The DXL broker stops working or is not correctly tagged during installation
기술 문서 ID:
KB88600
마지막으로 수정한 날짜: 8/12/2021
환경
McAfee Active Response (MAR) 2.x
McAfee Data Exchange Layer (DXL) 5.x, 4.x
McAfee Threat Intelligence Exchange (TIE) Server - all supported versions
For details of TIE Server supported environments, see KB83368.
문제
1
You perform a standalone DXL installation. The DXL broker installation completes and is displayed in the ePO Console System Tree. But, it is not tagged as a DXLBROKER.
문제
2
When a TIE installation includes the option to install DXL Broker on the same server, the DXL Broker handshake status never completes, and the installation hangs.
문제
3
After a MAR installation that includes the option to install DXL Broker on the same server, the DXL Broker installation is selected as DONE. The MAR server displays in the ePO System Tree, but the MAR server is not tagged as a DXL broker. Instead, the MAR server is incorrectly tagged as MARSERVER. The MAR server is not displayed in the DXL Fabric, nor listed in DXL Topology.
시스템 변경
You disabled the McAfee Agent policy option: Retrieve all system and product properties (recommended). If unchecked retrieve only a subset of properties.
원인
McAfee Agent is only sending a subset of properties. The McAfee Agent installed on the DXL broker is needed to send custom properties back to the ePO server.
해결책
Edit the McAfee Agent Policy applied to the System Tree group:
Log on to ePO console with an account that can edit policies.
Select System Tree and locate the group where your DXL broker is listed.
Select the Assigned Policies tab.
In the Product drop-down, select McAfee Agent.
Select the General policy option that is configured, for example, My Default.
Enable the following option in Agent Server Communication:
Retrieve all system and product properties (recommended). If unchecked retrieve only a subset of properties.
NOTE:This setting is needed, and must always be kept for managing DXL brokers. Any change in policies could affect other endpoints if the policy is used by other groups. If your default policy is applied to other groups that require different settings, create a policy for McAfee Agent with this option selected. Apply it only to the DXL broker servers.
