LANDesk User Community: BrokerConfig.exe Gateway Information

Up to Discussions in Agent Deployment and Installation

This Question is Answered (go to answer)

1 "helpful" answer available (10 pts)

4,866 Views 7 Replies Last post: May 20, 2009 4:32 PM by Kothoga

JamesM-F

12 posts since
May 20, 2009

Currently Being Moderated

May 20, 2009 4:38 AM

BrokerConfig.exe Gateway Information

Hi All,

More of a question regarding the brokerconfig settings from the agent. We our core and LDGateway talking nicely to each other and in turn on demand and resident clients working away. Nice.

However I want the agent to automatically switch between Direct and Gateway mode depending on its location. I have done into the Brokerconfig.exe and located the Gateway information tab. Under here are three options:

Dynamically determine connection rroute
Connect directly to LDMS core
Connect using the management gateway

Currently it is set to Dynamically determine, the management gateway address is correct, there is nothing in the proxy settings (this is correct) and the certificate has been posted to the client.

However it still stays in Direct mode, even when it is off the network on our "dirty" line.

Any help would be appriciated

James

P.S. We are running 8.8SP2a core and clients

Mach6

447 posts since
May 23, 2008

Currently Being Moderated

1. May 20, 2009 7:12 AM

in response to: JamesM-F

Re: BrokerConfig.exe Gateway Information

JamesM-F,

The dynamic setting in BrokerConfig you are referring to is for the inventory scanner, the policy check, and the vulnerability scanner. Remote Control is designed to always need to be changed manually.

There is no built in method of changing that. There is a link to one that was created outside of support, but that a lot of people have had success with. I tested an earlier version (much earlier) and had mixed results, but I understand that the current version is pretty solid. I haven't tested it, but I haven't heard any problems with it either.

Here's a link, so you can research this as an option:

http://community.landesk.com/support/blogs/jack/2009/05/08/ldmsautogateway-is-prime-time

Report Abuse

JamesM-F

12 posts since
May 20, 2009

Currently Being Moderated

2. May 20, 2009 7:22 AM

in response to: Mach6

Re: BrokerConfig.exe Gateway Information

Cheers Mach6,

I have gone to the droppedpackets site and scoping around. On a seperate note, if the agent is configured to gateway will it still communicate with the core server?

Report Abuse

Mach6

447 posts since
May 23, 2008

Currently Being Moderated

3. May 20, 2009 7:59 AM

in response to: JamesM-F

Re: BrokerConfig.exe Gateway Information

JamesM-F,

The Gateway does everything one way for inventory scan, security scan, and policy updates, and does everything a completely different way for remote control, so that type of question will have two answers.

There's a fundamental difference between how an inventory scan, security scan, and policy updates work and how remote control needs to work. The first three have the client check in on a schedule that is launched by the client. By default they are set to check in once every 24 hours + up to one hour random delay. That's generally not a problem. They check in, do their task, disconnect and are no longer in communication until the next client initiated task gets kicked off. They settings in BrokerConfig apply to them. 99% of the time leaving the setting at dynamic is just fine. The device will automatically talk to the core directly when it can and failover to the Gateway when it's off network.

Remote control is totally different. It needs to be ready to go all the time for the technician to connect to. Needing to wait up to 24 hours + 1 hour random delay is not what I want to do when I try to remote control a device. [-8 We need the connection to stay persistent. Also, instead of following the same basic process, just sending the information through a different route, remote control has two distinct modes. In direct mode the service is a listening service that listens for incoming connections on port 9535. That's not going to get a lot of traffic from a hotel room two states away from the core. When we switch it (manually) to Gateway mode it actively creates an outbound connection on port 443 (HTTPS) to the Gateway, and it keeps that connection alive, and the Gateway waits for someone to request to link up to that connection. Some customers have 10,000+ devices that may or may not be on the network at any given time. The Gateway simply couldn't handle that many connections effectively (at least it's not designed to). Because of that the decision has been made to require the end use to switch back and forth, rather than automatically put more strain on the Gateway.

If you'd prefer to have Gateway mode do it's thing, then I think Jack Coates' utility is a great solution to go with. Easy to deploy, easy to verify that people have it, and (from what I've heard) it works like a champ. All good things.

That's a pretty detailed overview of the difference between Gateway mode for Remote Control and how the Gateway dynamically handles all other tasks (inventory, security, and policies).

