Cortex XDR Broker VM questions

[Ben-Price]

Hi All,

Can anyone answer a few questions about Cortex XDR Broker VM?

If the Broker VM is being used as a proxy, do the hosts connecting to the Broker VM need to be on the same subnet as the Broker VM or can they communicate with the Broker VM via the default gateway of their VLAN?

When defining the proxy server on Broker VM, is the address you assign here the IP address of the Broker VM itself?

Can someone explain the Internal network of the broker VM? Is this the subnet that the container applets use internally on the VM itself or is this something else?

[etugriceri · Accepted solution]

Dear Ben-Price,

One of the role of brokerVM is working like HTTP proxy. not necessary to be in same vlan with you XDR agents unless xdr agent located in private vlan.  if a vlan does not have a gateway for routing, yes one of the interface of brokerVM should be in this vlan. 

BrokerVM is not router. its not routing TCP packages of agents. its proxying of HTTP requests. 

Proxy server on BrokerVM is for parent proxy. if brokerVM cannot able access internet (due to your infrastructure), you can define parent proxy. in that case, agent will connect BrokerVM and BrokerVM will connect parent proxy. 

Internal network configuration is a configuration for avoiding potential conflict with docker network which is located on BrokerVM. By default 172.17.0.1/16 subnet is configured for docker containers. If this network conflicting with your internal network, you can set new docker network with this configuration.