Endpoint Protection

Hi all,
I am Vaisakh. One of my client purchased symantec endpont 11.x with 275 licences. Now its my turn to install the product. I am not familiar with the product. I have a central server in Head Office with win 2003 server to be used to control all clients. And i have more than 20 branches connected with 128 and 512 kbps leased line. I want to configure the central server to download updates from the Symantec update server. And i want to configure all the HO clients to take updates from HO server. And also i need to configure one branch pc to  take updates from the HO server and distribute that with the corresponding branch clients.  I need to configure all branch clients to take updates only from the corresponding branch servers, they should not contact the HO server for updates. This is the goal to be achieved. I also need to help to configure custom client installation package for each branch. and also please specify what things are to be installed on HO server and the remote sites. also need help in configuring policies. if u need any more details pls revert....Pls give me the solution by step by step...like...server, manager console configurations etc...installation procedure in detail....which installation should i choose....push or custom client installation package to be run locally on each computer...is there any need foe configuring liveupdate administrator some where

Install SEPM at the main site and for the branch office configure  GUPs.
With the GUP in place the clients at the branch office will not  go to the HO to get the update , they will take it from the GUP located ,locally That will save bandwidth and achieve your objectve

 

Title: 'Symantec Endpoint Protection 11.0 Group Update Provider (GUP)'
Document ID: 2007092720522748
> Web URL: http://service1.symantec.com/support/ent-security.nsf/docid/2007092720522748?Open&seg=ent
 
Title: 'Configuring the Group Update Provider (GUP) in Symantec Endpoint Protection 11.0 RU5'
Document ID: 2009092901593448
> Web URL: http://service1.symantec.com/support/ent-security.nsf/docid/2009092901593448?Open&seg=ent
 
 
Title: 'Best Practices with Symantec Endpoint Protection (SEP) Group Update Providers (GUP).'
Document ID: 2009050510573148
> Web URL: http://service1.symantec.com/support/ent-security.nsf/docid/2009050510573148?Open&seg=ent


Creating custom client installation packages in the Symantec Endpoint Protection Manager console
http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/c741ec26fa674b1e8825738a0076abf3?OpenDocument

use GUP
http://service1.symantec.com/support/ent-security.nsf/docid/2008121722041748.

this is to create custom install package

http://service1.symantec.com/support/ent-security.nsf/docid/2008121722041748

Pls give me the solution by step by step...like...server, manager console configurations etc...installation procedure in detail

1. Install SEPM server
2. Deploy  SEP to all your  computers( even the  one's  in remote  locations).
3. Configure GUP.

which installation should i choose....push or custom client installation package to be run locally on each computer...is there any need foe configuring liveupdate administratorr some where

Hi,

Below is the Step by Step solution as requested by you:

1. Install the SEPM.
2. Create custom install package.
3. Create groups for each branch office.
4. Push the package to the client (Use migration deployment / Find unmanaged computer / Create the EXE and sent it to the Branch office so that it can be installed locally).
5. Create a Live Update Policy to assign a GUP for each branch office.


Please refer to this:

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/ac120aa7be3e522688257346007dfe45?OpenDocument

is there any need of the live update administrator in the HO. and also where i need to set up the GUP in HO or in each branches and how the client can be configured pls help me to set it up

The SEPM will download the defintions and give it the GUP, There is not need for LUA at the HO.

The GUP needs to be set at each locations

Have a look at these links.If you have any more queries pls post
Installing Symantec Endpoint Protection 11.0.6 (RU6) for the first time  
Tips for installing SEP in Low Band width 

i need to configure one machine in each branch to take updates directly from the HO server and all branch clients should take updates only from the corresponding server. How can i do that..pls describe the steps

How many clients will be present approximately in a branch?

HO is having about 100 and branches between 10 to 20

Then you can go for GUP.In each branch designate one PC as GUP so that only this PC will download virus defs from HQ server.

how to configure that...

