Endpoint Protection

I currently use 5 SEPM servers, one in each subnet, but I have tired of using 5 consoles etc. I want to setup GUP in each of the subnets.

1. What type of computer/server is used in the local subnet? Can I piggyback off of the WSUS server since it will also always be in the subnet.

2. Do I then set the ip address of the 5 GUPs from the main SEPM console?

3. I am just now going to the latest version of SEP as I am on 12.1 now. That means all the clients have the wrong sylink. If I use group policy to upgrade the existing SEP and use a package off of the new server will it upgrade the sylink from the old local subnet to now my new centralized one?

Any other caveats?

Any machine with a SEP client can be a GUP.

Yes, you add by IP address if you want.

This should help

Symantec Endpoint Protection (SEP) Group Update Providers (GUPs) Selection Examples

Article:TECH198702

|

Created: 2012-10-22

|

Updated: 2012-11-15

|

Article URL http://www.symantec.com/docs/TECH198702

 

Understanding "Explicit Group Update Providers (GUPs) for Roaming Clients" in Symantec Endpoint Protection (SEP) 12.1.2

Article:TECH198640

|

Created: 2012-10-19

|

Updated: 2012-11-15

|

Article URL http://www.symantec.com/docs/TECH198640

 

HI,

SEP 12.1 RU2 And Explicit Group Update Providers

https://www-secure.symantec.com/connect/articles/sep-121-ru2-and-explicit-group-update-providers

About the types of Group Update Providers

http://www.symantec.com/docs/HOWTO80957

What is the processing order of an Explicit GUP list within version 12.1.2 of Symantec Endpoint Protection?

http://www.symantec.com/docs/TECH196741

Understanding "Explicit Group Update Providers (GUPs) for Roaming Clients" in Symantec Endpoint Protection (SEP) 12.1.2

http://www.symantec.com/docs/TECH198640

SEP 12.1 RU2 And Explicit Group Update Providers

https://www-secure.symantec.com/connect/articles/sep-121-ru2-and-explicit-group-update-providers

Check this thread also

https://www-secure.symantec.com/connect/forums/how-save-time-entering-multiple-explicit-group-update-providers-gups

Thanks for the links that will get me started.

use GUP in each subnet. 1. What type of computer/server is used in the local subnet? Can I piggyback off of the WSUS server since it will also always be in the subnet. te machine that is always up, most of the time. Yes WSUS can be GUP. 2. Do I then set the ip address of the 5 GUPs from the main SEPM console? Yes, you need to edit the LU policy. Note that the machines need to be communicating to SEPM to take the new LU policy. 3. I am just now going to the latest version of SEP as I am on 12.1 now. That means all the clients have the wrong sylink. If I use group policy to upgrade the existing SEP and use a package off of the new server will it upgrade the sylink from the old local subnet to now my new centralized one? check this link, it should help Restoring client-server communications with Communication Update Package Deployment http://www.symantec.com/business/support/index?page=content&id=HOWTO81455 \

check this link, it should help
Restoring client-server communications with Communication Update Package Deployment
http://www.symantec.com/business/support/index?pag...
\

Is this something new in 12.1.2 because in the previous version it was butal trying to get the sylink changed?

yes that new feature in SEP 12.1 RU2.

I am in the new SEPM console but I do not see Common Tasks on the Home Page.

1. On the Home page, in the Common Tasks drop-down list, click Install protection client to computers.

2. In the Client Deployment Wizard, click Communication Update Package Deployment, and then click Next

Is the SEPM 12.1 RU2? are you logged in as a Admin?

Under Help- About it says 12.1.2015.2015. I am in as admin. I jsut relogged in and I got a dialog box for different tasks and one was to deploy client and I see teh communication package. Is that only good for 12.1 UP2 clients.

Ok, my test one worked on the 12.1 v1 client. Let me ask this question.

Is it possible to add 12.1 older clients into the console and have it do the GUP thing as well for updates?

that is RU 2, can you go to install under Admin tab and check for the same?

I see the 3 antivirus packages and the ability to add but does that mean I have to hunt and peck for the communication package and then put it in?

