Background/Goal:
Note: Due to personnel changes, I am assuming responsibility for our Sophos infrastructure, and I am in no way a SME on this.
My organization recently acquired a new company's infrastructure, in a remote location, on a separate domain. We are using Sophos Enterprise Console 5.5.1 for our internal assets, and the goal is to install Sophos on their devices, and manage them from our internal management server. It's worth noting we will only be managing a very small handful of their devices -- roughly 10-20.
I was led to believe that creating a message relay which is publicly accessible for their domain, within our DMZ, is the correct way to accomplish this task - as illustrated in the following KB (https://community.sophos.com/kb/en-us/50832):
Questions/Issues:
I've created a Windows 2012 R2 message relay and installed Sophos Endpoint Security and Control on it. After reading through this KB on creating the message relay, and this KB on using the ConfigCID.exe, I am a little fuzzy on the following details:
- Section 1.1 on the Message Relay instructions states "You must create a new distribution point" to set up a new update location for the message relay. The instructions state to create this new update location, but doesn't necessarily clarify what that is, or how to go about this. I assume the distribution point/update location is where the message relay pulls policies, updates, etc. If that's the case, can I just use my existing management server as the distribution point/update location? If so, does this require any additional package creation, or do I just use my existing S000\SAVSCFXP location?
- If I can use my main management server as the update location/distribution point, my next question is after I drop the mrinit.conf file into the "rms" subfolder located in "\\[Management Server]\SophosUpdate\CIDs\S000\SAVSCFXP" and insert my message relay [IP-address],[FQDN-address],[NETBIOS-address] into the ParentRouterAddress field -- where do I run the ConfigCID.exe? The KB mentions to run this "On the server with the Sophos Management Service" so I would assume my management server, but then mentions to enter "configcid \\[servername]\SophosUpdate\CIDs\S000\SAVSCFXP\" with the "path to the distribution folder". If I use my management server as the distribution point, would that just be my management server path? -- \\[Management Server\SophosUpdate\CIDs\S000\SAVSCFXP
TL;DR -- Can I use my existing management server as the distribution point/update location, and if so, do I run ConfigCID.exe from the management server with configcid \\[Management Server]\SophosUpdate\CIDs\S000\SAVSCFXP as the command?
Specifications:
Sophos Enterprise Console 5.5.1 on Windows Server 2012 R2
Message Relay is Windows Server 2012 R2
This thread was automatically locked due to age.
