UTM to allow UEFI boot to SCCM for OS deployment

[techie17]

Hi

We have a remote site with a Sophos UTM and with a VPN back to our main office and i want to UEFI/PXE boot computers so that i can deploy the OS from the SCCM server which is located at the main site.

We use the DHCP server on the UTM and i have set options 66 and 67 to the same details as our main office windows DHCP option 66 and 67, and i've also set the "next-server" option set as the SCCM IP address however when the computer UEFI boots, I only get a Windows Deployment Services (server IP: 0.0.0.0) screen with the message "Error Code 0x0000023

What am i doing wrong? Do i need IP helpers set on the HP switch? if so what IP address would the IP helper need to be?

Both sites are on the same version of UTM 9 and both sites and a 100mb fibre internet connection. There are also no servers at the remote site.

Many thanks

[smarties11]

Is it feasible to set up a secondary sccm site server at the remote site?

 

OSD across a 100mb VPN link will be slow and bandwidth hungry. Especially if you are using sccm for windows updates and application deployment too.

 

A secondary server will allow you to publish all your content from the primary site and then pxe boot locally. The minimum spec for a secondary server isn't that high and it can run from an sql express db on the same server.

[Jonah]

Doesn’t even need to be a secondary site server, a distribution point should do the trick. We use this across 5 schools connected via IPSec VPN with a single site server at one site, and DPs at the others

[markwilfan]

From what I remember you only need a secondary server if you go above 100000 clients. As previously said so will do the trick

[Wave9_Matt]

If you have a mix of UEFI and Legacy BIOS machines you cannot use DHCP Scope Options to forward PXE requests to the Boot WIM on the SCCM DP / WDS server. You'll need to configure IP Helpers on the UTM to point at the WDS on the site at the other end of the VPN.

 

As smarties11 said though it might be better to put a PXE enabled distribution point on the remote site, 100Mbps could take some time if you have a sizable windows image to transfer.