Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 9 replies
  • Subscribers 1 subscriber
  • Views 28132 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Message Relays on a DMZ

slee

Scenario:

Currently have a Sophos Update Manager on the DMZ that all the DMZ servers get there updates from

The situation is that I need all the DMZ servers to report back to the Sophos Enterprise Console for reporting

The ports are open on the DMZ for 8192 and 8194 back to the Sophos Update Manager on the DMZ server but it needs to report back internally to the Sophos Enteprise Console in our internal network

My thoughts are that we need to create the Sophos Update Manager on the DMZ server as a Message Relay Server so it can report back to the Sophos Enterprise Console.   From the DMZ server back to the Sophos Enterprise Console server the ports are already open for 8192 and 8194

Do I need to create a message relay server on the SUM DMZ server? If so, how do I do that?

After I believe that we need to change the registry values, if we need to create a message relay server on the DMZ

Change registry values on the message relay

From reading the sophos article below, I need to change the registry values on the Message Relay server

Article 50832

Message relay server (DMZ) = 10.x.x.x; WORKGROUP and on the DMZ

Sophos Internal Management Server - IP Address = 172.16.xx.xx; Computer Name = SophosMgmtServer;  Apart of the Domain.

Example from the Sophos Website of the registry

a) To immediately affect the service:

  1. Modify the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Message Router\ImagePath
    to the following (all one line):

    "C:\Program Files\Sophos\Remote Management System\RouterNT.exe" -service -name Router -ORBDottedDecimalAddresses 0 -ORBListenEndpoints iiop://:8193/ssl_port=8194&hostname_in_ior=MR.domain.com
  1. Restart the Message Router service on the message relay.

b) To make the change persistent when an RMS update/reinstall occurs:

  • Modify the key HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\Messaging System\Router\ServiceArgs to the following (all one line):
    -ORBDottedDecimalAddresses 0 -ORBListenEndpoints iiop://:8193/ssl_port=8194&hostname_in_ior=MR.domain.com

Not really sure what the values mean, If I could get some help to enter the values in red

This is what I think may need to be change but not reallty sure? If anyone could confirm?

-ORBDottedDecimalAddresses 0

&hostname_in_ior=SophosMgmtServer

Change the mrinit.conf on the DMZ servers

Example on the sophos website:

MRParentAddress"="192.168.0.3,[Console-FQDN],[Console-HOSTNAME]"
"ParentRouterAddress"="MR.domain.com"    

Example what I think needs to be done, in my environment

MRParentAddress"="172.16.x.x,[Console-FQDN],[Console-HOSTNAME]"
"ParentRouterAddress"="10.x.x.x"

If anyone could help out that would be great - thanks

:56795


This thread was automatically locked due to age.
Parents
  • 0

    Hello slee and Vikas,

    \\SEC-Server\SumInstallSet

    please note that there have been changes with RMS on a SUM and the applicable "base" article is Deploying a message relay and SUM installation via the SUM bootstrap executable setup.exe. RMS does not reconfigure itself when on a SUM - perhaps the rationale is that you do not inadvertently lose the ability to manage the SUM.

    If I understand correctly you don't have to go through the steps in 50832 - 50832 applies to a setup where you relay external endpoints through the DMZ, i.e. WAN endpoint -> DMZ relay -> SEC. Your setup is "all-internal", the endpoints (servers) know your soon-to-be-relay SUM by name and address, the SUM in turn knows how to reach the management server. IMO no need to fiddle with these registry keys.

    There's a catch though - as said, you can't reconfigure RMS. Thus you'd have to reinstall SUM per the article above, the SUM installer refuses to do its work when it finds RMS installed so ...  There might be a way to turn it into a relay on the fly, it's unofficial and thus I'd rather not post it here. You can PM me (make sure you turn on PM). 

    Christian

    :56805
Reply
  • 0

    Hello slee and Vikas,

    \\SEC-Server\SumInstallSet

    please note that there have been changes with RMS on a SUM and the applicable "base" article is Deploying a message relay and SUM installation via the SUM bootstrap executable setup.exe. RMS does not reconfigure itself when on a SUM - perhaps the rationale is that you do not inadvertently lose the ability to manage the SUM.

    If I understand correctly you don't have to go through the steps in 50832 - 50832 applies to a setup where you relay external endpoints through the DMZ, i.e. WAN endpoint -> DMZ relay -> SEC. Your setup is "all-internal", the endpoints (servers) know your soon-to-be-relay SUM by name and address, the SUM in turn knows how to reach the management server. IMO no need to fiddle with these registry keys.

    There's a catch though - as said, you can't reconfigure RMS. Thus you'd have to reinstall SUM per the article above, the SUM installer refuses to do its work when it finds RMS installed so ...  There might be a way to turn it into a relay on the fly, it's unofficial and thus I'd rather not post it here. You can PM me (make sure you turn on PM). 

    Christian

    :56805
Children
No Data