Internal epo using NAT for external clients

[matti.rantakari]

Hi,

I'm planning to configure internal epo using NAT for external clients. I have couple of questions about the configuration.

Is port 443 enough for NAT rule or does it need port 80 also?

When updating public dns and public ip to internal agent handler, which address agent then first connect, the public dns or the old internal address? Can I change the order somewhere?

Does agent sitelist get automatically updated?

Do I need some other configuration? My plan is that external clients can connect to internal epo and get updates using agent interval.

[cdinet]

kb66797 lists port requirements for communication through a firewall. However, what we recommend rather than opening up your epo server to external traffic is to put an agent handler in the dmz and use a published dns and IP for that in agent handler settings. The epo product guide has a section for installing an agent handler in the dmz.

[matti.rantakari]

Hi,

Thanks for the reply. I'm trying to install DMZ agent handler but the problem is that installation says "installation could not find compatible ePO-server for given parameters". What could be the problem?

I have latest epo installed:

ePO Build: ePolicy Orchestrator 5.10.0 (Build 2428)

Update Installed: Update 4 (2.0.0.454)

I have extracted AgentHandler installer from the latest epo package "EPO510_2428_18_LR4.zip"

[matti.rantakari]

I can ping the epo server using name. I tried also with ip but same result.

I can telnet the epo server port 8443

I'm using admin account to connect.

Strange that still it gives error no compatible epo found...

[cdinet]

Go through KB66797 to ensure you have all the right ports open. Port 8444 is also required, as well a others. Also, since there is no dns resolution typically in the dmz, add a host file entry for the epo and sql servers on the agent handler with NetBIOS and fqdn so the agent handler can resolve them. Also, since typically a dmz server isn't on the domain, you will need to use an sql account instead of a Windows account to authenticate to the database. So if epo is using a Windows account, that is ok to continue to do so, but you will need to set up a separate sql account using sql authentication with appropriate permissions to the database and use that account with the agent handler.

[matti.rantakari]

From dmz server I can telnet epo server ports 8443, 8444, 8081, 80, 443.

From dmz server I can telnet sql server port 1433.

From dmz server i can telnet ldap ports also.

I added also hosts file entry for server names. I tried setup with sort name, fqdn and ip. Same result...

I confirmed the port in use is the default 8443.

From dmz server I can also login epo console with browser.

Can you confirm that the agent handler setup files are correct and are matching with my epo version?

I have downloaded the newest zip file "EPO510_2428_18_LR4.zip"

My epo version is:

ePO Build: ePolicy Orchestrator 5.10.0 (Build 2428)
Update Installed: Update 4 (2.0.0.454)

Still I'm getting this error. In this screen I'm using epo admin user account.

[matti.rantakari]

This is the error log. Error=12175

[matti.rantakari]

Found the connection problem. There were some chipher suites disabled.

• TLS_RSA_WITH_AES_128_CBC_SHA256
• TLS_RSA_WITH_AES_256_CBC_SHA256
• TLS_RSA_WITH_AES_128_CBC_SHA
• TLS_RSA_WITH_AES_256_CBC_SHA

Next problem. There is IIS running on same dmz server and the port is in use.

Should I change Agent-to-server port to some other? If I change it what will happen to currect client connections? Can they connect anymore?

[cdinet · Accepted solution]

You can change that port in epo, but it would be better to first find out what is using port 80 on that agent handler. What function is that server for - just agent handler, or other purpose also? It would be easier to remove the program on the agent handler, if possible, causing the issue. The most common is IIS, but not always. You can run this in the command prompt to find out what processes are using that port: net stop http That will show you what processes it wants to stop. If you really want to change the port instead, this KB will walk you through that. It will affect any 4.8 agents until they get an updated sitelist, but your 5.x agents don't use port 80 any longer. https://kc.mcafee.com/corporate/index?page=content&id=KB67605