You are not authorized for this operation in ePO 5.10 Update 10 (ENS Firewall policy edit)

[ezim]

We are experiencing the issue described in KB90725 when trying to update Trellix Endpoint Security  Firewall policies
The issue occurs when trying to add or change "Network" entries from the "Firewall Catalog".

The Trellix ePolicy Orchestrator  Audit entry shows:
"The user security token does not match. The requested URL is /ENDP_FW_META/ENDP_FW_META/showRuleEditor.do and request "referer" field is https://OurServerName:8443/ENDP_FW_META/loadCatalog.do.

We do not have a "maxPostSize" set in the server.xml file.

Has anyone come across this and found a solution?

[cdinet]

Please open a ticket with McAfee for this, I see another similar case in development, so this might need to go to dev.

[arunkumardurai]

Hi,

We have the same issue with our ePO 5.10 and update. Please confirm if anyone have any solution for this.

[cdinet]

Add the maxpostsize value and set it to 4194304, which is 4MB. By default the value is not set which means ePO uses the default of 2MB.

You will need to add it in both the 8443 and 8444 connector sections.

[arunkumardurai]

Thanks a lot, it is resolved after updating this.

[cdinet]

Thanks, please mark as solution what fixed your issue.

[bkdonigan]

Just ran into this issue yesterday. So what exactly am I adding and to where? I saw the connector lines but I'm not exactly sure what to write and between each line

[cdinet]

KB90725 gives an example

1. Example of the section in the server.xml file that causes the problem:

<Connector SSLEnabled="true" URIEncoding="UTF-8" maxPostSize="3096"
            acceptCount="100" 
            id="orion.server.https"
            keystoreFile="keystore/server.keystore"
            keystorePass="n2CNe4768s" maxConnections="500"
            maxHttpHeaderSize="8192" maxKeepAliveRequests="500"
            maxThreads="250" minSpareThreads="25"
            noCompressionUserAgents="gozilla, traviata" port="8443"
            processorCache="500"
            protocol="org.apache.coyote.http11.Http11NioProtocol"
            scheme="https" secure="true" server="Undefined"
            sessionCacheSize="400"
            sslEnabledProtocols="TLSv1.1, TLSv1.2" sslProtocol="TLS"
            truststoreFile="keystore/certAuthCa.truststore"

here is an example from mine, where that parameter doesn't exist

<Connector SSLEnabled="true" URIEncoding="UTF-8" acceptCount="100" ciphers="TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_GCM_SHA384, TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" clientAuth="want" compressableMimeType="text/html,text/xml,text/css,text/javascript,text/json,application/x-javascript,application/javascript,application/json" compression="on" compressionMinSize="2048" disableUploadTimeout="true" enableLookups="false" id="orion.server.https" keystoreFile="keystore/server.keystore" keystorePass="x52Dd7vdaR" maxConnections="500" maxHttpHeaderSize="8192" maxKeepAliveRequests="500" maxSwallowSize="1073741824" maxThreads="250" minSpareThreads="25" noCompressionUserAgents="gozilla, traviata" port="8443" processorCache="500" protocol="org.apache.coyote.http11.Http11NioProtocol" scheme="https" secure="true" server="Undefined" sessionCacheSize="400" sslEnabledProtocols="TLSv1.2" sslProtocol="TLS" truststoreFile="keystore/certAuthCa.truststore" truststorePass="x52Dd7vdaR" truststoreType="jks"/>

You can insert that parameter in each of the connectors if it doesn't exist - for example:

maxConnections="500" maxHttpHeaderSize="8192" maxKeepAliveRequests="500" maxSwallowSize="1073741824" maxThreads="250" minSpareThreads="25" maxPostSize="4096"

[kosmerm]

I have another similar issue .I have logged in with the account that created this rule set.  In Data Loss Prevention 11.6 --> DLP Policy --> MyPolicy , i press Edit and when i find my rule in active rule sets and click it , it gives me the error You are not authorized for this operation  , i added the maxPostSize="4096" but it didnt work. Can you propose a different solution? Or am i doing something wrong ?

[cdinet]

Yes, add a max post size value large enough to cover the firewall size.  You can export the policy to see how large it is.