'Configuring the Group Update Provider (GUP) in Symantec Endpoint Protection 11.0 RU5'

after installing the sepm and trying to login i got an error that the requested url cannot be retrieved....while trying to url http://localhost:8014/Reporting/dashboard/homepage.php

the following error was encontered
 connection failed
the system returned
(111) connection refused

Attach the scm-server-0.log which is present in Program Files \Symantec\Symantec Endpoint Protection Manager\tomcat\logs

the log attached

Can you give us a screen shot of the error.also?

screen shots attached

pls check the attachment

Enable advance logging.Refer this KB
How to debug the Symantec Endpoint Protection Manager console in Symantec Endpoint Protection 11.x
and attach new log file

If you have enabled Internet Security enhancement enabled in Add/removed components, remove it and see

server not taking updates from web it always try the local machine itself

server not taking updates from web it always try the local machine itself

Are you telling about SEPM software?Or about the client which is present in the same server?

how you are accessing the internet in machine. 

OPen the SEPM console

Go to Admin -- Servers -- Right click on Local site - go to Live update -- Edit source servers-- Use default live update server

And also check the 

In the control panel

Symantec live update -- Use HTTP and FTP all internet options

And make sure you are able to access symantec internet from your IE.

I am accessing internet via a proxy server 192.168.0.245...port 3128...and iam able to aceess internet from the server..pls see attachment

After the update failure i am not getting the home monitors and reports page in the SEPM console it shows an error.

http://localhost:8014/Reporting/dashboard/homepage...

the following error was encontered
 connection failed
the system returned
(111) connection refused

pls chk the txt file also

pls see this

http://support.microsoft.com/kb/907273

 

Try changing IUSER password

I am accessing internet via a

I am accessing internet via a proxy server 192.168.0.245...port 3128...and iam able to aceess internet from the server....the SEPM Update always fails pls check the attachment i posted already.

Have you configured proxy for SEPM

 

SEPM-Admin-Server--Local Site-Server [Server name] --Properties--Proxy Server

Yes its already configured

Open command prompt Browse to \Program Files\Symantec\Symantec Endpoint Protection Manager\bin type lucatalog -update...Try by running download liveupdate content....

Now its showing LUALL.EXE has been Launched....how much time(approx.) it will take to download the updates till date...

It depends on the Internet link speed and performance of your SEPM etc.It may take even a few hours...

how i can monitor the downloading......status of the files downloading......i already seen the Show liveupdate downloads but it shows no content has been downloaded

Go to C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads.SEPM will download the updated here first.

Hi, In my scenario there is one more problem...our variuos branches using different ip ranges. And in all brances there is an ACL configured in the router to allow onlly 192.168.1.0 range ip to communicate. My HO SEPM ip is 192.168.0.64 and i put one more ip 192.168.1.111 in SEPM for branch communication. all the HO machines using 192.168.0.0 range...the update and all things running in HO smoothly. Now i am going to deploy the clients in my first branch which using an ip range 192.168.15.0 and i am planning to configure 192.168.15.2 as the GUP. How i can plan this scenario for this branch and i can also need to plan my other branches

As a second option i got an idea. can i install SEPM in all branches and is it possible to configure the Branch SEPM to take updates only from the HO SEPM. If that is ok the i can make client packages for each branches from branch SEPM. and it will take updates only from the Branch SEPM...IS the idea possible...

You can go for second option too..its possible while installing Branch office SEPM go for option Additional site and make the first site as your HO SEPM

IF i change the ip of the SEPM server after creating one client installation exe. It will affect the client server connectivity or not

My SEPM is having an ip 192.168.0.64 and i created an installation package. After that i created one test group and also set a policy to use one pc with 2 ips 192.168.0.181 and 192.168.1.178 and in that policy i configured to use 192.168.1.178 as the GUP. all my clients are using 192.168.1.0 range. but after the installation there is no update is happening is there any fault with the configuration. At the time of the client package creation my ip was 192.168.1.111. is that affect the client package