Mle

Usage and Config Platform
1

(imported topic written by hbkrules6991)

Hi All:

I posted previously that we are looking to deploy a relay in the DMZ to allow our laptops the ability to communicate with our BF server when not connected over VPN. We only want the clients to use encryption when communicating to this relay, so I wanted to verify the steps to ensure that is the case.

v.8.0.627.0 is the version we are running

1: Enable encryption on the BES server thru the Admin tool.

  1. Click Generate new key, select the key size and Uncheck the option to being encrypting immediately. Save the key

  2. Copy the key to the relay servers that will be used to decrpyt. This will be one server which is in our DMZ. The path is here “c:\Program Files (x86)\BigFix Enterprise\BES Relay\Encryption Keys”

  3. On each client that needs to use MLE run the BES Client Setting: Encrypted Reports.

  4. The option I will choose is “Click here to set the BES Client to use encryption for reports if possible. (Recommended for most deployments)”.

  5. To verify encryption, I will put in these two reg keys CarbonCopyPath & EncryptedCarbonCopyPath

  6. Will verify data is encrypted.

Am I missing a step? or is the above pretty accurate as to what I need to do to accomplish our end goal.

Thanks!!

2

(imported comment written by BenKus)

Why not just encrypt all the agent reports? Unless you have a very big deployment, your standard BigFix Server should be able to easily handle the decrypting load.

Ben

3

(imported comment written by hbkrules6991)

Hi Ben, thanks for the reply, not sure what you folks define as a “big deployment”, but we have 9000 computers, and we only want to encrypt the data coming in over the internet(non-VPN). based on this, are my above steps accurate to ensure this data will be encrypted?

4

(imported comment written by BenKus)

It seems fine… I would suggest that you don’t need a decrypting relay at 9000 computers and your server can handle the decryption. For #4, you might target the policy to “All Computer” (or to “All Computers” who are reporting to your Internet Relay).

You can also consider using a network capture tool to verify the encryption.

Ben