How to change the ePolicy Orchestrator agent-to-server communication secure port

Technical Articles ID: KB72936
Last Modified: 2023-08-11 05:32:02 Etc/GMT

Environment

ePolicy Orchestrator (ePO) 5.x
McAfee Agent (MA) 5.x

Summary

This article explains how to change the ePO agent-to-server communication secure port.

On a new ePO installation, you can modify the default port value (443) for the agent-to-server communication secure port entry. The current design doesn't allow you to change this port through the ePO console after the product has been installed. If you need to change the port number after an upgrade from an earlier version of ePO, perform the steps in this article.

This port change affects all managed systems, unless the feature has been disabled in the Server Settings on the ePO server. With this feature enabled (default), you must modify the port setting on each managed MA system (see step 7 in the Solution). Or, you can redeploy MA to all affected systems.

NOTES:

There's no automatic port validation for this procedure. You must make sure that the selected port isn't already in use.
Back up ePO and the ePO database before you change the secure port. This action makes sure that you can revert the setting in the event of any issues.
IMPORTANT: Before you begin the process explained in this article, you must back up your ePO server. See the following KB articles for more information:
- KB87976 - Overview of the ePolicy Orchestrator 5.x Disaster Recovery Snapshot feature
- KB66616 - ePolicy Orchestrator server backup and disaster recovery procedure

Solution

To change the ePO agent-to-server communication secure port:

Consideration
Reduce the duration for which an MA client is unable to communicate with the server because of the port change. This is achieved when you choose to reduce the agent-to-server communication interval (ASCI). The default is 60 minutes, and the interval for which agents are out of communication with the ePO server is two ASCIs.

You can change the ASCI back to the previous interval after the following actions:

The port number change completes
The agents communicate with the server

Stop the ePO services:
1. Click Start, Run, type services.msc, and click OK.
2. Right-click each of the following services and select Stop:
  
  McAfee ePolicy Orchestrator Application Server
  McAfee ePolicy Orchestrator Event Parser
  McAfee ePolicy Orchestrator Server
Change the port number in the ePO database. Connect to the ePO server database with SQL Server Management Studio and run the following SQL command against the correct ePO database:

Update [ePODBName].dbo.EPOServerInfo
Set [ServerHttpsPort] = NewPortValue

Here,
- [ePODBName] - The name of your ePO database; brackets are needed
- ewPortValue - The number of the port you want to use instead of the default 443
On the ePO server, edit the httpd.conf and ssl.conf files. The default location is <Installation_Directory>\McAfee\ePolicy Orchestrator\Apache2\conf).

For httpd.conf, locate the following line and replace 443 with the new value:

Listen 443

For ssl.conf, locate the following two lines and replace 443 with the new value:

<VirtualHost _default_:443>
ServerName <server>:443
Start the ePO services:
1. Click Start, Run, type services.msc, and click OK.
2. Right-click each of the services below, and click Start:
  
  McAfee ePolicy Orchestrator Application Server
  McAfee ePolicy Orchestrator Event Parser
  McAfee ePolicy Orchestrator Server
Edit the httpd.conf and ssl.conf files on each remote Agent Handler. The default location is <Installation_Directory>\McAfee\Agent Handler\Apache\conf):

For httpd.conf, locate the following line and replace 443 with the new value:

Listen 443

For ssl.conf, locate the following two lines and replace 443 with the new value:

<VirtualHost _default_:443>
ServerName <server>:443
Restart the ePO services on each remote Agent Handler, if any:
1. Click Start, Run, type services.msc, and click OK.
2. Right-click each of the following services and select Restart:
  
  McAfee ePolicy Orchestrator Server (This service might also be listed as MCAFEEAPACHESVR.)
  McAfee ePolicy Orchestrator Event Parser
3. Verify the new secure port number listed in lastSent_SiteList.xml, located in <Installation_Directory>\McAfee\Agent Handler\DB
Replace Sitelist.xml on all managed agents by following any one of the three options shown below:
- Option 1 - 5.x Agents:
  1. Locally reprovision the agent with maconfig.exe.
  2. At the command-line on the local PC, navigate to C:\Program Files\McAfee\Agent, and run the command shown below:
    
    maconfig.exe -provision -managed -dir "<directory location where the Sitelist.xml and security keys were exported from>"
  3. Send Sitelist.xml, srpubkey.bin, reqseckey.bin, req2048seckey.bin, and sr2048pubkey.bin from the ePO server to the computers you want.
- Option 2
  Use FrmInst.exe to update the secure port change:
  1. Click Start, Run, type explorer, and click OK.
  2. Navigate to the folder below on the ePO server:
    
    C:\Program Files\McAfee\ePolicy Orchestrator\DB\Software\Current\ePOAgent3000\Install\0409
  3. Copy the following files to a temporary folder on the client, for example, C:\Temp:
    
    srpubkey.bin
    reqseckey.bin
    sr2048pubkey.bin
    req2048seckey.bin
    agentfipsmode
    Sitelist.xml
  4. Run the following command on the systems that require an update to the secure port entry:
    
    NOTE: By default, FrmInst.exe is located in C:\Program Files\McAfee\Common Framework.
    
    FrmInst.exe /SiteInfo=C:\<Temporary_folder_path>\SiteList.xml
    
    Here, <Temporary_folder_path> is the temporary folder where the files listed in step c are located.
    
    Example: FrmInst.exe /SiteInfo=C:\Temp\SiteList.xml

Related Information

Essential reading of the use of the /forceinstall switch.

IMPORTANT:

The McAfee Agent /forceinstall switch must not be used unless indicated in a KB article to resolve an issue.
Using the /forceinstall switch as a regular process can cause issues with the McAfee Agent, which leads to duplicate entries in the ePolicy Orchestrator system tree. It might lead to systems getting an incorrect policy assignment.

The standard use case as mentioned in the McAfee Agent product guide is to use the /forceinstall switch only to either:

Change the installation directory
Or
Downgrade the McAfee Agent

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

How to change the ePolicy Orchestrator agent-to-server communication secure port

Environment

Summary

Solution

Related Information

Affected Products

Languages:

Title

Title

Knowledge Center

How to change the ePolicy Orchestrator agent-to-server communication secure port

Environment

Summary

Solution

Related Information

Affected Products

Languages:

Choose your region

Title

Title