cancel
Showing results for 
Search instead for 
Did you mean: 
Create a Post

Data Center Object Enforcement in Azure

Hi forum!

My management server has been integrated with azure (I set up the data centre server). 

I can read all the objects in Azure.  (I'm running R80.10 gateway and mgt)

I have set up Identity Awareness too.

My gateways are not enforcing the rules I have created with datacentre objects! Smiley Sad

Everything looks perfect on the management server, I can even see the IP addresses dynamically associated with the tags!!

I need some help figuring out why the gateways are not enforcing the rules.

I have looked all over for this - and I have a case raised, but TAC have gone a bit quiet!

Anyone help me with locating the documentation for this?  I have looked everywhere.

When I do a "pep show user all" (not sure if this shows output on azure integration) i get nothing on the gateway - whcih makes sense. 

Are there any logfiles?  I have checked /var/log/messages - nothing!

Thanks! Smiley Happy

10 Replies
Employee+
Employee+

Re: Data Center Object Enforcement in Azure

I think: TAC will know better

How to debug issues related to Security Groups / Data Center objects not being enforced by vSEC Gate... 

GW side:

"$FWDIR/log/azure_had.elg*" log files. 
"$FWDIR/conf/azure-ha.json" log file. 
"$FWDIR/log/cloud_proxy.elg" log file. 

+

How to troubleshoot Updatable Objects in R80.20 (and higher) 

Azure portal reports read and/or write limits, throttling API resources 

Re: Data Center Object Enforcement in Azure

I'll post up root cause and corrective action when I am done - share the wealth - I suspect it's something I have overlooked!!

Re: Data Center Object Enforcement in Azure

  1. configured datacentre object (azure intergration)
  2. entered dynamically learned objects into fw policy
  3. console told me to configure identity awareness
  4. configured as terminal based, do AD later
  5. no enforcement occuring - but updates being learned by console
  6. Added a host_localhost (127.0.0.1) object 
  7. Went to cluster config > identity awareness > ticket Identity web api
  8. Dropped host_localhost object into authorized client
  9. BOOOM!

Dynamic enforcement enabled!!!!

So I missed out the bold bits Smiley Happy  HTH anyone who has the same issue as me 

Re: Data Center Object Enforcement in Azure

validate with pep show user all

Senaka
Ivory

Re: Data Center Object Enforcement in Azure

I would like to know if Azure Data Center objects only work with vSec gateways or does it also work with 15400 (r80.30) on-prem security gateways?
0 Kudos
Employee
Employee

Re: Data Center Object Enforcement in Azure

Data Center objects works also with on-prem GW.

0 Kudos
Highlighted

Re: Data Center Object Enforcement in Azure

Top response ofirsea040d26-f1f2-3b12-9fc6-5c89debaf56c!  I was thinking about getting R80.20 and just blowing away my cirrent install.

Thanks again mate - much appreciated Smiley Happy 

Carsten_R
Nickel

Re: Data Center Object Enforcement in Azure

Hello,

I have problems with that data center objetcs on an VMSS gateway in Azure.

I have enabled the Identity Awareness blade with the autoprov CLI feature. The VMSS gateway has an active Identity Awareness blade, the Remote Web API is checked, and one autogenerated host with IP 127.0.0.1 is added.

I have added the data center object for Azure, and everything is fine, I can seach all objects in my Azure inventory.

But when I would like to install the policy with one virtual machine from that Azure inventory, I receive an error.

Policy install error

If you have any good advise, because I'm normally familar with that data center objects for on-prem vCenter environments. In my opinion, it should the nearly "the same" for Azure objects...

Management and VMSS gateway is running on R80.20.

Best Regards,

Carsten

0 Kudos

Re: Data Center Object Enforcement in Azure

Hi Carsten,

Dont panic! Smiley Happy  All thats happened it is you must have combined regular objects, and objects learned from Azure in the same source field in the rule

Easiest thing I expect is to duplicate the rule, and in one rule leave the normal objects, and in the other rule put the objects in that are learned from azure

HTH

0 Kudos
Carsten_R
Nickel

Re: Data Center Object Enforcement in Azure

Upps, life can be so easy when you only read the error message 🙂

You're right Nicholas, that was the problem, it is working now - thanks a lot!

0 Kudos