Migrating ESET ERA proxy to Apache HTTP Proxy

[sysaddad]

Good afternoon. Looking for some tips to get my Roaming clients connecting to my newly upgraded ERA 6.x to ESMC 7.x. I can connect to the local machines (it was a simple rip and replace) but the fact that the ERA proxy is no longer supported by ESMC is killing me.

I’ve disabled the ERA Proxy and followed the instructions closely as listed here by ESET knowledge base.

I have questions about this setup. We have our AV server and our AVDMZ server which is where the proxy was installed. Specifically the bit about “making sure both IP’s are listed in the agent policy” and adding the lines to the configuration (CONF) file in Apache directory. I am not sure whether to reference to IP or hostname of the DMZ server (which agents will communicate with outside of our network) or the on-prem IP/host name (the server that the DMZ talks to. It’s all very confusing and i wish ESET had not done away with the ERA Proxy. Sorry in advance if this request looks messy. I have been tinkering with this for two days.

Thanks!

[culesflatlander]

Hi have tagged Taryn as she will be better placed to assist.

That said we use 7 and we do not use a proxy from remote sites. The idea as i understand it is that the agent will handle it all.

We set up a subdomain and referenced this via dns entries and then added those to the install package.

We then used the cfonfig files to customise the install and import those custom files into tge corresponding type of install.

That said we are still in tge early stages and refining bit by bit but using tgese config files helps a lot.
You could trt and check if the connecton is being blocked by putting the firewall in interactive mode which then prompts for every action. It is quite handy for troubleshooting at tge client.

The client will also generate lig files that help which i think are in program data.

Once you switch off interactive mode it recalls all the ones you have accepted.

Another to try on the client is to run a repair on the agent and it will prompt for the address local or external

Not sure if that helps but it is well meant and Taryn and ESET support are generally great. In fact the support is the main reason we bought it

@taryn-eset

[taryn-eset]

Hi Hunter,

I apologize for the confusion you’re experiencing! Creating a local DNS record that if someone is local and references the external hostname of the server, it is redirected to the on-premise host name. You can do the same for the IP address. This is done in the DNS server settings.

Then in your agent policy you can only reference the external hostname (just in case the IP changes for any reason) is a much safer approach. This would then allow when computers are local they will communicate via LAN and when remote over WAN.

I hope this helps,

Taryn

@sysaddad

[sysaddad]

Taryn, thank you. Pardon my ignorance here, but when you say to create a local DNS record, where exactly am I creating this in my case?

[culesflatlander]

Hi we do the same for our remote users who visit HO depending on your setup will depend on your individual setup but essentially you publish one rule for when off-site and they follow the internal rule when on the domain. We put one in the forward lookup zone and one on the gateway firewall for incoming traffic to point external traffic at the correct location.

Eset still updates whether connected to the console or not this is really for management purposes

[taryn-eset]

Hi Hunter, I replied to your private message so we can continue communication on there!

Best,

Taryn

@sysaddad