- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
12-08-2021 02:37 PM
Hi All,
Can anyone answer a few questions about Cortex XDR Broker VM?
If the Broker VM is being used as a proxy, do the hosts connecting to the Broker VM need to be on the same subnet as the Broker VM or can they communicate with the Broker VM via the default gateway of their VLAN?
When defining the proxy server on Broker VM, is the address you assign here the IP address of the Broker VM itself?
Can someone explain the Internal network of the broker VM? Is this the subnet that the container applets use internally on the VM itself or is this something else?
12-09-2021 12:26 AM
Dear Ben-Price,
One of the role of brokerVM is working like HTTP proxy. not necessary to be in same vlan with you XDR agents unless xdr agent located in private vlan. if a vlan does not have a gateway for routing, yes one of the interface of brokerVM should be in this vlan.
BrokerVM is not router. its not routing TCP packages of agents. its proxying of HTTP requests.
Proxy server on BrokerVM is for parent proxy. if brokerVM cannot able access internet (due to your infrastructure), you can define parent proxy. in that case, agent will connect BrokerVM and BrokerVM will connect parent proxy.
Internal network configuration is a configuration for avoiding potential conflict with docker network which is located on BrokerVM. By default 172.17.0.1/16 subnet is configured for docker containers. If this network conflicting with your internal network, you can set new docker network with this configuration.
12-09-2021 12:26 AM
Dear Ben-Price,
One of the role of brokerVM is working like HTTP proxy. not necessary to be in same vlan with you XDR agents unless xdr agent located in private vlan. if a vlan does not have a gateway for routing, yes one of the interface of brokerVM should be in this vlan.
BrokerVM is not router. its not routing TCP packages of agents. its proxying of HTTP requests.
Proxy server on BrokerVM is for parent proxy. if brokerVM cannot able access internet (due to your infrastructure), you can define parent proxy. in that case, agent will connect BrokerVM and BrokerVM will connect parent proxy.
Internal network configuration is a configuration for avoiding potential conflict with docker network which is located on BrokerVM. By default 172.17.0.1/16 subnet is configured for docker containers. If this network conflicting with your internal network, you can set new docker network with this configuration.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!