Issue

• You have ESET Security Management Center (ESMC) installed with no access to the public internet and want to maintain updates to ESET products

Solution

Create the repository using the Mirrortool:

1. Prerequisites
2. Create an offline repository
3. Move files to the offline web server (e.g. Apache)
4. Set up Agents and endpoints to use the offline web server

Configure the ESET Mirror Tool to download updates from another ESET Mirror Tool

I. Prerequisites

• ESMC 7.x installed or ESMC Virtual Appliance deployed
• Apache (httpd) (the ESMC Virtual Appliance have Apache pre-installed) or IIS (part of Windows Server)
• Download the MirrorTool (for mirror on Linux) or MirrorTool.exe (for mirror on Windows). You can download the Mirror Tool from the ESET download page. See the complete documentation for more information on the Mirror Tool and a list of available parameters.
  • MirrorTool.exe does not run on Windows XP and Windows Server 2003
• If you run the Mirror Tool on Windows, install the following:
  • Visual C++ Redistributable for Visual Studio 2010
  • Visual C++ 2015 Redistributable x86
• One machine connected to the internet to create and update the offline repository
  • At least 250 GB of free space at the machine where the full offline repository is created
• Offline license files from ESET License Administrator or ESET Business Account
  
  • How can I download the offline license file from ESET License Administrator?
  • How can I download the offline license file from ESET Business Account?

II. Create an offline repository

The Mirror Tool downloads data to the --repository-intermediate folder and when the download is finished, it moves all the data to --repository-final folder. Make sure to have enough space free on your drive, each folder is 100GB in size. As ESET releases new updates and product versions, the total size will continue to grow.

1. Run the following command in the command line on a computer with internet access. Use MirrorTool.exe on Windows machines and MirrorTool on Linux.

MirrorTool.exe --repositoryServer AUTOSELECT ^
--intermediateRepositoryDirectory repository-intermediate ^
--outputRepositoryDirectory repository-final

You can reduce the download size of the folder by using the following parameters:

--productFilterForRepository – Later in this document, you can find a list of the product names that can be used with this parameter. Enter the product names or a part of the name. Enclose the in " " if it contains a space. Separate multiple names by a single space, for example: "ESET Management Agent" "Antivirus". When filtering for a partial name, for example "Agent", all products containing the string are filtered.

--languageFilterForRepository – Select which language packs would be downloaded. Enter the codes separated by a single space, for example: sk_SK fr_FR de_DE. See the list of language codes.

The following command only downloads the packages necessary for an ESMC upgrade. For example, you can use such a repository when installing ESET Management Agent via the following methods:

• Push install (Server task - Agent Deployment)
• Live installer
• All-in-one installer
• Installation with a direct link to the repository

Example usage of the --productFilterForRepository parameter:

MirrorTool.exe --repositoryServer AUTOSELECT ^
--intermediateRepositoryDirectory repository-intermediate ^
--outputRepositoryDirectory repository-final^
–-productFilterForRepository "ESET Management Agent" "ESET Security Management Center Bootstrapper" "ESET Security Management Center Server" "ESET Security Management Center WebConsole"

2. Create an update mirror

To create an update mirror, you need the offline license file (license_file.lf) available on your intermediary machine. Run the following command to download the update files:

MirrorTool.exe --mirrorType regular ^
--intermediateUpdateDirectory mirror-intermediary ^
--offlineLicenseFilename license_file.lf ^
--outputDirectory mirror-final

The Mirror Tool creates two folders, temporary and final with 3GB size. You can use the --excludedProducts parameters to decrease the download size:

• ep4
• ep5
• ep6
• ep7
• era6 (covers all ESMC and ERA packages)

Example usage of the --excludedProducts parameter:

MirrorTool.exe --mirrorType regular ^
--intermediateUpdateDirectory mirror-intermediary ^
--offlineLicenseFilename license_file.lf ^
--outputDirectory mirror-final ^
--excludedProducts ep4 ep5

III. Move files to the offline web server (e.g. Apache)

After you download the update and/or repository files (Part 1), choose a local webserver. Set up the webserver to serve the updates and installers to the machines in the offline environment. See the setup instructions for Apache and Microsoft IIS below.

