EPO limitations for not connected devices to LAN/VPN

[User16263851]

Hi,

We are ENS users and planning to deploy the ATP and may be EDR. Since most of our users are working from home, some of them won't connect via VPN to the network  so often, so I guess some of the advanced capabilities of EDR or ATP won't work since EPO won't have visibility of these computers (f.i. blacklist a file, track an infection, etc). We cannot move to a cloud based EPO due to lack of support of Device encryption. 

So, the question is:

- What are the real limitations of the advanced capabilities in this scenario?

- How can them be overcome? 

- Is a good practice publish the EPO to Internet?

Thank you

[ChrisQ · Accepted solution]

To allow remote users to access ePO, we have added an additional agent handler/dxl server in the DMZ and control access to ePO from it with a traffic manager.

Machines need to know about the new agent handler, but once this is done (via installing a new agent or connecting to ePO using a vpn) they then work exactly the same as machines on our network. DXL allows communication even to machines on 10.192.x.x addresses. 

[cdinet · Accepted solution]

This section in product guide tells how to set up agent handler in dmz.

Best Practices: Adding an Agent Handler in the DMZ - McAfee ePolicy Orchestrator 5.10.0

[User16263851]

Thank you all for your answers!