The DXL broker stops working or is not correctly tagged during installation

Technical Articles ID: KB88600
Last Modified: 8/12/2021

Environment

McAfee Active Response (MAR) 2.x
McAfee Data Exchange Layer (DXL) 5.x, 4.x
McAfee Threat Intelligence Exchange (TIE) Server - all supported versions

For details of TIE Server supported environments, see KB83368.

Problem 1

You perform a standalone DXL installation. The DXL broker installation completes and is displayed in the ePO Console System Tree. But, it is not tagged as a DXLBROKER.

Problem 2

When a TIE installation includes the option to install DXL Broker on the same server, the DXL Broker handshake status never completes, and the installation hangs.

Problem 3

After a MAR installation that includes the option to install DXL Broker on the same server, the DXL Broker installation is selected as DONE. The MAR server displays in the ePO System Tree, but the MAR server is not tagged as a DXL broker. Instead, the MAR server is incorrectly tagged as MARSERVER. The MAR server is not displayed in the DXL Fabric, nor listed in DXL Topology.

System Change

You disabled the McAfee Agent policy option: Retrieve all system and product properties (recommended). If unchecked retrieve only a subset of properties.

Cause

McAfee Agent is only sending a subset of properties. The McAfee Agent installed on the DXL broker is needed to send custom properties back to the ePO server.

Solution

Edit the McAfee Agent Policy applied to the System Tree group:

Log on to ePO console with an account that can edit policies.
Select System Tree and locate the group where your DXL broker is listed.
Select the Assigned Policies tab.
In the Product drop-down, select McAfee Agent.
Select the General policy option that is configured, for example, My Default.
Enable the following option in Agent Server Communication:

Retrieve all system and product properties (recommended). If unchecked retrieve only a subset of properties.

NOTE: This setting is needed, and must always be kept for managing DXL brokers. Any change in policies could affect other endpoints if the policy is used by other groups. If your default policy is applied to other groups that require different settings, create a policy for McAfee Agent with this option selected. Apply it only to the DXL broker servers.

Affected Products

Configuration
Data Exchange Layer 6.x
Data Exchange Layer 5.x
Install/Uninstall
Known Issue/Product Defect
McAfee Active Response 2.x
Threat Intelligence Exchange Server 2.3.x
Threat Intelligence Exchange Server 2.2.x
Troubleshooting

Languages:

This article is available in the following languages:

German
English United States
Spanish Spain
French
Italian
Japanese
Korean
Dutch
Portuguese Brasileiro
Chinese Simplified
Chinese Traditional

Knowledge Center

The DXL broker stops working or is not correctly tagged during installation

Environment

Problem 1

Problem 2

Problem 3

System Change

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

The DXL broker stops working or is not correctly tagged during installation

Environment

Problem 1

Problem 2

Problem 3

System Change

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title