Alternative: I want to distribute updates using the ESET Endpoint as the update mirror.

...
Listen 3128
...

Listen 8080

...
Listen 3128
...

Listen 8080

#DocumentRoot /var/www/html

DocumentRoot "/var/www/html"
<Directory "/var/www/html">
Options Indexes FollowSymlinks
AllowOverride none
Require all granted
</Directory>

sudo systemctl restart httpd.service

SELINUX=disabled

iptables -A INPUT -p tcp --dport 8080 -j ACCEPT
ip6tables -A INPUT -p tcp --dport 8080 -j ACCEPT
service iptables save
service ip6tables save

Optional: Install ESET security products from a shared location

In this case, we do not use a repository. You need to have ESET Management Agents installed on client machines.

1. Download a ESET Endpoint installer (ESET download site).
   
   
2. Save the installer to a location accessible to other computers in your offline network. We recommend creating a logical folder structure based on product names and versions.
   
   
3. Log in to your management console (ESMC).
   
   
4. Create a new Software Install task with the direct link. [KB6726] Deploy or upgrade ESET endpoint products using ESET Security Management Center (7.x)

IV. Setup your server and clients to use the offline repository

See the examples below to set paths of Repository and Update servers with ESET Endpoint version 7.x products. Do the following in the ESET Security Management Center:

Set up the ESMC Server to use the offline repository and updates

Server settings

1. Log in to ESMC Web Console.
   
   
2. Navigate to More > Server Settings > Advanced Settings > Repository.
   
   
3. Type in your address to the Server field.

4. Navigate to the Updates section.
   
   
5. Type in your offline server's address to the Update server field. Type the whole address with the folder structure, according to the product you are setting up.

6. Click Save.

Use the correct path for each product

For the Update server settings, always enter the full path according to the product you are setting up. For example: http://update.server.local/mirror-final/eset_upd/ep7

The last folder in the path should be one of the following:

Folder Name	Updated products
ep4	ESET Endpoint 4.x
ep5	ESET Endpoint 5.x
ep6	ESET Endpoint 6.x
ep7	ESET Endpoint 7.x
era6	ERA 6.x and ESMC 7.x

Set up ESET Management Agents to use the offline repository and updates

Agent policy

You need to apply the new settings to all machines (their Agents) which are using the offline server for updates and repository. Select a suitable policy or create a new one and assign it to those machines.

1. Log in to ESMC Web Console.
   
   
2. Navigate to Policies.
   
   
3. Select the appropriate policy.
   
   
4. In the policy Settings section navigate to > Advanced Settings > Repository.
   
   
5. Type in your address to the Server field.

6. Navigate to Updates section.
   
   
7. Type your offline server's address to the Update server field. Make sure to type the whole address with the folder structure, according to the product you are setting up.

Set up ESET Endpoint products to use the offline repository and updates

Policies for ESET Endpoint products (on Windows)

How can I activate ESET Endpoint products in the offline environment?

You need to apply the new settings to all machines (their ESET security products) which are using the offline server for updates. Select a suitable policy or create a new one and assign it to those machines.

1. Log in to ESMC Web Console.
   
   
2. Navigate to Policies.
   
   
3. Select the appropriate policy.
   
   
4. In the policy Settings section navigate to > UPDATE > Profiles > Updates > Modules Updates.
   
   
5. Deselect the Choose automatically option.
   
   
6. Type in your offline server's address to the Custom server field. Make sure to type the whole address with the folder structure, according to the product you are setting up. The example image below shows the ESET Endpoint 7.x folder address.

Use the correct path for each product

For the Custom server settings, always type the full path according to the product you are setting up. For example: http://update.server.local/mirror-final/eset_upd/ep7

The last folder in the path should be one of the following:

Folder Name	Updated products
ep4	ESET Endpoint 4.x
ep5	ESET Endpoint 5.x
ep6	ESET Endpoint 6.x
ep7	ESET Endpoint 7.x
era6	ERA 6.x and ESMC 7.x

Other products

If necessary, create policies for any ESET product similar to the examples shown above.