topic Re: Identity Sharing with MDPS enabled + Maestro in Hyperscale Firewall (Maestro)

Identity Sharing with MDPS enabled + Maestro

bibinpaul — Mon, 30 May 2022 10:51:02 GMT

Hi All,

Good day!!

In one of my recent deployment, I have enabled MDPS on Maestro SG, which is running on R80.30SP, JHF take 97.

Identity sharing stopped working after enabling the MDPS. Maestro SG is PEP.

From the PDP and PEP logs, the connection initiated to mplane is getting disconnected.

Any one has has observed this kind of behavior with Maestro when MDPS enabled??

Thanks and Regards

Bibin

Re: Identity Sharing with MDPS enabled + Maestro

G_W_Albrecht — Mon, 30 May 2022 13:49:22 GMT

sk138672 Management Data Plane Separation: Do not configure non-Management operations on the Management plane network. Examples of non-Management operations: DNS, Proxy, DHCP, and Software Blade portals.

I would assume that IA Identity Sharing is a non-Management operation...

Re: Identity Sharing with MDPS enabled + Maestro

bibinpaul — Mon, 30 May 2022 21:56:37 GMT

Thanks Albrecht,

I could see the dplane and mplane interfaces of Maestro SG from the PDP gateway. Somehow it does automatically.

The maestro SG will be identified at management server through the mplane interface and hence when we configure identity sharing, while selecting the gateway it list the Firewall/SG object identified using the mplane interface IP.

Is there anyway we could configure the identity sharing connecting to dplane and not tp mplane?. One way I could think about is by adding the SG to management server by using the dplane interface, which defeats the purpose of MDPS.

[Expert@gw0011:0]# pdp connections pep

----------------------------------------------------------------------------------------------------------------

----------------------------------------------------------------------------------------------------------------

----------------------------------------------------------------------------------------------------------------

----------------------------------------------------------------------------------------------------------------

----------------------------------------------------------------------------------------------------------------

----------------------------------------------------------------------------------------------------------------

Bibin

Re: Identity Sharing with MDPS enabled + Maestro

Christian_Koehl — Tue, 31 May 2022 06:54:29 GMT

Dear Bibin,

try to change the "ia_control_connections_ip" via GuiDBedit of your firewall module.

Hth and best regards,

Christian

Re: Identity Sharing with MDPS enabled + Maestro

bibinpaul — Wed, 01 Jun 2022 08:36:40 GMT

Thanks Christian,

I will try and update you soon 🙂

Re: Identity Sharing with MDPS enabled + Maestro

Peter_Elmer — Tue, 21 Jun 2022 16:40:36 GMT

Hello @binu ,

there is sk175587 documenting guidelines for how to integrate Maestro in an ID Sharing environment. This sk was created in close collaboration with IDA R&D and Maestro R&D. You can find it linked from Maestro Admin guide here.

The introduction of this sk explains packet processing of inbound connections that may help even for this scenario.

best regards

pelmer

Re: Identity Sharing with MDPS enabled + Maestro

bibinpaul — Wed, 22 Jun 2022 00:15:36 GMT

Thanks Peter,

I have managed to resolve the issue by creating an MDPS task for 15105 and 28581. :). Its now working