Endpoint Protection

Hello all , please consider the below scenerio and kindly share your suggestions as what would be the GUP selection logic for each group. Would appreciate if you can tell me if I am understanding it correctly

Group A ( clients subnets 192.168.2.0/24  , Single GUP IP 192.168.2.10 )

For the same group A also checked explicit GUP and done the following mapping 192.168.2.0 to 192.168.5.10

Now clients in group A will always first try to connect to their local (same subnet GUP) and in case local GUP cant be reached/unavaible only on that case they will connect to Group B subnet i.e 192.168.5.10 since we have done an explicit GUP mapping and will get the defs from their ?

Group B ( clients subnets 192.168.5.0/24  , Single GUP IP 192.168.5.10 )

For the same group B also checked explicit GUP and done the following mapping 192.168.5.0 to 192.168.2.10

Now clients in group B will always first try to connect to their local (same subnet GUP) and in case local GUP cant be reached/unavaible only on that case they will connect to Group A subnet i.e 192.168.2.10 since we have done an explicit GUP mapping and will get the defs from their ?

Group C ( clients subnets 192.168.10.0/24  , Single GUP IP 192.168.10.10 )

For the same group C also checked explicit GUP and done the following mapping 192.168.10.0 to 192.168.20.10

Now clients in group C will always first try to connect to their local (same subnet GUP) and in case local GUP cant be reached/unavaible only on that case they will connect to Group D subnet i.e 192.168.20.10 since we have done an explicit GUP mapping and will get the defs from their ?

Group D ( clients subnets 192.168.20.0/24  , Single GUP IP 192.168.20.10 )

For the same group D also checked explicit GUP and done the following mapping 192.168.20.0 to 192.168.10.10

Now clients in group D will always first try to connect to their local (same subnet GUP) and in case local GUP cant be reached/unavaible only on that case they will connect to Group C subnet i.e 192.168.10.10 since we have done an explicit GUP mapping and will get the defs from their ?

Thanks

Please note that all Group A,B,C,D will have their own separate non shared  LiveUpdate policies.

It looks ok. Adding these for additional reference if you haven't seen already:

What is the processing order of an Explicit GUP list within version 12.1.2 of Symantec Endpoint Protection?

Understanding "Explicit Group Update Providers (GUPs) for Roaming Clients" in Symantec Endpoint Protection (SEP) 12.1.2

Thank you for your reply Brian . I have read the articles now trying to put what I have read/learnt into a real scenerio to see if I am on the right track to understand and grasp the logic explained in the articles to get a confirmation from the community members

Expaning the scenerio a bit further . Lets assume for Group A I have checked all the settings . Use single GUP , Use Explicit GUP mapping , download updates from the management server , download updates from the Symantec LU . Now would the precedence be like this or following will be the sequence.

Step 1 . endpoints in group first try to get the content from the Single GUP assigned to the respective group

Step 2 . if local GUP is not avaible get it from the GUP mapped as an explicit GUP for this Group/Subnet

Step 3 . if the explcit GUP is not availbe clients in the respect group will get the content from the SEPM as it is checked in the policy if GUP is unavaible for 3 days go to SEPM

Step 4. Even if the clients in the respective GUP cant download it or reach the SEPM then they will go to the internet and will get the defs from Symantec LU ?

Thanks

To your initial question that's exactly how the GUP logic work and once again you are real spot on. Need less to say that your second logic is also the correct logic.

First Local GUP, if failed --> Explicit GUP, if failed -->  SEPM, if failed -->  as a final resort SEP client will go online to symantec LU to download the definitions

Thanks for the reply Praveen . Just wanted to get the confirmation