Managing Machines over the Internet with BMC FootPrints Asset Core

Transcription

1 Managing Machines over the Internet with BMC FootPrints Asset Core Customer Requirements: A. I have desktop/servers at multiple sites which do not have a dedicated link to my datacenter, but have access to the internet. How do I manage these machines using Asset Core? B. I have laptop users that rarely ever VPN into the network. How do I manage those machines using Asset Core? Background Information: Managing machines that are part of a LAN or have a dedicated point to-point is easy because the Asset Core client agent and Asset Core parent always have an uninterrupted (reliable) communication path. However, managing computers that are not tethered to the company intranet is more challenging. These elusive systems include (but are not limited too): Type 1 = "Road warriors", typified by sales people who are often offsite, travelling for events or visiting customers Type 2 = Home workers who work isolated from the company network but have an internet connection Type 3 = Company site locations which do not have a dedicated connection to the corporate network ( sometimes referred to as offline-wan) but have an internet connection For "road warriors" and even "home workers", a VPN software connector typically exists. However, that does not mean it is utilized. BMC FootPrints Asset Core's native client agent and Relay architecture enables it to "intelligently" solve for the above mentioned needs with an "over-the-internet" based configuration using an advanced Relay architecture configuration. Relay selections can be configured by the following methods: Static: The parent name is set statically by configuring the agents association attributes. Dynamic: Different options are available to define a "dynamic" level of Relay selection. o Auto-select the closest Relay from a defined list of Relays. Page 1

2 o Scan the network using a native auto-discovery module to detect all Relays. The agent will select the closest Relay as the parent, based on the quickest response time (in other words which Relay responds to the request first). o Custom Scripted Relay Selection The agent will execute a script at startup, and at every IP change. The script will automatically return the name of the relay to use. Hybrid: A mix of both static and dynamic capabilities. All three methods mentioned above set a "Primary" Relay. To further introduce redundancy and/or visibility through BACKUP RELAYS, configure the agent to have one or many backup relays that will serve as a temporary association point until the Primary is back online. In other words the agent will continue to look for its Primary based on a lookup interval. Here is a high level concept of the setup needed to solve for managing over the internet systems. Page 2

3 Footprints Asset Core Solution: Step 1. Configure a machine to act as an internet RELAY(which is simply a role of the Asset Core client agent). An internet RELAY server has two distinct characteristics: A. The system is a multi-homed machine (or in other words it has two NIC cards) with an external facing IP address/interface and an internal IP address/interface. The external interface serves as the public contact point for client agents that will be reporting over the internet. The internal interface serves as the private contact point between the Relay and the Master Server. B. The system is designated as an Asset Core RELAY Step 2. Configure your corporate network firewall to enable inbound communication through port This is so the internet relay can be directly accessible on the internet via a port (default 1610) by client agent machines. As a best practice place the internet Relay server in a DMZ (demilitarized zone), sometimes referred to as a perimeter network. In addition, enable SSL communication between the internet relay and the client agents communicating over the internet to maintain security/encryption of data. Step 3. Configure an Asset Core client agent rollout profile specifically designed for the "TYPE Page 3

4 X" of over the internet system. The easiest type of internet managed machine configuration is a "Static" configured "Internet" Relay (solves for Type 3 mentioned above). A. The "Relay" tab must contain the public IP address of the internet Relay server as the parent. In addition, the "Parent Name" field in the "Relay.ini" file can be edited on existing clients. Below is a static example with Asset Core configuring an agent with a "Primary" Relay. There also exist dynamic options for roaming users (which may have VPN or plug directly into the corporate network when onsite). However, this document will focus on a standard over-the-internet configuration. Page 4

5 B. The most common Type 3 case is that the endpoint machines will be behind a NAT-based router. Therefore, the remote agent w i l l communicate through HTTP to the public internet Relay and download/execute assignments as well as report data. The agent accomplishes this "polling" architecture through something called a "RequestInterval" parameter located in the Agent Configuration->Request for Notification Interval section. By default it is set to 300 seconds which translates to 5 minutes (this interval can be set to a different value). In addition, you may use an agent configuration operational rule to set a new interval on existing "over the internet" based clients (but they will be a slave to the original interval the first time after you assign the rule, naturally). By virtue of this method and constraints around NAT architectures, FootPrints does not have the ability to directly connect to an internet-based client agent or perform "on demand" operations (instant actions like that of a LAN/WAN environment). Step 4. Roll out the agent to target machines. Provision a system with the a "internet" Asset Core client agent in one of 2 ways depending on your rollout strategy: A. Push the "internet" client agent configuration mentioned above to systems when they are connected directly to the LAN/WAN prior to its operating in an over-the-internet situation. B. Pull the "internet" client agent configuration. The following method simply creates a selfinstalling Asset Core Agent rollout package (.exe) on the internet Relay server and also makes that package accessible via the Relay servers external facing interface (via a native web based rollout portal). Make sure the "internet" Relay server has the "Rollout" module loaded. Page 5

6 Configuring a "Pull" configuration is required to map to a Rollout Server so a package may be generated on THAT machine. Below the internet Relay server is designated as the Rollout Server so when "Generate Rollout Package" is clicked the package gets generated on the Relay server. Once a package is generated, map to the server name>:<rollout server port>/rollout to retrieve the install package. Login to the rollout server page with an Asset Core Page 6

7 administrator account with permissions to see rollouts. Below is an example of an Asset Core administrative account that has access to rollout out packages. Page 7

8 Below is an example of an Asset Core administrative account that DOES NOT have access to rollout out packages thereby configurable as such. We will be updating this document on a regular basis when new processes are in place. Page 8