> Source: [sk171703](https://support.checkpoint.com/results/sk/sk171703) # sk171703 - "Super Node" mode of Endpoint Security Client | Property | Value | |----------|-------| | Solution ID | sk171703 | | Date Created | 2021-02-03 | | Last Modified | 2025-10-06 | | Technical Level | General | | Products | Endpoint Security | | Versions | E89.X, E88.X | | OS | Windows, macOS | ## Solution What is a Super-Node? --------------------- A Super Node is a Windows machine running a specially configured Endpoint Security Client that also consists of server-like and proxy-like capabilities. Currently, Super Node serves as an Anti-Malware signature proxy. #### Primary Advantages * Reduces site bandwidth usage. * Reduces server workload. * Reduces customer expense on server equipment. * Scalability. **Notes:** * Super Node is available in both Domain and Workgroup environments. * Super Node is suitable for Offline environments starting version E88.50. Prior to E88.50 Endpoint clients must be Online and connected to the Harmony Endpoint Management server. * Super Node is supported for macOS through a Windows Super Node (preferred), or via a macOS machine for Anti-Malware only. * Super Node is now supported on Endpoint Security Clients for Linux, starting from version 1.24.02. Super Node flows ---------------- Super Node runs a light-weight web-server named Nginx that listens in on port 4434 and responds to requests. When the supported blades (such as Anti-malware) are installed on a Super Node, it: * Downloads signatures from sources defined in the policy. * Creates a local mirror of signatures that is used as a signature source for other Endpoint clients. **Note:** If the Endpoint Security Firewall blade is installed on a Super Node machine, the currently enforced firewall policy is overridden to allow inbound traffic on port 4434. * Starting in version E85.30, Harmony Endpoint Client also attempts to download EPS.msi files using Super Node. Super Node attempts to cache the requested files in the local folder, depending on available free space and cache size configuration. * Starting in E85.40, Harmony Endpoint Client also attempts to download dynamic package zip files, Behavioral Guard signatures and Static Analysis models using Super Node locations. * Starting in E86.10, Harmony Endpoint Client supports downloading policy files using a Super Node location. * Starting in E87.00, Harmony Endpoint Client for macOS can be configured to create local mirror of Anti-Malware signatures which can be used as a signature source for other Endpoint clients for macOS. **Note:** If the client that is configured to use Super Node is older than the above listed version it will download the files from the "fallback" location directly as if Super Node is not configured. If the Client is from a version that supports new file types of downloads, but Super Node endpoint is older, then the Super Node will return 404 responses to the client trying to download file and client will use the "fallback" location as if Super Node is not configured. Non-Super Node flows -------------------- When an Endpoint Security client launches an update, it ?rst checks the "**Client Settings** \> **General** " policy for a "Super Node" list. If such a list is found, a random Super Node is selected for update. If update of the selected node fails, the next entry is taken from the list. Sources de?ned in the Anti-Malware policy are **only** used if all the Super Node options have failed. Starting with E85.30 client uses "Super Node List" global policy when it is available on server in combination with **Client Settings** \> **General** policy to determine if current computer is Super Node or if it should use one of configured "Super Nodes" as a download location for supported file type. **Note:** An update is considered to be successful if the local signatures are newer than the remote signatures. Make sure all Super Nodes are continuously updated. Policy and Software Deployment features in E85.30 and newer Endpoint Security clients require a connection to the Endpoint Manager to process sync requests regarding policy and software deployment changes. How to Configure a Super Node ----------------------------- **For Management Servers supporting "*Manage Super Nodes*" capability (all EPMaaS servers; R81.10 and newer on-premise)** 1. Navigate to **Policy** \> **Client Settings** \> **Manage Super Nodes** . ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk171703/1202111220911021.jpg) 2. Click "+" and search for a device or devices that you want to define as Super Nodes in your environment. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk171703/2202111220911533.jpg) 3. When required devices are added, click "Save". To revert all changes, click "Discard". ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk171703/3202111220912334.jpg)4. Navigate to Client Settings \> Select the required rule \> General tab \> Super Nodes. Super Node settings are rule dependent. It means that Super Nodes defined in the General tab will be applied only to devices which are related to a specific rule. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk171703/4202111220913265.jpg) 5. Click "+" and add Super Nodes with all its specific devices to the relevant Client Settings rule. Save and install the rule. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk171703/5202111220913596.jpg)**For older on-premises servers**, use the following approach. *Please use it ONLY if Web Management doesn't show "Manage Super Nodes" option or Web Management can't be activated (on-premise R80.40 and older).* *For on-premise R81.10 and newer, Jumbo should be installed and Super Node should be configured from Web Management.* Super Nodes are defined by adding a Base64 encrypted Unicode (Little Endian) string into the "Comment" field of the "**Client Settings** \> **General** " policy. A single "Super Node" Endpoint client is defined using two properties: * `fqdn` - mandatory property that should normally contain a full computer name. The name must be resolvable on an Endpoint client performing an update. Usage of IPv4 or IPv6 addresses in `fqdn` requires an additional `epguid` property. **IPv6 addresses must be enclosed in square brackets.** * `epguid` - optional property that is used to uniquely identify an Endpoint client that serves as a Super Node. The value of `epguid` can be taken from the "Endpoint Connectivity" report in SmartEndpoint (navigate to the "Reporting" tab, expand "Activity Reports", select "Endpoint Connectivity", right-click on a column name in the "Endpoint Connectivity" table and select "Show/Hide Columns", and make the "NID" column visible). **Example of a string that defines four Super Nodes** (Note that the first computer is a member of Windows Domain. Consequently, its name includes a domain suffix): `` ` { "SNList":[` ` {"fqdn":"ComputerName.my.organization.com"},` ` {"fqdn":"WorkGroupComputer"},` ` {"fqdn":"192.168.18.10" "epguid":"8471C504-29BB-4E0D-9F4F-B43D706EFAE6"},` ` {"fqdn":"[fe80::2cf6:e79:ab20:64e0]" "epguid":"6B147FA8-29C7-4124-9223-12538389163C"}` ` ]}` `` **In the above example:** The "AdditionalFeatures" xml tag encloses a `json` string, where each row that contains an `fqdn` property corresponds to one Super Node. In order to convert an xml string into a Base64 representation, use a tool that allows you to specify a destination character set . The destination character set must be UCS2-LE or UTF-16LE. Follow this [link](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=112409) to download a simple tool that helps create a "Super Node" policy by adding `fqdn` (and/or `epguid`), one by one. The tool performs Base64 encoding as well. #### Determining whether a Client is a Super Node To check whether an Endpoint Security Client has been configured as a Super Node, open the Windows Task Manager. There should be two instances of the `nginx.exe` process, running as a`cpnginx` user. Starting with E85.30 version you can also use following registry entries: HKLM\\SOFTWARE\\WOW6432Node\\CheckPoint\\Endpoint Security\\Device Agent\\SuperNode - if this REG_DWORD value exists and is set to 1 then current Endpoint is successfully configured as Super Node. HKLM\\SOFTWARE\\WOW6432Node\\CheckPoint\\Endpoint Security\\Device Agent\\SuperNodeLocations - this REG_SZ entry contains list of available Super Node download locations. When this list is empty Client will not use download from Super Node feature. --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content