Patch Management Group

Our environment consists of 1 notification server, and 3 site servers with one of those in the same vLan as the Notification server, the other two are at remote locations.  All 3 site servers are task and package servers.  I have my internet gateway server sitting in the DMZ ready for setup.  I know port 4726 inbound from the gateway, needs to be open to my NS.  However, my question is the one package server I have in the same vLan as the NS would this one need to have port 4726 inbound to it as well.  Or will just having the firewall open for the NS?  I've seen diagrams and read documentation which references a standalone package server for the DMZ, however all of my package servers serve internal systems as well.  The server in my vLan is also my imaging server, so I don't want to jeopodize the functionality.

Was wanting to get this done by this weekend but didn't know if I could use this one server as a package server for both internal and external clients.

Hi mmathews,

1) When you are creating a "Symantec Agent"  (CEM Web Site) on Notification Server machine, then it automatically adds 4726 port in 'InBound' Firewall rule settings.

2) Same does "CEM Gateway" when you are specifying on which port to listen incoming connections.

So Site Servers, CEM Agents and NS will be communicating by 4726 via CEM Gateway through 777 port.

3) Information on CEM Site Server binding settings says that you need to have open InBound firewall rule for port on which Site Server is working (4726, or 443, etc)

Hope this information gives an answer for your case.

Other information regarding CEM:

• https://www.symantec.com/connect/articles/how-install-cem-functionality-smp-75-sp1
• https://www.symantec.com/connect/articles/about-different-cases-troubleshooting-cem-functionality

Regards,

IP.

Mathews,

I implemented the CEM in my environment a few months ago. I used the existing Site server in the same LAN as NS and added them to the Internet site. They serve both internal and external clients without major issues.We use also our Package server as PXE servers together with Ghost Solution 3.1 for image deployment. Below is the diagram with the ports opened in DMZ for internal and external connections.

I hope it helps.

Tomasz