CSA Updates for remote users

[ftikphillips]

I was curious if there was any way to get policy updates easily to clients who may not come into an office frequently if at all and may not VPN in.

We are looking at deploying CSA, but have users that don't VPN in because of RPC over HTTPS for email and may not come into the office for several months, but they do connect to the Interenet.

We want them to be able to get policy updates if something new comes up and we want to protect those endpoints.

Thanks for your input.

[netjim_66]

One possibility is to have an internet facing

server from your DMZ that clients at home can connect to.

They would go to a https site and log in.

[jwalker]

If you have the remote clients pointing to a publicly available CSAMC, then they can get configuration changes. Basically you just have to set the agent to poll every minute or so in the agent kit. When the agent polls, it contacts the management center and asks if its config has changed. If the config is different, it downloads the changes and updates itself.

[RichardSW]

Right. The CSAMC can still be a local server, you just need a public IP address NATed to the private IP address.

One problem you will face is resolving the MC server. The agents try to connect to the server's Hostname. So what you will want to do to make this work is add a static record on your internal DNS server so the full hostname resolves to the local IP. Then register a public record with your ISP so the public IP also resolves to your Hostname (and the NAT will take care of the rest).

There is 1 caveat though - if you're using an internal domain suffix that is non-conformative to public dns suffixes, then you'll have to rename your server. For example, my MC might be "csa1.domain.local", so I can't register that with my ISP. So I will have to rename it to something like "csa1.mysitename.com". Then I can register that with my ISP, and I can still add a static record on my local dns server that points that hostname to the private IP address.

Now... if your mobile uses almost NEVER come back to the local network, then you could just add an entry in their HOSTS file after you set up the NAT. Then you wouldn't have to deal with dns and renaming the mc.

[tsteger1]

I would stick with DNS to resolve the CSAMC. Our MC is in our DMZ on a public IP address. Agents can connect to it from internal or the Internet because it's in internal and external DNS.

It's been working this way trouble free for over three years.

I'd be very hesitant to rename any CSAMCs. A lot of things are dependant on the name as it exists during installation and changing it can cause problems.

[RichardSW]

If he can't register a public record for his internal hostname, then his only option is to rename the MC. But I suppose I left the most important part out - you're not just changing the name. You'd have to reinstall the MC and redeploy all the agents too.