Attaching and detaching DMZ servers

Use the CLI commands in this topic to attach or detach DMZ servers to or from the primary Endpoint Security (HX) server. Attaching the servers allows them to communicate.

Note

Up to two DMZ servers can be attached to an on-premises Endpoint Security (HX) appliance or virtual Endpoint Security (HX) server. In cloud environments, only a single DMZ server can be connected to the Endpoint Security (HX) server.

A single Endpoint Security (HX) ecosystem, which includes the Endpoint Security (HX) server and any installed DMZ servers, can support up to 100,000 agents.

Important

Your servers must run the same version of Endpoint Security (HX) software. If they use different versions, communication between them will fail.

The Central Management appliance can be used to upgrade and manage DMZ server, with the following caveats.

Indicator updates from the Central Management appliance or from the DTI (Dynamic Threat Intelligence) Cloud cannot be sent directly to the DMZ server. Instead, they are acquired from the Central Management appliance or the DTI by the primary Endpoint Security (HX) server and transferred to the DMZ server.
If you have problems connecting your Central Management appliance to your DMZ server, consider the firewalls your organization has in place. In some circumstances, the DMZ server is not accessible to the Central Management appliance because a firewall is blocking the connection.

Prerequisites

Admin or fe_services access

Attaching a DMZ server to the primary Endpoint Security (HX) server

Follow the instructions below to attach a DMZ server to the primary Endpoint Security (HX) server.

To attach a DMZ server to the primary Endpoint Security (HX) server:

On the DMZ server, enable CLI configuration mode:
```
hostname > enablehostname # configure terminal
```
Verify the server's current role:
```
hostname (config) # show hx ecosystem
```
The DMZ server displays:
```
Appliance Role: dmz
```
Generate a passphrase for the DMZ server:
```
hostname (config) # hx ecosystem dmz attach-initiate
```
The system displays a passphrase that you must use on the primary Endpoint Security (HX) server by the expiration time shown.
For example:
```
Attach passphrase: $J^N%n@rsZ6F
```
```
This passphrase will expire at 2014-11-20 21:29:54 UTC.
```
```
If you do not use it in that time, you will need to re-initiate the listener.
```
Note
Reinitiating the listener means repeating this step to generate a new passphrase.
On the primary Endpoint Security (HX) server, enable CLI configuration mode:
```
hostname > enablehostname # configure terminal
```

Attach the DMZ server to the primary Endpoint Security (HX) server:

hostname (config) # hx ecosystem dmz attach <dmz-hostname-or-IP> passphrase <passphrase>

Verify that the DMZ server is attached.
- View ecosystem roles:
```
hostname (config) # show hx ecosystem
```
  A primary Endpoint Security (HX) server configuration with an attached DMZ server displays:
```
Appliance Role: master
DMZ Appliance: {<IP address or domain name of DMZ appliance>}
```
- View the DMZ server attachment in the PKI settings:
```
hostname (config) # show hx pki
```
  The response includes certification and ping times, which should be the same for both servers.

Detaching a DMZ server from the primary Endpoint Security (HX) server

Follow the instructions below to detach a DMZ server from the primary Endpoint Security (HX) server.

To detach a DMZ server from the primary Endpoint Security (HX) server:

On the primary Endpoint Security (HX) server, enable CLI configuration mode:
```
hostname > enable
hostname # configure terminal
```

Detach the DMZ server:

hostname (config) # no hx ecosystem dmz <dmz-hostname-or-IP>

Verify that the DMZ server is no longer attached to the primary Endpoint Security (HX) server.
- View the ecosystem roles:
```
hostname (config) # show hx ecosystem
```
  The list of current HX ecosystem configuration roles no longer contains the DMZ server that you detached.
- View the PKI settings:
```
hostname (config) # show hx pki
```
  The response no longer includes the information about the DMZ server that you detached.