cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

How to bridge two DXL fabrics (ePO 5.9.0 with DXL 3.1 - ePO 5.9.1 with DXL 4.0)

We set up a second ePO server to test new ePO version and new product versions. We still wanted to use our existing TIE and ATD.

Our first ePO server (ePO1 version 5.9.0) uses DXL 3.1 - the new one (ePO2 version 5.9.1) uses 4.0.

We built a DXL bridge - outgoing from ePO2 and incoming to ePO1. After a while all DXL broker at ePO1 were in state 'unknown'. We searched a lot of time for the reason. The log file of the DXL broker to which ePO1 was connected gived the final hint. ePO and all DXL broker (version 3.1)  were not authorized to send/receive some messages.

DXL 4.0 introduced some new DXL topics and topic groups which DXL 3.1 (ePO1) did not understand.

We had a look at ePO2 and its DXL topic groups and we decided to manually add custom topic groups at ePO1 (server settings -> DXL. Topic Authorization -> Edit -> Actions -> Add topic group). Here is the list of all custom topic groups:

DXL fabric infratruccture (send: ePO, DXLBROKER / receive: ePO, DXLBROKER)

/mcafee/event/dxl/clientregistry/disconnect
/mcafee/event/dxl/clientregistry/connect
/mcafee/service/dxl/brokerregistry/topicquery
/mcafee/service/dxl/broker/health
/mcafee/event/dxl/ipe/token/request
/mcafee/event/dxl/brokerregistry/topicadded
/mcafee/event/dxl/ipe/policy
/mcafee/service/dxl/clientregistry/query
/mcafee/event/dxl/ipe/health/trigger
/mcafee/event/dxl/fabricchange
/mcafee/event/dxl/brokerregistry/topicremoved
/mcafee/event/dxl/brokerregistry/brokerstatetopics
/mcafee/event/dxl/ipe/token
/mcafee/event/dxl/ipe/health
/mcafee/service/dxl/ipe/madecrypt
/mcafee/event/dxl/brokerregistry/brokerstate
/mcafee/event/dxl/revocation/list

 

event request for ePO token (send: DXLBROKER / receive: ePO)

/mcafee/event/dxl/ipe/tokens/request

 

event response for ePO token (send: ePO / receive: DXLBROKER)

/mcafee/event/dxl/ipe/tokens/response

 

automatic reactions for threat events (send: ePO / receive: all)

/mcafee/event/epo/threat/response

 

Perhaps the easier way is to install the DXL 4.0 extensions at ePO1.

After that all DXL broker at ePO1 were online and healthy. So we could install a secondary TIE at ePO2.

More McAfee Tools to Help You

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community