BigFix Auto Relay Selection for a distributed environment with approximately 40 branch locations. The objective is to ensure that roaming laptops always connect to the local branch relay based on their current network location while maintaining the required failover and relay hierarchy.
Environment
40 Branch Offices
One Local Relay in each Branch
Two Top-Level Relays in the Data Center
DMZ Relay(s) for Internet/External Clients
Roaming Windows laptops
Expected Behavior
If a laptop is connected to Branch A, it should communicate only with the Branch A Relay.
If the same laptop moves to Branch B, it should automatically switch and communicate with the Branch B Relay.
If the laptop moves to Branch C, it should automatically communicate with the Branch C Relay.
This behavior should apply to all branch locations, ensuring the client always reports to the relay at its current location.
If the local Branch Relay is unavailable, the client should automatically fail over to Top Relay 1 or Top Relay 2.
Branch clients should never connect to relays in other branches while their local branch relay is available.
Branch Relays should communicate only with the Data Center Top-Level Relays and should not communicate with other Branch Relays.
When the laptop is outside the corporate network, it should communicate only with the designated DMZ Relay.
Once the laptop reconnects to the corporate network, it should automatically switch back to the local Branch Relay based on its current location.
Current Issue
Auto Relay Selection is enabled; however, clients are not consistently selecting the relay at their current location.
For example:
A laptop physically located in Branch A is reporting to the Branch F Relay, even though the Branch A Relay is available and healthy.
Similarly, when laptops move between branch locations, they do not always switch to the local branch relay as expected.
Hi @Shahban , this is actually a fairly common issue, and I've seen it multiple times across different org, including my previous company as well.
My first recommendation would be to enable Client Debug Logging on one of the affected clients. While the debug log does not always explain the exact reason why a particular relay was selected, it does record relay registration, relay switching events, communication failures, and the final relay selected. This can help determine whether the client is failing relay discovery, experiencing network communication issues, or switching relays unexpectedly.
I would start by verifying the following:
DNS resolution of the expected relay FQDN.
ICMP connectivity from the client to the expected branch relay.
Firewall connectivity.
Check tracert from a healthy client and one of the affected clients to identify any routing differences.
I would suggest implementing Relay Affiliation for this type of distributed environment with roaming devices, so it is definitely worth implementing if you haven't already. However, if the underlying network communication or relay discovery is inconsistent, clients may still select an unexpected relay.
I would also question the underlying network architecture of why each branch network needs to connect to another branch network. Perhaps there is a valid business use case, but I would question it. This along with vk.khurava recommendations in this thread should help quite a bit.
As for the Branch Relays, I would use manual relay selection to specify their connection to you two Parent Relays… either all set with Top Relay 1 as their primary with Top Relay 2 as the secondary, or a 50-50 split depending on your total number of clients the child relays service.