Cortex XDR Broker VM questions

cancel
Showing results for 
Search instead for 
Did you mean: 

Cortex XDR Broker VM questions

L3 Networker

Hi All,

 

Can anyone answer a few questions about Cortex XDR Broker VM?

 

If the Broker VM is being used as a proxy, do the hosts connecting to the Broker VM need to be on the same subnet as the Broker VM or can they communicate with the Broker VM via the default gateway of their VLAN?

 

When defining the proxy server on Broker VM, is the address you assign here the IP address of the Broker VM itself?

 

Can someone explain the Internal network of the broker VM? Is this the subnet that the container applets use internally on the VM itself or is this something else?

1 ACCEPTED SOLUTION

Accepted Solutions

L2 Linker

Dear Ben-Price,

 

One of the role of brokerVM is working like HTTP proxy. not necessary to be in same vlan with you XDR agents unless xdr agent located in private vlan.  if a vlan does not have a gateway for routing, yes one of the interface of brokerVM should be in this vlan. 

BrokerVM is not router. its not routing TCP packages of agents. its proxying of HTTP requests. 

 

Proxy server on BrokerVM is for parent proxy. if brokerVM cannot able access internet (due to your infrastructure), you can define parent proxy. in that case, agent will connect BrokerVM and BrokerVM will connect parent proxy. 

 

Internal network configuration is a configuration for avoiding potential conflict with docker network which is located on BrokerVM. By default 172.17.0.1/16 subnet is configured for docker containers. If this network conflicting with your internal network, you can set new docker network with this configuration.

View solution in original post

1 REPLY 1

L2 Linker

Dear Ben-Price,

 

One of the role of brokerVM is working like HTTP proxy. not necessary to be in same vlan with you XDR agents unless xdr agent located in private vlan.  if a vlan does not have a gateway for routing, yes one of the interface of brokerVM should be in this vlan. 

BrokerVM is not router. its not routing TCP packages of agents. its proxying of HTTP requests. 

 

Proxy server on BrokerVM is for parent proxy. if brokerVM cannot able access internet (due to your infrastructure), you can define parent proxy. in that case, agent will connect BrokerVM and BrokerVM will connect parent proxy. 

 

Internal network configuration is a configuration for avoiding potential conflict with docker network which is located on BrokerVM. By default 172.17.0.1/16 subnet is configured for docker containers. If this network conflicting with your internal network, you can set new docker network with this configuration.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!