WIXLIB

2013 McAfee, Inc. All Rights Reserved.1ePolicy Orchestrator 5.1 Essentials

This module covers the essential information on maintaining an ePO Server and database. Theinformation presented in this module is not all inclusive. Enterprise customers most often just needto know where the “must preserve data” is located. From there, they’ll usually throw the new setupinto their existing backup and recovery plan, already set forth by the organization.The most crucial data for ePO is obviously the database. The entire system can be restored with arecent copy of the database. But there is other data that can ease the process greatly in the event arestoration is needed. Students will be shown how to manage ePO Security Keys, and reviewimportant logs, along with utilizing database maintenance tools. 2013 McAfee, Inc. All Rights Reserved.2ePolicy Orchestrator 5.1 Essentials

ePO is not an appliance-based solution. It is installed to the customer’s hardware. Therefore,customers need to maintain and protect their ePO Server and database. Obviously, failure to do sowill cost them a lot of downtime and headaches. They need to keep the server up-to-date on patchesand updates. This includes not only McAfee ePO patches, but also Microsoft patches for theoperating system and the SQL database and some sort of malware protection application (i.e.VirusScan Enterprise). 2013 McAfee, Inc. All Rights Reserved.3ePolicy Orchestrator 5.1 Essentials

Several of the available ePO Server Tasks can assist with periodic server maintenance tasks likemaintaining System Tree synchronization, managing product licenses, purging old data, maintainingrepositories, and maintaining Rogue System Sensors. 2013 McAfee, Inc. All Rights Reserved.4ePolicy Orchestrator 5.1 Essentials

Security KeysePolicy Orchestrator uses security keys to secure the agent-to-server communication, and to sign andvalidate packages.Agent-to-server secure communication keysAgent-to-server secure communication (ASSC) keys are used by the agents to communicate securelywith the server. You can make any ASSC key pair the master, which is the one currently assigned toagents deployed in the environment. The ePO agent key Updater needs to exist in Master repository,and the McAfee Agent agent update task has to have the ePO agent key updater selected. Existingagents using other keys in the list will change to the new master after their next update. It isimportant to be sure to wait until all agents have updated to the new master before deleting anyolder keys.Master repository key pairThe master repository private key signs all unsigned content in the master repository. Agents use thepublic key to verify the repository content originating from the master repository on the ePO server. Ifthe content is unsigned, or signed with an unknown repository private key, the downloaded contentis considered invalid and deleted.This key pair is unique to each server installation. However, by exporting and importing keys, you canuse the same key pair in a multi-server environment.Other repository public keysThese are the public keys that agents use to verify content from other master repositories in theenvironment or McAfee source sites. Each agent reporting to this server uses the keys in this list toverify content that originates from other ePO servers in the organization, or from McAfee owned 2013 McAfee, Inc. All Rights Reserved.5ePolicy Orchestrator 5.1 Essentials

sources. If an agent downloads content that originated from a source for which the agentdoes not have the appropriate public key, the agent will discard the content. 2013 McAfee, Inc. All Rights Reserved.‹#›ePolicy Orchestrator 5.1 Essentials

Customers in multi-server environments can choose to use the same ASSC key pair for all servers andagents. You can export ASSC from on McAfee ePO server to a different ePO server, to allow agents toaccess the new ePO server.You can choose to make any ASSC key pair the master, which is the key pair currently assigned to alldeployed agents.They can also choose to use a different ASSC key pair for each McAfee ePO server to ensure that allagents can communicate with the required McAfee ePO servers in an environment where each servermust have a unique agent-to-server communication key pair.NOTE: Agents can communicate with one server at a time. The ePO server can have multiple keys tocommunicate with different agents, but the opposite is not true. Agents cannot have multiple keys tocommunicate with multiple ePO servers. 2013 McAfee, Inc. All Rights Reserved.6ePolicy Orchestrator 5.1 Essentials

ASSC Keys in Multi-Server EnvironmentsYou can have both a 2048 and a 1024 bit key set as master. The ePO will talk to McAfee Agent 4.8with the stronger key. 2013 McAfee, Inc. All Rights Reserved.7ePolicy Orchestrator 5.1 Essentials

You can view which systems are using a key-pair, when editing security keys, by highlighting the keyand selecting the View Agents button. 2013 McAfee, Inc. All Rights Reserved.8ePolicy Orchestrator 5.1 Essentials

Before deleting the previous master key pair from the list, wait until all agents begin using the newmaster key pair. Agents begin using the new key pair after the next update with ‘ePO agent keyupdater selected’ task the agent completes. At any time, you can see which agents are using any ofthe ASSC key pairs in the list. 2013 McAfee, Inc. All Rights Reserved.9ePolicy Orchestrator 5.1 Essentials

CAUTION: Do not delete any keys that are currently in use by any agents, or those agents are not ableto communicate with the server.You cannot delete a key designated as a Master Key. You must make another key the Master beforedeleting the old key.In ePO 5.x you cannot delete a key that an agent is using. 2013 McAfee, Inc. All Rights Reserved.10ePolicy Orchestrator 5.1 Essentials