Yes, older 12.1 clients can serve as GUPs as well, even when SEPM is already RU2 - as far as recommendations goes would an upgraded of these machines be possible here as well?

I'm going to upgrade but wanted to see all the possible scenarios before I do.

Hi,

1. What type of computer/server is used in the local subnet? Can I piggyback off of the WSUS server since it will also always be in the subnet.

--> Yes. Any machine acting as a SEP client can be promoted to GUP role. However it's recommended to promote the machine which has a better hardware configuration.

2. Do I then set the ip address of the 5 GUPs from the main SEPM console?

--> You will have to configure it through liveupdate policy

3. I am just now going to the latest version of SEP as I am on 12.1 now. That means all the clients have the wrong sylink. If I use group policy to upgrade the existing SEP and use a package off of the new server will it upgrade the sylink from the old local subnet to now my new centralized one?

-->  Yes it should. You can use SEP 12.1 new feature i.e. Communication Update pacakge deployement.

SEP 12.1 RU2 and Reset Client Communication

https://www-secure.symantec.com/connect/articles/sep-121-ru2-and-reset-client-communication

I must confess I have a large large screen and it ended up that the Common Tasks drop down was so far to the right and at the top I did not see it.

I have to tell that the Restoring client-server communications with Communication Update Package Deployment
 is the best thing they added. It was so so difficult before.

On the GUP. I will have 5 subnets and no roaming clients. Do I do multiple GUPs or Single GUP. I will only have one GUP-computer per subnet. I have read the docs but still confused. I want to keep this as simple as I can.

You can set up multiple gups (=5) and then through the explicit group assigment set one GUP for each subnet: http://www.symantec.com/business/support/index?page=content&id=TECH198640

I have put one subnet with one gup and designated a server to be the gup in that building. I set that group of computers it's own group in SEPM and designated that server to be thier gup which is inside the subnet. I am pushing out some client installs and will let it upgrade those test computers etc. How do I know they are hitting the gup for updates.

Hi,

You can check with below link.

http://www.symantec.com/business/support/index?page=content&id=TECH97190&locale=en_US

When I setup the GUP and am using a server in the particular subnet that I want for that, do I need to use the "specify an internal live update server"? and if so how do I put that in? The server is mar-wsus

You can check with below link.

http://www.symantec.com/business/support/index?pag...

 

 

Those are pretty difficult ways to see if it works. I wonder what happens if I just turn off the GUP server and see if the client updates or will it failover to the SEPM server itself to get the updates?

As a test I went to a computer and told it to do LiveUpdate both with the GUP server on and also off I get the following:

Connecting to liveupdate.symantecliveupdate.com...
Connected to LiveUpdate server successfully.

Doesn't look like the GUP thing works to me.

do you have internal Liveupdate server? if yes, you can add it.

Here is maybe an easier way how to check if client is getting updates from GUP:

https://www-secure.symantec.com/connect/articles/how-can-we-check-which-content-sep-121-clients-are-downloading-gup

Thank you, thank you for this link. Symantec needs to put that in for reference instead of the previous links.

Yes, it is quite usefull information and to the moment I believe easiest way to check from the clients if they are downloading from GUP.

I just did the SylinkMonitor but it does not give me so far where it might download from. When I went to luall manually and ran it it told me no updates were needed and the SylinkMonitor showed me nothing. But I do see a "Number of ‘Group Update Provider Mapping entries’ in the policy: 1" when I look at the SEP client system logs. Does that mean it's working?

From my log.

GUP type: Multiple Group Update Providers last GUP type: Invalid Group Update Provider type

does that mean I do not have it setup correctly in SEPM?

Hello,

Check these Articles which would be of interest to all the participants of this Thread - 

Generate LiveUpdate Policies that have many GUP Subnets

https://www-secure.symantec.com/connect/downloads/generate-liveupdate-policies-have-many-gup-subnets

How To Save Time Entering Multiple Explicit Group Update Providers (GUPs)

https://www-secure.symantec.com/connect/forums/how-save-time-entering-multiple-explicit-group-update-providers-gups

Hope that helps!!