How do you point a System Tree group in McAfee to update from a perticular distributed repository?

Hi Simon

Yes i still require an answer to this question

Cheers

Andy

Hi Andy
This is how the McAfee "knows" where to go, I know it's not an answer to the question, I'll post back with a seperate post once I've tested a couple of things out here

How does the ePO agent know which repository to talk to

This article provides information on how the options for Repository selection affect ePO agent function for updates. The configuration options discussed here are located in the managed products of the ePO console, under the ePO Agent, Configuration, Repositories tab, Repository selection.

Background information:
Repositories contain files from which the agent downloads .DAT file updates, Engine updates, product Patches, Anti-Virus software, and other files that may be needed. Distributed repositories are strategically placed in the environment to provide redundancy and proximity. The ePO agents receive a list of repositories from the ePO server. This list is saved in the ServerSiteList.xml and SiteList.xml files. The agent orders the repositories and stores that order in the SiteMapList.xml. The agent selects a repository for updates based on the information in SiteMapList.xml.

The local computer's SiteList.xml is not updated unless one of the following conditions occur:

    * The SiteList.xml is changed by ePO policy
    * The SiteList.xml is imported from a file
    * The number of disabled sites in the agent policy is changed
    * The repository selection option in the agent policy is changed
    *
      The repository order is changed in the agent policy with the User Defined List option
    *
      The local computer's network property information changes (new IP or subnet value)

The local SiteMapList.xml is reordered only when one of the above events is triggered and after the first update task is invoked. The repositories are sorted using one of the three different methods offered in the agent policy configuration:

    * Ping time
    * Subnet value
    *
      User defined list

After the five closest repositories are found based on subnet distance calculation, all of the remaining sites are set with a delayMS value of 65534 in the SiteMapList.xml. The sitelist.xml is then modified to set the repositories in ascending order by the delayMS value. After the first five, the remaining repositories are disabled (enabled=0). The Fallback repository is the exception, as this will be set to enabled even though it is not within the 5 closest repositories.

Explanation of Repository Selection options:

Ping time method: The agent pings the repository servers and sorts them according to the response time from each site. Several methods are attempted until a response is received or all attempts fail. The process described for the Subnet value option is used to sort the entire list of repositories. The Ping time method is then applied to the closest five repositories.

If the server is the ePO server master repository (SpipeSite), the agent pings in this order:

   1. ICMP ping using IP address
   2. ICMP ping using DNS name
   3. ICMP ping using NetBIOS name
   4. Connect to Spipe port using IP address
   5. Connect to Spipe port using DNS name
   6. Connect to Spipe port using NetBIOS name

If the server is an HTTP site, the agent pings in this order:

   1. ICMP ping using DNS name
   2. Connect to HTTP port using DNS name

If the server is a SuperAgent repository, the agent pings in this order:

   1. ICMP ping using NetBIOS name
   2. Connect to HTTP port using NetBIOS name

If the server is an FTP site, the agent pings in this order:

   1. ICMP ping using DNS name
   2. Connect to FTP port using DNS name

If the server is a UNC site, the agent pings in this order:

   1. ICMP ping using NetBIOS name
   2. Connect to UNC port using NetBIOS name

Additional information:

    * The agent does not send any data to the server
    * The size of ICMP ping packet is 32 bytes
    * The agent calculates delay time by averaging response time of 3 ping attempts
    * The agent counts the delay time until the connection is established, then disconnects from the server
    * If the agent cannot connect to a server, that server is disabled in SiteMapList.xml.

Subnet value method: The ePO agent uses IP addresses to sort the repository servers according to the distance of each server from the host computer. The distance is the number of bits from the lowest bit, which differs between two IP addresses.

An example of IP address distance calculation:

    * Agent Computer:10.0.1.1
    * Localhost: 10.0.1.1 = 0
    * Repository A: 10.0.1.5 = 3
    * Repository B: 10.0.2.1 = 10
    * http://www.nai.com/: 63.215.198.30 = 30

If the agent cannot connect to a server, the server is disabled in SiteMapList.xml.

User defined list method: ePO Agent sorts the servers according to the configured order. The Fallback site is always the last repository server entered.

OK,
I've had a quick look
What I would do is to create a new policy for the McAfee Agent with the repositories that you want to tell it to talk to and then set it to Use Order in Repository List
You can then enable/disable the various repositories that you dont' want to use on a per policy basis and then apply each individual policy to each Group in ePO

Does that answer the question ?

Cheers
Si

Hi Simon

Thanks for this, it looks perfect.  Any chance i can be a pain and ask for some screenshots of what you mean?  I understant how to setup and new policy for hte Agent but not sure how to change it to list mode and then remove the respositories i dont want, and then assign it to a perticular group

Cheers

Morning horshamIT

No problems, let me recreate a mock-up for you in my ePO and I'll screen shot it for you

Give me this morning, I have some other stuff to do, but I'll try to have it done by lunchtime for you

Cheers
Si

Sorry, got snowed under....it's going to be nearer close of business today :-(

How we doing on this then ?
Cheers
Si