Using Agent Handlers behind a DMZ, firewall, or in NAT networks: best practices

Without Agent Handlers, any Trellix Agent behind a DMZ, firewall, or in a NAT network can be viewed with the ePO - On-prem server. But you can't manage or directly manipulate those systems in the NAT network.

With an Agent Handler behind the DMZ, you can address systems within the NAT region for wake-up calls, data channel access, and more.

Note

This Agent Handler connection requires access to both the SQL database and the ePO - On-prem server. Some firewall rules are necessary for this configuration.

This diagram shows an Agent Handler with managed systems behind the DMZ and these connections:

Agent Handler behind the DMZ

This table lists all ports used by the ePO - On-prem server and the other network components.

Important

The ports connecting the Agent Handler to the ePO - On-prem server and SQL database must be open to connect to the Agent Handler through a firewall.