Migrating EPO to new Hardware with New IP and Hostname

[prasunthapa]

Hi,

We need to migrate EPO 5.10 CU 13 to new hardware with new IP and Hostname.   We have installed  EPO 5.10 CU 13 and followed below article 

https://kc.mcafee.com/corporate/index?page=content&id=KB79283

How to migrate policies and systems from one ePolicy Orchestrator server to another server (mcafee.c...

While performing these task we found that all of the settings old server are not able to export like EPO users e.tc. 

Also we have Drive Encryption 7.3 also, so please guide to successfully perform the migration and all settings configuration are same in new server.

Do we need to export database and replace in new EPO.

Our main concern do we need to take full backup of old database/existing database and replace it with new database along with the directories C:\Program Files (x86)\McAfee\ePolicy Orchestrator\Server\extensions C:\Program Files (x86)\McAfee\ePolicy Orchestrator\Server\conf C:\Program Files (x86)\McAfee\ePolicy Orchestrator\Server\keystore C:\Program Files (x86)\McAfee\ePolicy Orchestrator\DB\Software C:\Program Files (x86)\McAfee\ePolicy Orchestrator\DB\Keystore C:\Program Files (x86)\McAfee\ePolicy Orchestrator\Apache2\conf

[aguevara]

There are a couple of things to address here:

1. if you are moving the ePO server from one server to another then it is recommended to use the snapshot feature to restore the ePO system files into new hardware, the procedure is provided here:

https://docs.trellix.com/en/bundle/epolicy-orchestrator-5.10.0-installation-guide/page/GUID-C9561397...

2. It is very important to retain at least one of those properties, either the IP or the FQDN other wise the managed nodes wont know where the new ePO server is or where to communicate, that is also covered on the same document

Note: We recommend that you change the FQDN first, and use the same IP address so that McAfee Agent on the end nodes communicates to the Agent Handler or the McAfee ePO server using the last known IP address. After successful communication, McAfee Agent will update the new FQDN of the server. Once all systems communicate successfully using the IP address, you can change the IP address as McAfee Agent knows the new FQDN.

3. It sounds like you are migrating your settings to a fresh installation of ePO on another server if you are following KB88822, not everything included on that article to export and import but you need to review the MDE check list and guidance provided on a similar article, this document provide info on how to work out those assigned users

https://kc.mcafee.com/corporate/index?page=content&id=KB79283

The following applies if you manage Drive Encryption (DE) systems:

Drive Encryption 7.1 Update 3 (7.1.3) provides the ePO administrator with a new capability. This feature allows systems to be transferred from one ePO server to another while preserving user assignments and user data. For details, see the following documentation:

• McAfee Drive Encryption 7.3.x Client Transfer Migration Guide.
• KB83186 - Statement regarding the migration of managed encrypted systems from one McAfee ePO server ....

4. you can not take the old Database and restore it to new system files on the new server, it is recommended to restore the ePO server with the snapshot feature as mentioned on answer 1

Regards

Alejandro

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

[prasunthapa]

@aguevara 

We will be having the new IP and FQDN. So we cannot have old IP or FQDN. 

We perform below steps from the article and transfer the system where they agent was able to communicate with new EPO Server.

https://kc.mcafee.com/corporate/index?page=content&id=KB79283

How to migrate policies and systems from one ePolicy Orchestrator server to another server (mcafee.c...

Our main issue is with DE keys and client user SSO. 

Also EPO console login users we were unable to export. 

Please provide us the steps to perform in new IP and FQDN and migrating EPO settings to new server.

[aguevara]

if you followed KB79283 then you should work with the MDE guide to export those users first before any transfers.

If you need assistance doing that please post on their group:

https://community.mcafee.com/t5/Encryption-PC-and-Mac/bd-p/encryption

Could you please clarify what do you mean with "Please provide us the steps to perform in new IP and FQDN " apologies 🙂 

[prasunthapa]

@aguevara 

I have posted in https://community.mcafee.com/t5/Encryption-PC-and-Mac/bd-p/encryption

Can we export epo console user details into new server.

[aguevara]

This is something that is included on the document i shared previously:

McAfee Drive Encryption 7.3.x Client Transfer Migration Guide:

https://docs.trellix.com/en/bundle/drive-encryption-7.3.x-client-transfer-guide/page/GUID-72A39FDF-5...

Please take a look at the document

Regards

Alejandro

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

[prasunthapa]

@aguevara 

We are able to transfer the DE machine info and key to new server, we missed one step of Web API in destination server. 

McAfee Drive Encryption 7.3.x Client Transfer Migration Guide:

https://docs.trellix.com/en/bundle/drive-encryption-7.3.x-client-transfer-guide/page/GUID-72A39FDF-5...

[cdinet]

Console login users are not exportable, you will need to re-set them up.  You can export any permission sets and once users are created, you can assign the permission sets.

[aguevara]

@prasunthapa was referring to MDE users

Regards

Alejandro

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

[cdinet]

Yes, but I was also answering this...

Also EPO console login users we were unable to export.