BigFix client and server in DMZ

Usage and Config Platform
1

I am unable to find the “definitive” documentation re: the initial connection a client must make when it first becomes a bigfix client.

My understanding is that the masthead includes only the name of the bigfix server (and no relays) AND that this implies, for an installation to finish (in a non-windows environment) a client MUST be able to connect with the bigfix server on port 52311. (I am assuming that the airgap util works for Windows (and macos?) endpoints but not for linux or AIX endpoints.

Did I miss something?

I hope I missed the documentation on how to permit an (AIX) client to “register” with the bigfix server (and thereafter only work via relays).

2

You can use one of the clientsettings.config options to define relays (or, even better, FailoverRelayList) so your client can register via a relay rather than contacting the root server directly. Have a look at https://www.ibm.com/developerworks/community/wikis/home?lang=en#!/wiki/Tivoli%20Endpoint%20Manager/page/Configuration%20Settings for the options.

The Airgap tool applies to the root server, not clients.

1 Like
3

This page also might be helpful: https://www-01.ibm.com/support/docview.wss?uid=swg21505838

4

for windows we use the clientsettings.cfg file with the following settings:

IP:http://DMZRELAYIP:52311/bfmirror/downloads/
__RelayServer1=http://DMZRELAYIP:52311/bfmirror/downloads/
_BESClient_Inspector_ActiveDirectory_Refresh_Seconds=43200
_BESClient_Log_Days=10

5

I tend to define FailoverRelayList with a dozen or so relays, including our larger sites and DMZ, so I can use one config file and be assured the client can reach something

1 Like
6

Thanks all. I think I am going to start with modifying the besclient.config settings. Will update when I know more.