Agent deployment and SO firewall > hostgroups > analyst - bug?

[chris1284]

Hi,

today i started my SO journey. After install i tried long time to deploy a elastic fleet windows agent.
The SO management web was reachable to all time with the 192.168.0.0/16 firewall > hostgroups > analyst rule but no way to get the agent connected. the https://192.168.2.162:8220 website was reachable.
I had to add the 192.168.2.0/24 explicit to get an agent connected. is this a bug? 192.168.0.0/16 should cover all 192.168.0.1 to 192.168.255.254 addresses.

thx

[reyesj2]

How soon after you made the configuration change did you test connectivity?

[chris1284]

The 192.168.0.0/16 was set while setup. i explored SO a while and started than with the agent deployment. i think time between setup and agent deploy 1 hour. the change /setting 192.168.2.0/24 as an additional rule has worked immediately and the agent was directly able to connect.

I had to reinstall SO because after test i switched the disk to a larger one and with the new installed instance i have seen the same behavior. other network i have configured like 10.0.0.0/16 has to be 10.0.9.0/24 and 10.0.8.0/24 to work

[dougburks]

When Setup asks if you want to allow traffic through the firewall, that is for the analyst hostgroup which allows you to connect to the web interface on port 443. Setup does not automatically allow Elastic Agents to connect and send data. If you want to connect an Elastic Agent, you would need to manually specify that in the elastic_agent_endpoint hostgroup. Does that explain what you're seeing?

[chris1284]

yes, i think this is the solution. i had set the ips in the elastic_agent_endpoint hostgroup after that question and figured out that i need "--insecure" parameter for agent install on linux because of the self signed certificate