Very weird both servers are in same subnet, same switch.
Both are reachable from WAN IP.
Mobile devices can contact with MDM and ERA shows:
GlaxyS10 Updated 2020 Jul 23 15:04:52 0 0 ESET Endpoint Security 2.7.17.0
Update time is correct but I known that phone using 2.8.12.0 not 2.7.17.0
I did not find any blocked traffic on firewall, all rules for ESET are clearly pass.
From ESET expert perspective: I should only change both servers IPs and reconfigure agents on servers?