ESA/CES - Procedure to register clustered appliances to AMP for Endpoints - Clarification

[RSHSN]

After following this document, I do not understand how to accomplish step 5 without over writing the cluster config.

https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/213585-esa-ces-procedure-to-register-clustere.html

Step 5 - Switch to Cluster Mode.

After each machine has registered with AMP for Endpoints, change the mode back to cluster by removing the machine level overrides for File Reputation and Analysis under Centralized Management Options > Manage Settings.  All of the device settings must match for the clustering to work successfully.  The Register Appliance with AMP for Endpoints button will still be greyed out and unavailable in cluster mode.

Also the bug referenced in the warning is not available by link

Warning: ESA/CES software versions affected by defect id:CSCvp23281 should skip Step 5 as provided on the defect workaround.

Can anyone clarify?

Thanks.

[Ken Stieers]

Cluster the boxes, set up everything on that page except the tie to the AMP cloud, submit/commit.

Then override it on each device, and register it to the amp cloud.  

Then tell go back to the top and tell the config for that page to use the cluster configuration again.  You're overwriting each devices config with the cluster config, not the other way around...

I couldn't see the bug either... 

[RSHSN]

Thank you Ken.

I still don't see how to accomplish this. I have only the option to Copy or Move the settings from the cluster to machine level or Machine level to cluster. If I delete the machine level settings to inherit from the cluster, the machines immediately stop communicating with AMP for Endpoints.

[Ken Stieers · Accepted solution]

Which I think means you're affected by the bug.

Don't do step 5, which is "flip back to this page being clustered"



So until that's fixed, you'll have to manage this page for each box...

[RSHSN]

Excellent. Thank you very much.

Rob.