Setting up a "False Root" configuration

[straffin]

Mark Leitch’s BigFix 11 “blog” includes a diagram of a configuration that we’re very interested in replicating.

Where can I find information about setting up a system like this? Essentially, we’d want to have the masthead route clients and all other relays to a “False Root” (or “Primary Relay”) server so that only the False Root, WebUI, Web Reports, and Consoles communicate with the Root Server. We’re not worried at all about those “Relay Cluster” clouds.

Root ↔ Primary Relay ↔ Secondary Relays ↔ Endpoints

Some of the items that are not clear to me at the moment:

• altering and distributing the masthead
• configuring relays to be left out of the auto selection list

Anyone have any thoughts about all this?

[itsmpro92]

I think it would be something like:

Set your Primary Relay to manual relay selection to the Root server,

Top Level Relays would be excluded from auto seleciton using:

_BESRelay_Selection_AutoSelectableRelay = 0

How to prevent Relay from being auto-selected?

Is there a way to block a relay from being selected by auto-selection? We’ve just added a relay to a protected enclave where the only BigFix communications allowed through the firewall are between the relay and the primary server. However, it looks like some computers outside the enclave are being assigned to this relay by the auto selection process. How do I keep that from happening, so that clients are only ever directly assigned to the relay? Is Relay Affiliation the answer? Seems like I wou…

Last Fallback Relay = False Root

[straffin]

So, for the prevention of relay auto-selection, you’re saying that I’ve already asked and received the answer to this question? #oops #sorry

@itsmpro92

Last Fallback Relay = False Root

We actually have a fallback relay defined in our masthead but still have 20 or so clients reporting to the root server instead of a relay. Any idea what’s going on there?

[itsmpro92]

First thing I would do is verify that those 20 or so clients have the proper masthead which defines the last fallback relay, and that they have a network path to the relay as well.

Edit:

Another thing I would do is check that DNS or local hosts files are not causing grief with name resolution of the fall back relay.

[JasonWalker]

@straffin

We actually have a fallback relay defined in our masthead but still have 20 or so clients reporting to the root server instead of a relay.

One thing to note is that the root server itself does not respect the AutoselectableRelay client setting.
The only good way to prevent your root from being selected by auto-selection is to configure it to advertise an Affiliation Group that no client seeks. I.e.

_BESRelay_Register_Affiliation_AdvertisementList = "DoNotUse"