How to bridge two DXL fabrics (ePO 5.9.0 with DXL 3.1 - ePO 5.9.1 with DXL 4.0)

[lespuck]

We set up a second ePO server to test new ePO version and new product versions. We still wanted to use our existing TIE and ATD.

Our first ePO server (ePO1 version 5.9.0) uses DXL 3.1 - the new one (ePO2 version 5.9.1) uses 4.0.

We built a DXL bridge - outgoing from ePO2 and incoming to ePO1. After a while all DXL broker at ePO1 were in state 'unknown'. We searched a lot of time for the reason. The log file of the DXL broker to which ePO1 was connected gived the final hint. ePO and all DXL broker (version 3.1)  were not authorized to send/receive some messages.

DXL 4.0 introduced some new DXL topics and topic groups which DXL 3.1 (ePO1) did not understand.

We had a look at ePO2 and its DXL topic groups and we decided to manually add custom topic groups at ePO1 (server settings -> DXL. Topic Authorization -> Edit -> Actions -> Add topic group). Here is the list of all custom topic groups:

DXL fabric infratruccture (send: ePO, DXLBROKER / receive: ePO, DXLBROKER)

/mcafee/event/dxl/clientregistry/disconnect
/mcafee/event/dxl/clientregistry/connect
/mcafee/service/dxl/brokerregistry/topicquery
/mcafee/service/dxl/broker/health
/mcafee/event/dxl/ipe/token/request
/mcafee/event/dxl/brokerregistry/topicadded
/mcafee/event/dxl/ipe/policy
/mcafee/service/dxl/clientregistry/query
/mcafee/event/dxl/ipe/health/trigger
/mcafee/event/dxl/fabricchange
/mcafee/event/dxl/brokerregistry/topicremoved
/mcafee/event/dxl/brokerregistry/brokerstatetopics
/mcafee/event/dxl/ipe/token
/mcafee/event/dxl/ipe/health
/mcafee/service/dxl/ipe/madecrypt
/mcafee/event/dxl/brokerregistry/brokerstate
/mcafee/event/dxl/revocation/list

event request for ePO token (send: DXLBROKER / receive: ePO)

/mcafee/event/dxl/ipe/tokens/request

event response for ePO token (send: ePO / receive: DXLBROKER)

/mcafee/event/dxl/ipe/tokens/response

automatic reactions for threat events (send: ePO / receive: all)

/mcafee/event/epo/threat/response

Perhaps the easier way is to install the DXL 4.0 extensions at ePO1.

After that all DXL broker at ePO1 were online and healthy. So we could install a secondary TIE at ePO2.