Upgrade infrastructure with ERA 6.5 Proxy

The ERA Proxy component is discontinued in ESMC 7. There is a replacement proxy solution available. During the upgrade of your infrastructure (Server and Agents), you have to migrate your proxy solution.

Before upgrading, read the information below.

validation-status-icon-error WARNING

Be careful about connection compatibility:

oERA Version 6.x Agent can connect to ESMC 7 Server.

oESET Management Agent (version 7) cannot connect to ESMC Server via ERA Proxy.

oESET Management Agent (version 7) cannot connect to ERA

The communication protocol between Agent and ESMC Server does not support authentication. Any proxy solution used for forwarding Agent communication to ESMC Server that requires authentication will not work.

Do not upgrade ERA Agents (connecting via Proxy) before setting up  a proper proxy solution.

Upgrade scenarios

If you are running an environment that uses the ERA Proxy component, follow one of the scenarios below to upgrade your infrastructure to ESMC 7.

ERA Proxy installed on Windows (this page)

ERA Proxy installed on Windows (Knowledgebase article with more detailed instructions)

ERA Proxy deployed as Virtual Appliance (Knowledgebase article)

Upgrade infrastructure with ERA Proxy installed on Windows

1.Back up your ERA Server.

2.Upgrade your ERA Server to ESMC 7 via Remote Administrator Components Upgrade task. (Server, Agent and Web Console are upgraded)

3.Wait approximately 24 hours to make sure that the upgraded environment runs smoothly.

4.Upgrade the ERA Agent on the ERA Proxy machine via Security management Center Components Upgrade Task.

5.Install Apache HTTP Proxy on the machine where the ERA Proxy is installed. Use the pre-configured ESET version of Apache. (download link)

6.Modify Apache HTTP Proxy configuration file httpd.conf located in C:\Program Files\Apache HTTP Proxy\conf.

a.By default, port 2222 is used for communication with the ESET Management Agent. If you have changed your port during the installation, use your port number. Change the 2222 in the line: AllowCONNECT 443 563 2222 for your port number.

b.Add a separate ProxyMatch segment:

I.The address that your Agents use to connect to the ESMC Server.

II.All other possible addresses of your ESMC Server (IP, FQDN)
(add all of the code shown below; IP address 10.1.1.10 and hostname hostname.example are only examples to be replaced with your actual addresses. You can also generate the ProxyMatch expression in this Knowledgebase article.)

<ProxyMatch ^(hostname\.example(:[0-9]+)?(\/.*)?|10\.1\.1\.10(:[0-9]+)?(\/.*)?)$>

Allow from all

</ProxyMatch>

c.Restart the Apache HTTP Proxy service.

7.Create a new policy on your ESMC Server.

a.In the ESMC Web Console click Policies > Create New.

b.In the Basic section, type a Name for the policy.

c.In the Settings section select ESET Management Agent.

d.Navigate to Connection > Server connects to > Edit server list.

e.Click Add and enter the address the of the proxy machine (the machine where the ERA Proxy is installed) in the Host field. Click OK.

f.Repeat the step above and add the address (the address must match what was used for Agent configuration) of your ESMC Server.

g.Click Save.

h.Navigate to Advanced Settings > HTTP Proxy and set Proxy Configuration to Different Proxy Per Service.

i.Click Replication > Edit and enable the Use proxy server option.

j.Type the IP address of the proxy machine to the Host field. (the IP address 10.1.1.10 is only an example, replace it by your address)

k.Leave the default value 3128 for the Port.

l.Click Save and Finish to save the policy. Do not assign the policy to any computers yet.

validation-status-icon-warning IMPORTANT

It is absolutely necessary to have both IP addresses in one list applied on the client. If the Agent does not have this information on one policy, it will be unable to connect to the Proxy and Server after the upgrade. An agent with this issue must be fixed manually by running a repair installation and using the correct ESMC Server address.

If the HTTP Proxy setting is not applied in the policy, the Agent will not be able to connect to ESMC Server.

8.Choose a single computer that is connected via ERA Proxy and assign the new policy to that computer.

9.Wait a few minutes until the policy is applied and check if the computer is still connecting the ESMC Server.

10. Run the Security management Center Components Upgrade Task to upgrade the client.

11. After the client is upgraded to version 7, check if it is still connecting to the ESMC Server. If the computer is successfully connecting after the upgrade, continue upgrading the other computers.

validation-status-icon-warning IMPORTANT

If you have a large network, start by upgrading departments with IT experience or users who are physically close to the computers to simplify the troubleshooting process.

12. Apply the policy (from step 5) to other computers connected via the ERA Proxy.

13. Wait a few minutes until the policy is applied and check if clients are still connecting to the ESMC Server.

14. Run the Security management Center Components Upgrade Task on these clients.

15. If all clients are connecting to the ESMC Server after the upgrade is finished, you can proceed with next steps.

16. Modify the policy (from the step 5). Navigate to Policies > click the gear icon next to the policy you want to modify and click Edit.

a.In the Settings > Connection click Edit server list and remove the address of the ERA Proxy machine.

b.Click Save.

c.Click Finish to save and apply the policy.

17. Remove the ERA Proxy using Client Tasks > Software Uninstall.