Multi-tenant ePO Deployment

[Former Member]

Hi

I am trying to design and deploy an ePO infrastructure to support multiple clients from different domains or workgroup in the same fashion is the McAfee cloud offering. At the moment it is still in development and i need some assistance.

My current setup is a Standalone ePO server sitting on the LAN and another Agent Handler server sitting in a DMZ.

I have client domain A and client domain B added to my System Tree. I have added the Agent Handler and added the Published IP Address and DNS Name and also created a Handler Assignment Rule with Priority 1 for the Agent Handler server only.

I now wish to publish an Agent Deployment link using port 443 to allow clients to download the Agent from the DMZ server however. When I publish the URL it still uses the Internal ePO server for link.

How do i get past this?

Thanks

[tao]

If you want the installer to use a specific Agent Handler, select it from the drop-down list. If not, select All Agent Handlers.

[Former Member]

Hi Tao

Thanks for the reply. I have attempted this step already and selected my DMZ agent handler however the URL is still generated using the LAN server

Also is there a way to change the port from 8443 to 443?

Thanks

M

[tao]

Give this a try; replace the Hostname of the ePO server with the IP address of the ePO Agent Handler to which the Client instance can connect.

Default URL:

https ://ePO1*****:Server_Port/ComputerMgmt/agentPackage.get?token=f9510c4729ae5e288ba2a4bb297c912e1612f7df

Modified URL:

https ://AH1_IP_Address:Server_Port/ComputerMgmt/agentPackageDownload/McAfeeSmartInstall.download?token=f9510c4729ae5e288ba2a4bb297c912e1612f7df

McAfee Corporate KB - How to install McAfee Agent on cloud instances using the ePO Agent Deployment ...

Through the ePO console / Configuration Server Settings / Ports; you can change Agent wake-up communication port & Agent broadcast communication port.  As for changing the Console-to-application server communication port 8443; either re-install (no really) or registry modification - be very careful with the registry modification; it would be best to contact support and have them on the phone/remote session when this is done.

McAfee Corporate KB - How to change the ePolicy Orchestrator console-to-application server communica...  

[Former Member]

OK I tried changing the URL but still no luck. I can see the browser request hitting the firewall and passing through NAT onto the DMZ AH1 server however nothing happens. If I change the NAT to hit the LAN ePO1 then I get the download page. The only component installed on the AH1 server is the Agent Handler. Is this enough for the download to work?

[tao]

Check the ePO server log records for the following error: Push Agent Installation Program to <***>.  In general, the Agent handler should build the Installer from the specified branch and from there it will be downloaded to instances using deployment URL - You may need to contact mcafee support on this one -