Endpoint Protection

Dear Community

I am in the process of designing a new SEP solution. I have already gotten some valuable inputs on multi-site design and setup.

In addition to my two sites

DC1 Site SEPM-A
DC1 Site SEPM-B
DC2 Site SEPM-C, connect to SEPM-A for replication
DC2 Site SEPM-D

I also have a third site with about 45 endpoints. I was reading through the SEP12.1 Installation and Administration Guide and came across Group Update Providers (GUP).

Is this (single GUP) something I could consider for this third site (I don't want to create an actual third site here)? Any pros/cons of such a setup?

The plan behind my two site setup is that endpoints will connect in to both, so in the event one of my DCs is down, I can still manage all my clients. I'll get this done using a "Management Server List".

Will this still work if I introduce a GUP for these 45 endpoints?

If my GUP is unavailable, will these 45 endpoints get their updates from the SEPMs in DC1 & DC2?

Yes you can designate a GUP for those 45 endpoints only, assuming it's a local site? A GUP just hands out content updates to local clients instead of pulling back over the WAN.

Yes, there is an option in the policy to have the clients go back to the SEPM if the GUP is down.

Configuring the Group Update Provider (GUP) in Symantec Endpoint Protection 11.0 RU5 and later

Hi Brian

Thank you for the feedback.

Yes, the GUP will be on the same local LAN as my 45 endpoints. This is a different location from my two datacenters where I will have my SEPM servers.

The link you provided has a screenshot where it indicates a 'fallback' to the management server if the GUP is down.

Are there any disadvantages of using GUP? If I'll go ahead and set this up, it will be configured on one of my local servers (maybe on a domain controller).

I can't say there are disadvantages. Ideally, you want to configure on a server (always up and unlimited connections), however, keep in mind any client that runs SEP can be a GUP. So if you had to setup a desktop (ie. win7/8) that would be possible as well.

This is an ideal setup and should lighten the load on your bandwidth significantly.

Thanks again Brian

The bandwidth advantage is what I think is really good. And it will also get my endpoints updated faster than if they had to download everything across my WAN link, especially if a client has been offline for a while and would have to download the entire content package, rather than just the delta.

A follow-up question.

In the link you referred to, it says the following

"Maximum time that clients try to download updates from a Group Update Provider before trying the default management server."

Does this means it will only try one management server?

Let's say that I have two management servers in two different sites. The client endpoint is aware of them both using a Management Server List.

In the event the configured GUP is unavailable, will it only try to connect to the first management server in the Management Server List or will it try both?

The client will use whichever SEPM it's currently talking to for other management purposes (i.e. policy updates, log uploads, etc).

Thanks a lot SMLatCST