Endpoint Protection

Hi,

I have successfully deployed two SEPM in each of my network:

1. Internal Primary SEPM (called SEPMI-VM) with the connection to the internet to download the live update content.
2. External Secondary SEPM (called SEPME-VM) without the connection to the internet but synchronizing the Primary SEPM Internal above to download the live update content.

the problem is that how can I make sure that the synchronization between the servers is successfully working fine ?

At the moment I have set the replication partners to synch at 2 AM and just did Initial Synch but it sits at Submitting stage, can anyone please let me know what to do here ?

Thanks.

as a best practise you should not replicate the content. If the other SEPM is not connected to internet, then use the LUA option.

the submitting status could be becuase of it has huge date to be transmitted.

its not recommended to have content and packages to be replicated

Check this thread

https://www-secure.symantec.com/connect/forums/best-practice-sepm-live-update

Why is that the "content" is not suggested to be replicated ?

I have uninstalled the LUA server in the Primary server, therefore I'm trying to get all of the update for DMZ clients from the SEPME-VM which is I'm now trying to set it up to get the update from.

Big bandwidth is not a problem to me as the traffic is internal within 100 MB internal WAN link.

About site replication and content updates
If you configure sites on your network for replication from another site, the content updates that are in the database of the primary site will replicate as part of the database. In this case, you only need to configure updates on the primary site.

If you choose to use product updates as well as content updates, you should not replicate product updates between sites, because these updates can be quite large, and one exists for every language that you select.

http://www.symantec.com/business/support/index?page=content&id=TECH102467

Check this thread Mithun Comments

https://www-secure.symantec.com/connect/forums/best-practice-sepm-live-update

lets consider 30 content stored, it will be replicated at the first instance then subsequent replication will be 3 assuming 3 definition a day. huge badnwidth.

turn off this setting and monitor for successfull replication and let us know.

Here's what i've got from the :

yes,

Client Package and LiveUpdate Content Replication: Yes

Thanks Pete.

It has finished replicating from the secondary server, the status is now success after 3 hours of replicating. But in the primary server it is shown as Failed to submit ?

can you check what;s the time of failure, if it's more than 4 hiurs back, manually initiate replication?

HI John,

Have you received your answer ?

Hi,

You should be aware that Auto-Upgrade, Live Update (LUALL.exe) and Replication are using a common process. So if any of them is running when a replication is done, the replication will fail.

In this situation, it could display some error logs like, unexpected error with some various errors ID and sometimes a relevant log evidence like "Unable to lock the process to replicate from site XXX to site XXX".

As it was already mentioned on the previous posts, it is recommended to set some specific settings for the replication depending the database type, the quantity of clients and your logs settings.

LiveUpdate on your both SEPMs should be set to run every 4 hours or ideally once a time in daily basis.

Example:

LU schedule for SEPM 1:

from 8.00 AM to 6.00PM (it will cover all the daily distribution).

LU shedule for SEPM 2:

from 8.00 AM to 6.00PM (it will cover all the daily distribution).

Replication from SEPM 1 to SEPM 2:

Daily basis from 8.00PM

Replication from SEPM 2 to SEPM 1

Daily basis from 1.00 AM

If you're using Auto-Upgrade to deploy some of your client, ensure that it's scheduled in different hours (example: from 6.00 AM to 7.00AM if we follow the previous schedule example).

With this type of configuration, you will be sure that you will not encounter replication issue cause of this common process uses between Auto-Upgrade, Live Update and replication.

Other basic replication troubleshooting  steps:

- Ensure Windows Firewall is deactivated on the both SEPM for all the levels (Public network, Private Network, Domain Network).

- Port 8443 is not already in use and allowed for the both SEPMs.

- The certificate of the both SEPMs are valid.

- Auto Replicate : No

- Live Update should never run continuously.

A it has been said before, you might do replication of clients packages and liveupdate contents during the first replication but for the replications for the future, it's more fair to replication logs only a the clients install package do not change really often so it's not needed to replicate them all the time.

For Live Update contents, do not forget that the LU contents are download from SEP clients requests. In some situation it could happen some issue when you anticipate the SEP clients update request with replication of LU contents. That's why we recommend to perform the replication of the logs only after the first main replication has been done.

Hoping these information are helping you ;)

Kind Regards,

A. Wesker

Many thanks A. Wesker,

Auto Replicate : No --> yes I should turn that off and make sure in any deployment schedule the schedule is not overlapping.