Help on BigFix Relay

Usage and Config Platform
1

Good morning,
I have a small BigFix infrastructure with 230 workstations. The structure is divided into 27 locations and to optimize network traffic I have promoted a computer Ralay at every location. All notebooks are forced to keep all clients in “automatic select” except relays that point directly to the BigFix Server.

My problem is this:
I DO NOT want that branches speak with each other, they should get the local relay, if it is on, or the server only

I really like the logic of this fixlet/task:

https://www.bigfix.me/fixlet/details/3916

setting “_BESClient_Register_Affiliation_SeekList” = “{registration subnet address of client as string}; PrimarySite; *” on “{now}” for client

but unfortunately it does not work. It only recognizes PrimarySite and * but not local relays.
I used BESRelayRegister_Affiliation_AdvertisementList on BigFix Server to assign the label.

any idea?

Thanks for your help
Allan

2

Looks like you may be missing the leading _ on the setting? Have you confirmed the advertisement list on your relay is actually what your clients expect it to be?

_BESRelay_Register_Affiliation_AdvertisementList
_BESClient_Register_Affiliation_SeekList

3

I would also add that after you update relays (including creating or deleting relays, or updating their Advertisement Lists), you must also take at least one action as a Master Operator. The relays.dat file that clients use to lookup relays is part of the actionsite, and you need to take a MO action to update the actionsite. That will trigger clients to gather and find the new relays.dat file.

4

This action should be dynamically targetted to ensure it’s created in the actionsite and not in a particular endpoints mailboxsite.

5

I do not believe that is the case anymore. The root server should self-propagate the actionsite for relays.dat changes.

2 Likes
6

the syntax is correct with _

only client have:
_BESRelay_Register_Affiliation_AdvertisementList
with value PrimarySite

all client have:
_BESClientRegister_Affiliation_SeekList" = “{registration subnet address of client as string}; PrimarySite; *” on “{now}” for client

7

I have adopted a workaround, but i dont like it this solution. I closed port 52311 between sites/branch.
I look for an alternative solution :slight_smile:

8

Are you allowing ICMP to the relays? A client will not autoselect a relay unless it answers to ICMP first; and the client should select the relay with the lowest hop-count (within its AffiliationSeekList, if set).

9

If I’m understanding this correctly, you are saying that the Relay at the site has the “PrimarySite” as the _BESRelay_Register_Affiliation_AdvertisementList setting? If so, that is the problem.

Assuming one of your sites has the subnet address 10.10.10.0, you should have on all the clients at that site:

_BESClient_Register_Affiliation_SeekList = 10.10.10.0;PrimarySite;*

At that same site, you should also have set (only on the Relay):

_BESRelay_Register_Affiliation_AdvertisementList = 10.10.10.0

And on the Relay (or Server) which represents the “PrimarySite” (at a minimum)

_BESRelay_Register_Affiliation_AdvertisementList = PrimarySite