Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 6 replies
  • Subscribers 1 subscriber
  • Views 2595 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Can't connect clients after somewhat convoluted upgrade

buuuuuuuuuh

We're having trouble getting our clients to reconnect after upgrading from Enterprise Console 4.0 to 5.1. 

Granted, a straight upgrade didn't work, so I had to run the stored procs in the various versions of the console to get the database from SOPHOS4 up to SOPHOS51, and the database is now located locally on the same box as the management server.  

After changing the connection string, I can open up the Enterprise Console and see all of the devices, but hte only one connected is the server itself as the Update Manager.

Things I've already checked:

(1) The box now only has one NIC on it, so thats not an issue.  the mrinit.conf files also show this single IP 

(2) I've checked the router logs, other than a bunch of "cannot verify peer's ssl certificate, unknown ca", things seem fine - I see these after I try and push a policy:

16.10.2012 17:29:37 113C I Logged on Agent as a client
16.10.2012 17:29:37 0A9C I Routing to Agent: id=007DDFD1, origin=Router$sophos, dest=Router$sophos.Agent, type=EM-ClientLogon
16.10.2012 17:29:37 0A7C I Sent message (id=027DDEEC) to Agent
16.10.2012 17:29:37 0A7C I Sent message (id=007DDEEF) to Agent
16.10.2012 17:29:37 0A7C I Sent message (id=007DDFD1) to Agent
16.10.2012 17:29:57 0A9C I Routing to EM: id=007DDFE5, origin=Router$sophos.Agent, dest=EM, type=EM-GetStatus-Reply
16.10.2012 17:29:57 06F4 I Sent message (id=007DDFE5) to EM

(3) For a test client, I've verified that I can ping the IP address that Sophos lists for that device from the Sophos enterprise console machine.

(4) The DNS is properly set up to go to the new machine, which has the necessary files within a folder in IIS that mirrors the old server's setup.  This "should" get around the primary update policy location IP address changing as it was listed under an http address that is a DNS name we can change.

Any pointers would be fantastic right now. 

:34235


This thread was automatically locked due to age.
Parents
  • 0

    Hi,

    "C:\ProgramData\Sophos\AutoUpdate\Config\iconn.cfg" or "C:\program files\Sophos\AutoUpdate\Config\iconn.cfg" (XP/2003/2000) is the config of Sophos AutoUpdate (SAU) in terms of update location and account to access the update share. You may wish to check that on the client, this path can be accessed.

    The update location should be something like:

    ConnectionAddress = \\server\SophosUpdate\CIDs\S000\SAVSCFXP\

    This location is derived from the updating policy as in SEC you specify 2 things:

    1. The update location, e.g. \\server\sophosupdate  (ensure that the client can resolve the address using the NetBIOS address if that's what is used)

    2. The subscription. (subscription tab)

    The subscription part adds on the "\CIDs\S000\SAVSCFXP\" part as the S000 part is the subscription as seen in the "view" - bootstrap locations.  Each subscription creates a new sxxx.

    As for the update account reference in iconn.cfg, e.g.

    UserName = domain\updateaccount

    that is defined in the updating policy and although can be any account with read access to the \\server\sophosupdate share, during the install, the installer asked for an account for access the share.  This account should be listed in the security properties of the SophosUpdate share on the server and is the default account details in the default updating policy.  When accessing the share from the client, this is the account you should test.

    Hope this info helps.

    Regards,

    Jak

    :34357
Reply
  • 0

    Hi,

    "C:\ProgramData\Sophos\AutoUpdate\Config\iconn.cfg" or "C:\program files\Sophos\AutoUpdate\Config\iconn.cfg" (XP/2003/2000) is the config of Sophos AutoUpdate (SAU) in terms of update location and account to access the update share. You may wish to check that on the client, this path can be accessed.

    The update location should be something like:

    ConnectionAddress = \\server\SophosUpdate\CIDs\S000\SAVSCFXP\

    This location is derived from the updating policy as in SEC you specify 2 things:

    1. The update location, e.g. \\server\sophosupdate  (ensure that the client can resolve the address using the NetBIOS address if that's what is used)

    2. The subscription. (subscription tab)

    The subscription part adds on the "\CIDs\S000\SAVSCFXP\" part as the S000 part is the subscription as seen in the "view" - bootstrap locations.  Each subscription creates a new sxxx.

    As for the update account reference in iconn.cfg, e.g.

    UserName = domain\updateaccount

    that is defined in the updating policy and although can be any account with read access to the \\server\sophosupdate share, during the install, the installer asked for an account for access the share.  This account should be listed in the security properties of the SophosUpdate share on the server and is the default account details in the default updating policy.  When accessing the share from the client, this is the account you should test.

    Hope this info helps.

    Regards,

    Jak

    :34357
Children
No Data