Changing 'parent router' IP address

Question

I've noticed that some, quite a lot perhaps, of my PCs have application log warnings, ID 8004: Failed to communicate with parent router "10.1.10.16".

Indeed my Sophos server changed address, though not name, about a year ago. The PCs are communicating to the named server rather than the IP address by the look of the logs and I see their status updating on the console. The old address is embedded in the mrinit.conf file on the PCs - is that the significant location?

How do I tidy up this hangover and ensure all my PCs talk to the correct place?

This thread was automatically locked due to age.

jak · Accepted Answer

Hi,

As a bit of background mrinit.conf is a file created at install of the server and placed into the distribution points/CIDs for the clients to find the server and a few other settings such as ports. If the server has a static IP address, the parent address in the file contains:

If the server is DHCP, it takes the format:

The file is copied down to the client (into the program files RMS directory) by setup.exe as the machine is bootstrapped.

As the MSI of the RMS package is installed by AutoUpdate, a custom action runs an installer helper called clientmrinit.exe which finds this file to configure the Router. The values are put into the registry and used from there from then on, I.E.:

HKLM\software\Sophos\messaging system\router\

ParentAddress

So you could change this registry key to drop the IP part and restart the router.

However:

1. Future clients protected from the distribution point would still copy down the mrinit.conf with the wrong IP address in.

2. If the RMS package was updated, clientmrinit.exe would re-read the local mrinit.conf file and re-apply the original settings.

That being said, to make things permanent I suggest:

Edit all mrinit.conf files on the server to remove the ip address (or put the new IP address in but not if it is going to change again :) ). Search in Program files and the UpdateManager folders within application data. The most important are the ones in the distribution points/CIDs.

You can then be sure that newly protected machines will be correct, and if you install additional SUMS, they distribute the correct mrinit.conf files also.

For the existing clients you can then do the following:

1. Re-protect the clients, not a great solution for many machines but depending on the number of clients\number of machines that are on it could be an option.

2. Add a custom mrinit.conf with the correct values into the distribution points\CIDs the clients are using and then re-checksum the distribution points\CIDs. To do this: copy the correct mrinit.conf into the rms subdirectory of the distribution point\CIDs the clients are using and then run configcid on them. On the next update the clients will bring down the mrinit.conf in the CID and the clients will be re-configured with the correct address.

Something similar to:

http://www.sophos.com/support/knowledgebase/article/14635.html

but you're not configuring relays. This article does mention using configCID.exe and where to put the custom mrinit.conf.

I hope this helps,

Jak