McAfee EPOCDE-AA-BA - ePolicy Orchestrator - PC, Product Manual

Page: 124 / 328

Environmental borders and their impact on system organization
How you organize the systems for management depends on the borders that exist in your network.
These borders influence the organization of the System Tree differently than the organization of your
network topology.
McAfee recommends evaluating these borders in your network and organization, and whether they
must be considered when defining the organization of your System Tree.
Topological borders
Your network is already defined by NT domains or Active Directory containers. The better organized
your network environment, the easier it is to create and maintain the System Tree with the
synchronization features.
Geographic borders
Managing security is a constant balance between protection and performance. Organize your System
Tree to make the best use of limited network bandwidth. Consider how the server connects to all parts
of your network, especially remote locations that are often connected by slower WAN or VPN
connections, instead of faster LAN connections. You may want to configure updating and agent-server
communication policies differently for remote sites to minimize network traffic over slower connections.
Grouping systems first by geography provides several advantages for configuring policies:
• You can configure update policies for the group so that all systems update from one or more
distributed software repositories located nearby.
• You can schedule client tasks to run at times better suited to the site’s location.
Political borders
Many large networks are divided by individuals or groups responsible for managing different portions
of the network. Sometimes these borders do not coincide with topological or geographic borders. Who
accesses and manages the segments of the System Tree affects how you structure it.
Functional borders
Some networks are divided by the roles of those using the network; for example, Sales and
Engineering. Even if the network is not divided by functional borders, you may need to organize
segments of the System Tree by functionality if different groups require different policies.
A business group may run specific software that requires special security policies. For example,
arranging your email Exchange Servers into a group and setting specific exclusions for VirusScan
Enterprise on-access scanning.
Subnets and IP address ranges
In many cases, organizational units of a network use specific subnets or IP ranges, so you can create
a group for a geographic location and set IP filters for it. Also, if your network isn’t spread out
geographically, you can use network location, such as IP address, as the primary grouping criterion.
If possible, consider using sorting criteria based on IP address
information to automate System Tree creation and maintenance. Set IP
subnet masks or IP address range criteria for applicable groups within
the System Tree. These filters automatically populate locations with the
appropriate systems.
Tags and systems with similar characteristics
You can use tags for automated sorting into groups. Tags identify systems with similar characteristics.
If you can organize your groups by characteristics, you can create and assign tags based on that
12 Organizing the System Tree
Considerations when planning your System Tree
124 McAfee
®
ePolicy Orchestrator
®
4.6.0 Software Product Guide