Platform: W2K3 SP 2 , ePO 4.5 patch 4, MA 4.5 patch 2
We've deployed an AH(agent handler) in the DMZ. The assignment rules are set up in ePO 4.5 (patch 4) so that DMZ systems should talk to the AH, and all other systems should communicate only with the ePO server. The ePO itself and the AH are the only AHs in the network.
The DMZ systems do communicate with the AH. We had some trouble at first getting them to do this, but DNS problems were solved and they are fine now.
Trouble is, we created a new agent (new systems | create and download agent installation package) after deploying the AH. Now, when we install that frame package on a new system, no matter where it is, inside or outside the DMZ, it tries to communicate with the AH inside the DMZ! It of course fails if it's outside the DMZ, and then it does NOT fail over to the ePO server itself.
The sitelist .xml file that is created has the AH in the DMZ first, and the ePO 2nd, but when the system fails to communicate with the AH it does not go on to communicate with the ePO server. It just fails.
I don't understand why the AH is
A) even showing UP in the sitelist.xml for non DMZ systems. SHouldnt' this be determined by the AH settings in menu | configuration | Agent handler | assignment rules? If I state in those rules that I want non DMZ systems to communication only with the primary ePO (Which I have) I dont' think the AH should even show UP in those systems covered by that assignment rule.
B) Showing up FIRST in the list in that sitelist.xml! This seems totally contrary to our AH settings.
In the assigment rules, we have it configured for DMZ systems to try DMZ AH and then fail over to ePO , and for non-DMZ systems to go to ePO only and NOT fall back to DMZ AH.
Luckily, we kept an old version of the framepkg around from before we deployed the AH.
If we deploy this version, to a system outside the DMZ, it works fine. Systems in the DMZ have not been tried, don't want to mess with them as they are working fine now.
Any tips are appreciated! I'm under time constraints and really need to get this figured out.