IEM agent, multi client engagement conflict with existing agents ... how to solve

Usage and Config
1

I’ve been made aware of a situation, and I have some agent functionality questions:
Scenario:
CompanyA: This is a multi-tenant hosting company (CompanyB is a client), and they use IEM for patching (BixFix) and provide additional servers to CompanyB
CompanyB: They are a client of CompanyA, they have their own IT environment, plus the extra server environment provided by CompanyA. They use IEM for licensing (ILMT).
Conflict: IEM agent needs to service two functions, where each function resides in different environments. CompanyA, needs to maintain separation of each client. CompanyB needs to see it’s reporting. This scenario could come up again for CompanyA multiple times.
QUESTION:

  • Can the agent service two masters? and if not, what are the possible solutions?

I’m thinking of things like dual agent installs (custom ports) where each instance points to one master, etc.

2

I am just keying on the “CompanyB needs to see it’s reporting”. Could you connect the web reports from CompanyB to CompanyA and consolidate the data that way?

1 Like
3

The only real option is for CompanyA to provide ILMT functionality for Company B and provide them with the reports they need.

BigFix/IEM cannot talk to 2 different root servers.

4

You should also be able to setup an ILMT server which only receives data from a specific subset of computers.

This would allow Company A to manage IEM while allowing Company B unfettered access to ILMT

2 Likes
5

Agree with the suggestions above. It is not possible to install two agents on the same system, even if configured to use different ports/directories.

So Company A will have to deploy the ILMT content/scanners to the endpoints and have the data roll up to their server. Then provide the data to Company B by one of the following methods:

  • Giving them their own ILMT server that pulls in their subset of data
  • Pulling Company B reports from a global ILMT server
  • Sending the scan files and database property info to Company B to import into their own ILMT server
1 Like
6

So, additional information is that CompanyB has had their infra in place already. CompanyA is coming in new. Running two servers would be most costly to CompanyB (their own infra, plus the chargeback for the hosted services).

Here are the current solutions on the table, and I’m wishing for a better 3rd option…

There are two possible solutions:
a) CompanyB change their configuration to pull ILMT data from CompanyA’s management server, rather than from VM agents.

This needs to be confirmed if possible from CompanyA and their management Service might not be segregated, so CompanyB will be pulling down other clients information as well
CompanyB need to indicate the willingness to do this and the work/testing involved

b) The CompanyA Patch management agents withdrawn from the VM’s and replaced with the CompanyB Agents

Will require CompanyA operations staff to have “Master Operators Rights” access to the CompanyB management console
Will require blueprint script amendments to install the CompanyB agent and not use the CompanyA agent.

The preferred option is option 2.

NOTE: The last/“preferred” option means make CompanyA is burdened. I work for CompanyA :wink:

7

I addressed this a bit in my reply to the whole forum, but with two servers CompanyA would be double charged because they license their own stuff, and need to also license the stuff provided by CompanyB, but CompanyB would charge back too. Simply because it’s included in their service (and with a markup, I’m sure). It’s kind of like CompanyA wants to maintain all licensing functionality (that’s all they use IEM for) and CompanyB wants to only use BigFix (they don’t use the licensing aspect).

Hope that helps clarify.

8

CompanyB doesn’t even employ ILMT today. It’s an option, but not ideal.

9

I think in your replies you are confusing which company you defined as which, which is extra confusing.

This is technically possible, but with only 1 BigFix infrastructure. It would be a bit to get it set up, but it would work.

You can have all machines in 1 BigFix for patching, but then have a subset of those machines in ILMT or SUA. The current ILMT for one company would have to be essentially moved to the other and then only used for that subset of computers. This would probably be the easiest option.