Getting a DMZ Server to talk to internal MP so it can be managed. I am close but seems I am missing something.

Question

Getting a DMZ Server to talk to internal MP so it can be managed. I am close but seems I am missing something.

Thomas Faherty 151

Hello,

recently I have been asked to bring a machine in our DMZ under patch control of our SCCM system. We've given it our main CA cert, along with a client auth cert from our SCCM server. I can hit the mp list URL and SMS_MP/.sms_aut?SITESIGNCERT from a browser but I seem to be getting some errors in my ClientLocation log which I will attach that lead me to think it's unable to talk. I added our site server info to the lmhost file along with the host file which allows me to ping our management point. Then I ran a client install specifying the site server FQDN and what not. The client installs, says it is on internet, but then wont talk. Logs seem to recognize the site server but I am missing something. I am hoping some one can catch what I have missed here.

SCCM version 2010 running on Windows Server 2016

135607-clientidmanagerstartup.log
135675-clientlocation.log

Accepted answer

0 additional answers

Your answer

Answer 1

Amandayou-MSFT 11,156

Hi @Thomas Faherty ,

Could we know that there is the MP or SUP role in the DMZ? In our environment, it is recommended to install a new site server that has MP/DP/SUP roles for your test servers to take more flexible management.
Here is the article about the best practice of deploying updates patch in DMZ server:
https://social.technet.microsoft.com/Forums/office/en-US/921bc8c2-e8b6-4f78-af1a-b589edd8b163/the-best-practice-of-deploying-updates-patch-in-dmz-server-quotsccm-wsus-quot?forum=configmanagergeneral

If it exists already, we could try to connect the DMZ MP to check if it is normal and there is any error in these logs.

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Thomas Faherty 151 Reputation points

2021-09-28T16:26:55.807+00:00

No, nothing in the DMZ. I suggested that we set some stuff up in the DMZ but was told they don't want to go that far just yet so I am trying to get things to talk inward for the time. I will read the best practices and see if there is anything in there that can help.
Thomas Faherty 151 Reputation points

2021-09-28T17:07:38.093+00:00

So it looks like this led me down the right path. I think I was just missing the use PKI command switch when I installed the client and because I didn't have that it wasn't using it. Thank you again for your help!

ccmsetup.exe /UsePKICert /NoCRLCheck SMSSITECODE=<SITENAME> SMSMP=<MP-FQDN>
Thomas Faherty 151 Reputation points

2021-10-07T22:22:48.41+00:00

I wanted to add more info if anyone else ran into the same situation of trying to pull a client from a DMZ Workgroup into SCCM

I added our Root CA cert, and our SCCM client auth cert onto the machine then followed this guide.

https://www.windows-noob.com/forums/topic/8977-how-can-i-remotely-control-workgroup-computers-in-system-center-2012-configuration-manager/

with the one exception being I used the command line to install the client in this format

ccmsetup.exe /UsePKICert /NoCRLCheck SMSSITECODE=<SITENAME> SMSMP=<MP-FQDN>

To use the ccmsetup.exe you should be able to browse at this point to your client location as long as it is network hosted so something like

\SCCM-Server.company.com\ClientFolder\

From here you can either copy the client over or modify the command to run from the network location.
JessicaP_83 26 Reputation points

2022-02-25T21:07:43.347+00:00

Hello @Thomas Faherty , thanks for your comment here. Can you please specify the step in detail where in you added the cert "I added our Root CA cert, and our SCCM client auth cert onto the machine".
I have aaded root CA cert and SCOM client cert for SCOM to work on my DMZ machine so used the switch in my ccmsetup command line "ccmcertsel=<DMZ host name>" , but its not working. Am i missing out any step here to make SCCM recognise the certificate I added for SCOM already.

Share via

Getting a DMZ Server to talk to internal MP so it can be managed. I am close but seems I am missing something.

0 additional answers

Your answer