topic problem with VMware vcenter integration R81.10 in Firewall and Security Management

problem with VMware vcenter integration R81.10

Wolfgang — Fri, 26 Nov 2021 19:59:02 GMT

Hello CheckMates,

we are using VMware vcenter integration with R80.30. Meaning virtual server objects from VMware vcenter server are used in the rulebase as source or destination.

After upgrade to R81.10 policy verification fails

Any changes with R81.10 and VMware vcenter integration ?

Re: problem with VMware vcenter integration R81.10

the_rock — Fri, 26 Nov 2021 20:33:37 GMT

Would you mind post a screenshot of the object (just blur out the IP)? I want to try it in my R81.10 lab.

Andy

Re: problem with VMware vcenter integration R81.10

Wolfgang — Fri, 26 Nov 2021 20:43:50 GMT

You can see a part of the rule on the top of my screenshot with the object as destination. The object will be imported from the defined datacenter object. You‘ll need a VMware vcenter for replication.

Switching back to R80.30 or R80.40 let us run the policy verification without problems.

Re: problem with VMware vcenter integration R81.10

the_rock — Fri, 26 Nov 2021 22:36:33 GMT

Definitely seems like an issue, I got exact same thing. Maybe someone from CP will respond and confirm this.

Re: problem with VMware vcenter integration R81.10

Wolfgang — Sat, 27 Nov 2021 19:04:50 GMT

Very strange…….

Policy install is possible and everything is working fine, only policy verification fails. This should be fixed.

Re: problem with VMware vcenter integration R81.10

the_rock — Sat, 27 Nov 2021 19:15:03 GMT

Yes, correct! I forgot to mention yesterday that policy did work for me as well. I even rebooted both mgmt/fw, but same behavior.

Re: problem with VMware vcenter integration R81.10

Lori_Spoznik — Sun, 28 Nov 2021 20:47:41 GMT

Hi @Wolfgang

This is a known issue and will be fixed in the next R81.10 JHF, you can follow this sk175186

As you mentioned this issue is related just to policy verification and install policy succeeded.

Thanks,

Lori Spoznik

QA TL, CloudGuard IaaS

Re: problem with VMware vcenter integration R81.10

M_Ruszkowski — Mon, 21 Nov 2022 19:43:38 GMT

Not all limitations are fixed. We are using mplane separation feature and this broke vcenter integration.

Re: problem with VMware vcenter integration R81.10

Gil_Sudai — Tue, 22 Nov 2022 09:24:26 GMT

We added support for mdps feature in the CloudGuard Controller starting with R81.10 jumbo take 79 (need to be installed on the management server). Is that what you are referring here to?

Re: problem with VMware vcenter integration R81.10

M_Ruszkowski — Wed, 23 Nov 2022 15:02:33 GMT

That fix only resolves one issue. It detects if you are running mplane and pushed the file that contains the datacenter objects to /etc/fw/tmp. The issue is still that CPRID runs on mplane and there is a disconnect between the file and PDP. If i move CPRID to dplane then I break CDT. Also the CPRID process doesnt understand that the cluster object IP is defined in the dplane.