Configuring Cloud-Enabled Management (CEM) in ITMS 8.7 and 8.8

Products

IT Management Suite Client Management Suite

Issue/Introduction

You are looking guidance on how to properly install and configure Cloud-Enabled Management (CEM) in IT Management Suite (ITMS) 8.7 and 8.8 to allow managed endpoints to communicate securely over the Internet.

Common reported symptoms include:

Internet-based agents not reporting to the Notification Server
Internet Gateway not appearing as “Online”
Agents failing to switch from intranet to cloud communication
Certificate or IIS binding errors

Environment

ITMS 8.7.x and 8.8.x

Cause

Cloud-Enabled Management (CEM) enables managed endpoints to securely communicate with the Notification Server (NS) over the Internet using the Internet Gateway (IG).

In ITMS 8.7 and 8.8, proper CEM configuration requires:

Valid public SSL certificates
Proper IIS configuration
Internet Gateway installation and registration
Correct agent policy assignment
Open firewall ports

Misconfiguration of any of these components commonly prevents cloud-based agent communication.

Most CEM deployment failures are caused by one or more of the following:

Incorrect or missing SSL certificate bindings in IIS
Internet Gateway not properly registered with the Notification Server
Firewall blocking required HTTPS traffic (default 443)
Cloud-Enabled Management policy not applied to agents
Expired or revoked CEM certificates

Resolution

Setting up and configuring your environment for Cloud-enabled Management requires some pre-work and preparation on the network side of things. The main documents that you should start with are:

Cloud-enabled Management for ITMS

About Cloud-Enabled Management

Cloud Enabled Management (CEM) High Level Implementation Guide

The general guidance for configuration sequence is as below:

Important: Always configure components based on your network needs.

Step 1 – Prepare the Environment

Ensure:

Public DNS name resolves externally
Port 443 is open externally
Valid public SSL certificate installed
Server meets ITMS 8.7 / 8.8 requirements

Step 2 – Install Internet Gateway

In the SMP Console, go to:

Settings > Notification Server > Cloud-enabled Management
Download the Internet Gateway installation package.
Install on a dedicated server in the DMZ.
During installation, provide:
- Notification Server FQDN
- Certificate information

Validate Installation

On the Internet Gateway server:

Check services:

services.msc
Verify:

Symantec Internet Gateway Service = Running

Check logs:

C:\ProgramData\Symantec\SMP\Logs\
Look for:

a.log
Expected log entry:

Internet Gateway successfully registered with Notification Server

Step 3 – Configure IIS Bindings

On Internet Gateway: Open IIS Manager
Select Default Web Site
Click Bindings
Ensure HTTPS binding:
- Port 443
- Correct public certificate assigned

Step 4 – Enable Internet Gateway Status Reporting

In SMP Console, go to:

Settings > Notification Server > Internet Gateway
Enable:

Status reporting

Confirm Internet Gateway appears as:

Online

Step 5 – Configure Cloud-Enabled Management Policy

Go to:

Manage > Policies > Agents/Plug-ins > Cloud-enabled Management Settings
Edit the Default Cloud-Enabled Management Settings Policy.
Enable:
- Allow cloud communication
Assign policy to appropriate target.

Force Agent to Switch to Internet Mode (Optional Diagnostic)

On client machine:

"C:\Program Files\Altiris\Altiris Agent\AeXAgentUtil.exe" /Server
Verify Internet Gateway is listed.
Check client log:

C:\ProgramData\Symantec\SMA\Logs\Agent.log
Expected:

Switching to Internet Gateway mode

Step 6 – Generate Offline CEM Package (If Needed)

If client cannot reach internal network:
Navigate to:

Settings > Notification Server > Cloud-enabled Management
Generate Offline Package
Install on endpoint manually

Troubleshooting Reference Table

Symptom	Log Location	Likely Cause	Action
IG not Online	a.log	Registration failure	Re-run IG configuration
Agent not switching	agent.log	Policy not applied	Check policy targeting
403 IIS error	IIS logs	Certificate binding issue	Verify HTTPS binding
Certificate revoked	agent.log	Expired certificate	Revoke and regenerate