Q&A - Web Protection Suite and Web Gateway Cloud Service migration

[awasilen]

Hello,

In ref. to SNS https://kcm.trellix.com/corporate/index?page=content&id=SNS3681 - we sent about ongoing Web Protection Suite and Web Gateway Cloud Service migration - Skyhigh Security will host Q&A sessions to answer your questions about migration.

Customers will receive invite details on Thursday Oct. 13. via mail.

We want to use this forum to collect questions or feedback we should address in our Q/A sessions. 

Simply reply to this post with your question or feedback.

Thanks for participation!

Customer Success Group

Skyhigh Security

[chirasmita]

Hi Team,

The customer's WPS entitlement has already expired earlier this year (1st May 2022) and they currently don’t have any active WPS entitlements. They are all on UCE now. So please confirm if WPS to WPS 2 migration is relevant for the customer.

[Anthony1]

I had this same question and submitted a ticket to support about it. If clients are using UCE (so you are accessing the CASB from the new authuimcafee domain) then this migration DOES NOT apply to you. I hope that helps. 

[jebeling]

Migration not required if they are already actively using UCE

[XavierOrozco]

We use an MWG virtual appliance to sync the rules with the MWGCS. With this migration, is this virtual appliance still needed to sync the rules?

Thanks

[smasnizk]

Generally speaking - yes. We do not make any difference if you are running Virtual or Hardware appliance . As long you are using our Cloud Service and want to apply your local policies make sure your Customer ID is migrated and Synch is working. If you can rebuild all rules with our Cloud UI you could consider to switch.

[smasnizk]

Q: We use onPrem McAfee ePO and it does not synch cloud. But we also have Web Gateway onPrem and it dose have a web hybrid policy synch. Do I have to take action and what is relevant? 

A: Yes, you will have to follow steps shown as "Hybrid"-Setup. 

for reference please follow guide on this link:

Migrate_WGCS_to_SWG/Migrate_from_WPS_to_WPS2_(ePO_Managed_MCP_Agent_and_Policy) 

---------------------------------------------------------------------------------------------------------------------

Q:  Which steps do I have to follow if I'm "Cloud only" and which for "Hybrid-Mode"?

A1: for Cloud only: Migrate_from_SWE_to_SWG_Cloud_(ePO_Cloud_Managed_MCP_Agent_and_Policy)

A2: for Hybrid Mode: Migrate_WGCS_to_SWG/Migrate_from_WPS_to_WPS2_(ePO_Managed_MCP_Agent_and_Policy) 

---------------------------------------------------------------------------------------------------------------------

Q: Why is there a infrastructure difference between "hybrid.skyhigh.cloud" and "wgcs.skyhigh.cloud"?

A: "c(Customer ID).hybrid.skyhigh.cloud will direct traffic directly to a hybrid proxy which will process the hybrid policy uploaded from the on-prem appliance." You might not have recognized any difference in first place cause you have possibly enabled "hybrid policy routing" in your "Web Policy". This would lead to internal redirection to your SWG synchronized policy.

Ref: Configure_New_Proxy_Name

---------------------------------------------------------------------------------------------------------------------

Q: Are different PoPs used for SSE (UCE) and WGCS (Hybrid) traffic?

A: different PoP - No, but you can expect different egress IP addresses. UCE and WGCS use different policy "language" which allow you to write rules in "Code View". Technically those are different products.

---------------------------------------------------------------------------------------------------------------------

Q: In hybrid mode, after onPrem is synched with Skyhigh domain, will clients that are still pointing to *.saasprotection.com via SCP loose access to *.saasprotection.com Proxy? Or have access but miss further policy updates?

A: No connection will be lost. Customer ID and Admin Account for cloud synch remains the same after migration. The only issue that would be expected is that this service wont work after 31th of Dec. 

---------------------------------------------------------------------------------------------------------------------

Q: I can sigh into Auth.ui.mcafee.com but when I select "Skyhigh Security Cloud" card it takes me to setup notification page, nothing else.

A: This symptom is common for expired trial accounts. No trial account will be migrated. If you need help to identify active account please contact support.

[mgarten]

Hello,

we also sync our MWG policy from the OnPrem MWG into the SkyHighCloud for Hybrid usage.

We already did migrate everything but on question is open.

On the OnPrem config for the sync we use the URL

 

I didn't find any information regarding this settings. Do we need to change this URL and if yes, when must this be done?

Bye

Mathias

[smasnizk]

Good Morning @mgarten,

you're right this URL will become obsolete on 31.Dec this year as well. Please change it to https://policysync.skyhigh.cloud:443. 

The Backend remains the same the only change for you is the FQDN.

[mgarten]

Hello,
can we do this FQDN change already now?
Bye
Mathias