security.nsf/2326c6a13572aeb788257363002b62aa/ab6f6bdaeabbd882ca25754b0074a662?OpenDocument

Best practices for replication server sizing

Best Practice for setting replication frequency

Replication and considerations

http://www.symantec.com/connect/articles/replication-and-considerations

A replicated site, is a SEPM and DB that serves as an additional management point for remote clients.

Here's an article on how it all works:

http://www.symantec.com/docs/HOWTO81035

As an aside, Symantec provide some guidelines of when replication should be used, in the below article:

http://www.symantec.com/docs/TECH92051

For a remote site of only 3k - 5k, it's probably not recommended