What should be considered when installing the Altiris Agent on a server in the DMZ?

Products

• IT Management Suite
• Client Management Suite

Issue/Introduction

What should be considered when installing the Altiris Agent on a server in the DMZ?

Environment

ITMS 8.x

Resolution

Communications:

• The Altiris Agent communicates over Port 80 or Port 443, by default. Port 80 or Port 443 must be opened, or another port utilized.

Networking:

• A DMZ does not utilize DNS. DNS is needed in order for the client to resolve the IP address of the Notification Server. And so it's necessary to put the Notification Server Name into the system's Windows\System32\drivers\etc\Hosts file.
• Note that the agent normally uses the Notification Server's host name when attempting communication, so the host file may need to include this 
  • <IP Address>     <FQDN of Notification Server>     <Hostname of Notification Server>

Other items to consider:

• Define an Notification Server Site for the DMZ subnets, and not assign any Package Server to that site (unless of course there is a Package Server in the DMZ).
• UNC package codebases should be disabled to systems in the DMZ since those won't work across the DMZ firewall.
• Another consideration in a DMZ is not using network throttling, since ICMP (ping) would be turned off there. The policies would try testing the network with ping and could not download its packages (Patch, Inventory...)

Additional Information

Installing Altiris Agent to a workstation outside a DMZ