The master repository key pair is unique for each installation. If you use multiple servers, each uses adifferent key. If the agents are configured to allow the download of content that originates fromdifferent master repositories, you must ensure that agents recognize the content as valid. You canensure this in two ways: Use the same master repository key pair for all servers and agents Ensure agents are configured to recognize any repository public key used in the environment 2013 McAfee, Inc. All Rights Reserved.11ePolicy Orchestrator 5.1 Essentials

It is recommended that you back up all keys before making any changes to the key managementsettings. 2013 McAfee, Inc. All Rights Reserved.12ePolicy Orchestrator 5.1 Essentials

After installation you can change only two ports; Agent wake-up communication port, and Agentbroadcast communication port. If you need to change other ports, you must either reinstall theserver and reconfigure the ports in the installation wizard, or refer to available KnowledgeBasearticles. 2013 McAfee, Inc. All Rights Reserved.13ePolicy Orchestrator 5.1 Essentials

Purge the Audit LogThe Audit Log page is used to find and view actions taken by all users. Here, you can maintain andaccess records of all McAfee ePO user actions. The entries are displayed in a sortable table.Customers can delete entries from the Audit Log based on a user-specified age. This action purges allaudit log entries older than the specified age. 2013 McAfee, Inc. All Rights Reserved.14ePolicy Orchestrator 5.1 Essentials

Purge the Threat Event LogThe Threat Event Log page allows you to view and manage the event files in the database. You canpurge events from the log based on a user-specified age. The action deletes the all the event logentries older that the specified age. 2013 McAfee, Inc. All Rights Reserved.15ePolicy Orchestrator 5.1 Essentials

Purge Old DataThe idea is that customers should be purging data on a regular basis. Here’s an example of a task thatthey should run every single day.Review the 9 actions setup in this example server task. Notice the 8th action is configured to purge byquery. This is just an example, but it illustrates the power behind server tasks, and represents amodest approach to keeping the database clean. 2013 McAfee, Inc. All Rights Reserved.16ePolicy Orchestrator 5.1 Essentials

Customers may find themselves needing to migrate the database to another server, or they may wantto upgrade the hardware on the existing server. Before performing any migration, the first step is toback up the database.The steps involved in the migration process depend on many factors. Are they keeping the servername and IP the same? Is one changing but not the other? Will there be any networkcommunication boundaries that need to be acknowledged and dealt with? Etcetera.Additional information: KB67605 - How to change the ePO 4.5.0 and 4.6.0 Agent-to-Server communication port 80 KB72936 - How to change ePO Agent-to-Server Communication secure port 443 KB52141 - How to change the ePolicy Orchestrator 4.x Console-to-Application Servercommunication port 8443 KB68963 - How to change the ePolicy Orchestrator 4.x Client-to-server authenticatedcommunication Port 8444 2013 McAfee, Inc. All Rights Reserved.17ePolicy Orchestrator 5.1 Essentials

Customer may also need to migrate their ePO server. This topic explains the process of migrating anexisting ePO Server to a new hardware platform according to recommended procedure. Thisinformation is intended for use by network and ePO administrators only. These instructions areintended guidelines for migration. All liability for use remains with the user.The instructions in this topic can also be used for disaster recovery.NOTE: The Agent uses either the last known IP address, DNS name, or NetBIOS name of the ePOserver. If you change any one of these, ensure that the Agents have a way to locate the server. Theeasiest way to do this would be to retain the existing DNS record and change it to point to the new IPaddress of the ePO server. After the Agent is able to successfully connect to the ePO server, itdownloads an updated SiteList.xml with the current information. The procedure can also be used bycustomers who want to migrate the ePO server to another system. For ePO 5.x users, it is preferableto use the built-in Disaster Recovery feature to migrate the ePO server to another system. 2013 McAfee, Inc. All Rights Reserved.18ePolicy Orchestrator 5.1 Essentials

In preparation for server migration, you will want to backup the folders shown here on the server.There are multiple KB articles available on how to backup the SQL database. 2013 McAfee, Inc. All Rights Reserved.19ePolicy Orchestrator 5.1 Essentials

It is important to back up the ePO Key-Store pairs.The task shown here backs up the repository and agent communication keys.These are stored in the following folder by default: .\Program Files\McAfee\ePolicyOrchestrator\DB\Keystore\ 2013 McAfee, Inc. All Rights Reserved.20ePolicy Orchestrator 5.1 Essentials

You must reinstall ePO to the exact same directory path as the previous installation or theinitialization of extensions will fail when the restore is complete.The server.ini file located in the previous installation (\Program Files (x86)\McAfee\ePolicyOrchestrator\DB) stores the following information: HTTPPort 80 (Agent-to-Server communication port) AgentHttpPort 8081 (Agent Wake-Up communication port) SecureHttpPort 8443 (Console-to-Application Server communication port) BroadcastPort 8082 (Agent Broadcast communication port)If you use the original SQL server, the installer will attempt to create a database calledePO epo servername . Because the name of the original ePO server is retained, the originaldatabase has to be backed up and detached. Otherwise, the installer prompts you to overwrite theexisting database. 2013 McAfee, Inc. All Rights Reserved.21ePolicy Orchestrator 5.1 Essentials