Report Abuse

mrspike

495 posts since
Dec 19, 2007

Currently Being Moderated

4. May 20, 2009 8:49 AM

in response to: Mach6

Re: BrokerConfig.exe Gateway Information

I would like to add that leaving a system in Gateway mode only (when on the local network) will prevent the client from getting software that is located on a source other than the core unless IIS is tweaked to allow it, and that you will not be able to PUSH jobs or make on demand scans of a system.

Of course, if the system is off the network, on demand push tasks will not work either way, only policy based task and jobs scheduled on the local client will run.

Report Abuse

Mach6

447 posts since
May 23, 2008

Currently Being Moderated

5. May 20, 2009 8:52 AM

in response to: James Marriott

Re: BrokerConfig.exe Gateway Information

Are you sure that's accurate?

Gateway Mode = On should be a remote control only settings. The other three processes don't know/care what Remote Control is on, they do their own thing.

In fact, they don't know/care whether or not they're talking to the Gateway or directly to the Core. A separate process handles all of that. It should be completely isolated from what mode remote control is in.

Report Abuse

zman

2,020 posts since
Dec 14, 2007

Currently Being Moderated

6. May 20, 2009 8:56 AM

in response to: Mach6

Re: BrokerConfig.exe Gateway Information

I think James may be referring to the Brokerconfig status and not RC status.

Report Abuse

Kothoga

18 posts since
Dec 15, 2008

Currently Being Moderated

7. May 20, 2009 4:32 PM

in response to: JamesM-F

Re: BrokerConfig.exe Gateway Information

It looks like we have a bunch of good information here, maybe I can add a little clarification.

The two parts of the Agent that we need to differentiate from are:

BrokerConfig.exe and its settings.
Remote Control (issuser.exe) and its settings.

Much of this has been covered by Mach6 so hopefully I'll try not to beat a dead Speed Racer.

Broker Configuration - BrokerConfig.exe

C:\Program Files\LANDesk\LDClient\BrokerConfig.exe

Picture of the Connection Settings: Dynamic, Direct to Core, Direct to Gateway

The settings in Broker Config control the communication states for processes such as Inventory (LDISCN), Software Distribution (SOFTMON), and Security (VULSCAN). These settings do not control the Remote Control service's state of Direct or Gateway Mode.

"Dynamically determine connection route" is the preferred method for 99% of the client configurations and it is not recommended to change this settings except for testing purposes.

If BrokerConfig on the client is set to "Connect using the Management Gateway", AND the client is on the local network then the client will experience problems with scanning and software distribution.

To quote James Marriott:

"leaving a system in Gateway mode only (when on the local network) will prevent the client from getting software that is located on a source other than the core unless IIS is tweaked to allow it, and that you will not be able to PUSH jobs or make on demand scans of a system."

With all this information about BrokerConfig, I'll remind you that this does not affect the state of the Remote Control service on the client.

Remote Control Service - (issuser.exe)

C:\Program Files\LANDesk\LDClient\BrokerConfig.exe

Picture of the two modes of Remote Control: Direct Mode, and Gateway mode.

These settings can only be changed manually. The current LANDesk agent does not have the capability to automatically detect the appropriate mode and switch. Mach6 did reference a script on Droppedpackets.org which can be used for this capability.

To quote Mach6:

"There is no built in method of changing that. There is a link to one that was created outside of support, but that a lot of people have had success with. I tested an earlier version (much earlier) and had mixed results, but I understand that the current version is pretty solid. I haven't tested it, but I haven't heard any problems with it either.

Here's a link, so you can research this as an option:

http://community.landesk.com/support/blogs/jack/2009/05/08/ldmsautogateway-is-prime-time"

The usual agent installation includes a remote control icon in the taskbar with which you can bring up issuser and switch modes. If you don't show the Remote Control icon on your client's taskbar, you can change the mode with this registry entry.

HKLM\SOFTWARE\Intel\LANDesk\WUSER32, Gateway Mode, 0=Direct Mode, 1=Gateway Mode

If a client machine is on the network and their remote control service is set to Gateway Mode then normal remote control from the Core will fail to connect to the client. On the Core server, if you try "Remote through the Management Gateway", you may get a successfull connection to the machine but this varies depending on the security architechture of the environment.

Hopefully this Helped.

I know this was still a lot of information, but I hope it helped clarify some of the differences in communication using the Management Gateway.

Kothoga!

Report Abuse

Go to original post

This Question is Answered (go to answer)

May 20, 2009 4:38 AM

BrokerConfig.exe Gateway Information

Broker Configuration - BrokerConfig.exe

Remote Control Service - (issuser.exe)

Hopefully this Helped.

Actions

More Like This

Bookmarked By (0)