-
Title
How to make your System Management Appliance (SMA) publicly facing - SMA integrity test -
Description
This article covers the setup of the SMA (KACE System Management Appliance) in your production environment, or trying to troubleshoot why the clients aren't communicating over the network correctly to the SMA.
In this example the appliance and the user are in the same network and use the same public facing IP-Address (share a router) -
Resolution
Forward ports to the SMA
- Make a new rule for port forwarding.
- Log into the router and go to the Port Forwarding section. - This differs from the model of any router. Please review the Documentation of the Router. Usually this setting is found under Advanced settings.
- Grab the internal IP address of the SMA
- Make the external port and internal port the same.
- A full port and protocol list can be found here: https://support.quest.com/kb/111775/
- minimal requirements are ports 80, 443 (access to the web interface and agent connectivity)
If all setup correctly an access to the web interface using the external IP can be done. This was the first hit on google to determine the external IP: whatismyipaddress.com
In your browser, enter your public IP address. You should be able to get to your SMA webUI now.
Pointing the agents to the SMA server public address
Since all nessesary ports are forwarded the only thing which needs to be done is telling the agents that they need to check in into a new appliance-address
Windows 32 Bit: c:\program files\quest\kace\amptools.exe -resetconf host=your.public.ip.address
Windows 64 Bit: c:\program files (x86)\quest\kace\amptools.exe -resetconf host=your.public.ip.address
Mac OS: /Library/Application Support/Quest/KACE/bin/amptools.exe -resetconf host=your.public.ip.address
Linux: /opt/quest/kace/bin/amptools.exe -resetconf host=your.public.ip.addressThats all! Just wait for the first initial inventory to happen. If you have problems, try to telnet over those ports to make sure they're opened.
Example if my public IP address was 66.77.88.99:
From command prompt:
telnet 66.77.88.99 80
telnet 66.77.88.99 443
You should get a blinking cursor
OR
From a mac, you can use NetCat (nc)
Example:
nc -vz 66.77.88.99 80
Result:
Connection to 66.77.88.99 80 port [tcp/http] succeeded!
Instead of the IP address also a DNS name can be used.
To deploy the changes to the clients a GPO is the smartest way.Final Note
Every environment is different; different firewalls, switches, routers, web filters, proxies, etc. You may run into issues where you can't access those ports. Check with your network admin to see what kind of security devices you have and have them check to see if they are opened for you.