- CheckMates
- :
- Products
- :
- CloudMates Products
- :
- Cloud Network Security
- :
- Discussion
- :
- Re: Data Center Object Enforcement in Azure
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Data Center Object Enforcement in Azure
Hi forum!
My management server has been integrated with azure (I set up the data centre server).
I can read all the objects in Azure. (I'm running R80.10 gateway and mgt)
I have set up Identity Awareness too.
My gateways are not enforcing the rules I have created with datacentre objects!
Everything looks perfect on the management server, I can even see the IP addresses dynamically associated with the tags!!
I need some help figuring out why the gateways are not enforcing the rules.
I have looked all over for this - and I have a case raised, but TAC have gone a bit quiet!
Anyone help me with locating the documentation for this? I have looked everywhere.
When I do a "pep show user all" (not sure if this shows output on azure integration) i get nothing on the gateway - whcih makes sense.
Are there any logfiles? I have checked /var/log/messages - nothing!
Thanks!
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think: TAC will know better
GW side:
"$FWDIR/log/azure_had.elg*" log files.
"$FWDIR/conf/azure-ha.json" log file.
"$FWDIR/log/cloud_proxy.elg" log file.
+
How to troubleshoot Updatable Objects in R80.20 (and higher)
Azure portal reports read and/or write limits, throttling API resources
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'll post up root cause and corrective action when I am done - share the wealth - I suspect it's something I have overlooked!!
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- configured datacentre object (azure intergration)
- entered dynamically learned objects into fw policy
- console told me to configure identity awareness
- configured as terminal based, do AD later
- no enforcement occuring - but updates being learned by console
- Added a host_localhost (127.0.0.1) object
- Went to cluster config > identity awareness > ticket Identity web api
- Dropped host_localhost object into authorized client
- BOOOM!
Dynamic enforcement enabled!!!!
So I missed out the bold bits HTH anyone who has the same issue as me
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
validate with pep show user all
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Data Center objects works also with on-prem GW.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Top response ofirsea040d26-f1f2-3b12-9fc6-5c89debaf56c! I was thinking about getting R80.20 and just blowing away my cirrent install.
Thanks again mate - much appreciated
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
I have problems with that data center objetcs on an VMSS gateway in Azure.
I have enabled the Identity Awareness blade with the autoprov CLI feature. The VMSS gateway has an active Identity Awareness blade, the Remote Web API is checked, and one autogenerated host with IP 127.0.0.1 is added.
I have added the data center object for Azure, and everything is fine, I can seach all objects in my Azure inventory.
But when I would like to install the policy with one virtual machine from that Azure inventory, I receive an error.
If you have any good advise, because I'm normally familar with that data center objects for on-prem vCenter environments. In my opinion, it should the nearly "the same" for Azure objects...
Management and VMSS gateway is running on R80.20.
Best Regards,
Carsten
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Carsten,
Dont panic! All thats happened it is you must have combined regular objects, and objects learned from Azure in the same source field in the rule
Easiest thing I expect is to duplicate the rule, and in one rule leave the normal objects, and in the other rule put the objects in that are learned from azure
HTH
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Upps, life can be so easy when you only read the error message 🙂
You're right Nicholas, that was the problem, it is working now - thanks a lot!
![](/skins/images/BFDD56B372A07FDFABDEF003EE622D96/responsive_peak/images/icon_anonymous_message.png)