Question What should be considered when installing the Altiris Agent on a server in the DMZ?
The Altiris Agent communicates over Port 80, by default. Port 80 must be opened, or another port utilized.
A DMZ does not utilize DNS. DNS is needed in order for the client to resolve the IP address of the Notification Server. And so it's necessary to put the Notification Server Name into the system's Windows\System32\drivers\etc\Hosts file.
Other items to consider:
Define an Notification Server Site for the DMZ subnets, and not assign any Package Server to that site (unless of course there is a Package Server in the DMZ).
UNC package codebases should be disabled to systems in the DMZ since those won't work across the DMZ firewall.
Another consideration in a DMZ is not using network throttling, since ICMP (ping) would be turned off there. The policies would try testing the network with ping and could not download its packages (Patch, Inventory...)
Imported Document ID: HOWTO8478
Subscribing will provide email updates when this Article is updated. Login is required.