Client with no connection to server?

[Sherpapsy]

I’m curious if I could build an infrastructure where the clients can only communicate with relays, and not the server itself. Ever.

This post suggests it is possible:

Client install not working without access to main server

(imported topic written by JanStraarup) Hey everyone I am new to Bigfix and this forum. So i have made an installation, with a main server and 2 relays, the main server is placed in a resource domain and no clients should never have access to it. I have made a clientsettings.cfg and used it with the setup.exe file, when i look in the registration database the relays are in place as they should be. However the client still trys to registre to the main server. Here is a cut out of the client…

The architecture will look like this:

Server<—>FW1<—>Relay<—>FW2<—>Clients

Clients will be able to see and communicate with relay through FW2, but not able to see or communicate with server though FW1 and then FW2. Relay will be able to communicate with server through FW1 and clients through FW2.

I understand the need to perform extra steps to configure clients to use relay during installation.

Thanks!

[strawgate]

This is a very standard configuration – the only required step is to specify a relay at installation time: http://www-01.ibm.com/support/docview.wss?uid=swg21505838

See also: http://www-01.ibm.com/support/docview.wss?uid=swg21506065

[JasonWalker]

I’ll echo what @strawgate said; not only is this a standard configuration, but it’s actually the recommended configuration. There’s a diagram at https://www.ibm.com/developerworks/community/wikis/home?lang=en#!/wiki/Tivoli%20Endpoint%20Manager/page/TEM%20Relays that shows a very complex deployment including multiple branch offices, Internet relays, etc.

A best practice is to isolate the BigFix Server and Console clients (maybe a Terminal Server hosting the console) within a private network segment, so that both Console and Relay access to the server is limited. A small number of “Top-Level Relays” would communicate directly with the server, and other Relays throughout the enterprise form a hierarchy with the “Top-Level Relays” at the top of the chain.

Clients and Relays need ICMP and tcp/52311 (by default, you could change it) traffic “upward” to their parent Relay; and Relays “should” allow udp/52311 downward to their clients (a UDP message is sent to clients when there is a new content/action/etc. available).