Roaming Client

Customizations
1

(imported topic written by yasar.md91)

Hello,

We have Laptops and BigFix Clients was running successfully.

Whether it is possibile to make the bigfix clients as roaming for Laptop User.

(ie., we need that laptop to communicate with the BigFix server even users out of the network).

2

(imported comment written by jessewk)

Most customers put a relay in their DMZ to allow laptops to remain connected when the are off the company LAN.

See this article: http://support.bigfix.com/cgi-bin/kbdirect.pl?id=199

And this forum post: http://forum.bigfix.com/viewtopic.php?id=428

3

(imported comment written by BenKus)

Hi yasar,

Absolutely… many people use BigFix like this to manage the laptops that are at home, in a hotel, at a coffee shop, etc. Here is the basic idea:

  1. Put a relay in your DMZ.

  2. Establish a public IP address or DNS name that will allow computers to address the DMZ Relay.

  3. Open the BES port in the firewall so that the computers from the outside world can reach the relay and the relay can reach the BES Server (or a top level relay).

  4. Use the Task on the BES Support “BES Relay Setting: Name Override” and use the IP address/DNS name that is publicly accessible.

With all this in place, the BES Clients will be able to find the BES Relay (using automatic selection or if you manually point them to the relay). The cool thing is that as long as the computer has an Internet connection, you can manage it as if it was in another one of your offices. This greatly helps the huge security issues surrounding mobile computers (which are the most exposed and hardest to update).

Couple notes:

  • Check out http://support.bigfix.com/bes/misc/besrelays.html for more details.
  • By doing this, you are opening a hole in your firewall that could lead to specific attacks on your BigFix system. This is an inherent risk when you make public Internet services.

Hope that helps,

Ben