topic Re: Datacenter objects doesn't appear in policy search? in Firewall and Security Management

Datacenter objects doesn't appear in policy search?

abihsot__ — Fri, 14 Jul 2023 15:27:05 GMT

Hi there,

We do use few datacenter objects (from AWS) in the policy and I noticed that policy search function when using something like "src:IP " ignores the rules with them. If you search by datacenter object "name", it would display it.

If you hover your mouse on datacenter object there is IP or network displayed, so my assumption was that policy search function would read these fields too.

We have only few such objects in the policy, but if some companies would use it more heavily you are screwed. How you deal with this issue? Any tips and tricks?

management is R81.10

Re: Datacenter objects doesn't appear in policy search?

the_rock — Fri, 14 Jul 2023 17:43:03 GMT

Im fairly sure thats by default. I also tested in R81.20, same thing.

Andy

Re: Datacenter objects doesn't appear in policy search?

PhoneBoy — Fri, 14 Jul 2023 22:42:48 GMT

I suspect this is by design since the management doesn’t know the content of the datacenter object (only the gateways do).

Re: Datacenter objects doesn't appear in policy search?

abihsot__ — Mon, 17 Jul 2023 06:33:20 GMT

Interesting, however in the console when you view details of the object, IP is visible. So there must be a way this information is passed to management server (note field).

My concern is that policy management would become extremely difficult with datacenter objects. I hope this gets visibility. In my opinion it is serious limitation.

Re: Datacenter objects doesn't appear in policy search?

the_rock — Mon, 17 Jul 2023 14:22:53 GMT

Im with you there, definitely a big limitation.

Andy

Re: Datacenter objects doesn't appear in policy search?

PhoneBoy — Tue, 18 Jul 2023 20:29:05 GMT

SmartConsole is able to provide the current list of IPs in the Generic Datacenter object based on CloudGuard Controller (which runs on the management).
This information is not currently integrated into SmartView.
Possible this limitation doesn't exist in R81.20 with Network Feeds (which is, FYI, the recommended approach going forward).