Access TIE/DXL via Internet

[iverbuyst]

Hello,

We have 2 TIE/DXL servers, which are both member of a DXL-Hub, on our local network and are currently installing ATP on a select number of computers for testing.

Because of Corona a large number of our employees are working from home. They can use VPN to connect to the office but this is not always needed to perform there jobs.

We've noticed that when the client is not connected using VPN, but has a connection to the Internet, and then an application is launched this is not visible in the ePO - TIE - Files Used on System page, even after establishing a VPN connection en pushing all event to ePO. We think that this is the result of no connection to our local DXLs.  

What is the best practice to enable remote clients to use TIE/DXL via the Internet? Agent Handler & DXL Broker in our DMZ or will assigning a public address to our DXL-Hub be enough?

Regards,

Ivan

[aguevara]

i think this one will be better answer by my colleagues from the ATP/ENS team as the question is how to deal with a file when TIE is not available.

im moving this post to that group

[iverbuyst]

@aguevara 

No the question is not how to deal with a file when TIE is not available, the question is what is the best practice to enable remote users that are not connected to the network, connect to our local TIE server?

[aguevara · Accepted solution]

Understood, then what i can suggest is to place a DXL broker on a dmz with a public IP so that you can manage those machines while they are not connected to the internal network: 

https://kc.mcafee.com/corporate/index?page=content&id=KB92610

It is possible to configure an externally available Data Exchange Layer (DXL) broker to facilitate wake-ups in this scenario. Both an externally available DXL broker and a remote Agent Handler must be present and configured. This feature is described and diagrammed in the DXL 5.0 and later product guides.

Here we walk about wake ups but all functionalities will be available, including DXL/TIE subscriptions and reputations

[yaz]

HI @iverbuyst 

Thanks for reaching out to McAfee Community.

If the TIE server is present, Adaptive Threat Protection uses the Data Exchange Layer framework to share file and threat information instantly across the whole enterprise. You can see the specific system where a threat was first detected and where it went from there, and stop it immediately.

Adaptive Threat Protection with the TIE server enables you to control file reputation at a local level, in your environment. You decide which files can run and which are blocked, and the Data Exchange Layer shares the information immediately throughout your environment.

Adaptive Threat Protection and the server communicate file reputation information. The Data Exchange Layer framework immediately passes that information to managed endpoints. It also shares information with other McAfee products that access the Data Exchange Layer, such as McAfee® Enterprise Security Manager (McAfee ESM) and McAfee® Network Security Platform.

If the TIE server and Data Exchange Layer are not present, Adaptive Threat Protection communicates with McAfee GTI for file reputation information.

If the TIE server isn't present and the system isn't connected to the Internet, Adaptive Threat Protection determines the file reputation using information about the local system.

I strongly suggest you can open an SR with us and we can understand the requirements and assist accordingly. 

Was my reply helpful?

If yes, please give me a Kudo. 

If I have answered your query, kindly mark this as solution and we together can help other community members. 

[iverbuyst]

@yaz 

We want our remote users, who not always use a VPN connection to connect to the office network, to be able to use DXL over the internet to connect to our local TIE servers.

What is the best practice to do this?

We've seen articles about setting up a DXL Broker in the DMZ to enable DXL connectie via the Internet and also some articles that assigning a public IP address to a DXL-hub also should work.

If we assign a public IP address to our DXL hub wil this IP always be used for client connected to the office and Internet or is the DXL client intelligent enough to first try one and if it fails to try the other?

Regards,

Ivan