Cloud Detector enrolled in Enforce has incorrect region

Products

• Data Loss Prevention Cloud Service for Email
• Data Loss Prevention Cloud Detection Service
• Data Loss Prevention Cloud Package

Issue/Introduction

The customer is attempting to enroll 2 or more Cloud Detection Servers (aka "Detectors"), and at least one of them was provisioned for a different region (US vs EU).

Although the first enrollment will be successful, and show as Connected, when the second Detector is added it does not appear to complete, and the first Detector goes into a "Disconnected" state.

"The bundle refers to a Gateway different than the one that has already been configured."

Environment

Enforce, and bundles for 2 or more Cloud Detection Servers

Cause

Enforce can only register Cloud Detection Servers from one global region, e.g., US or EU.

The error occurs when a second enrollment for a second region is attempted, and Enforce is thereafter denied access to connect to any Detectors via the Cloud Service Gateway.

If this has happened, it will be necessary to confirm which region is required - US or EU, and to re-provision whichever Detector(s) were incorrectly provisioned (requires ticket with Cloud Operations team). A new bundle will also be required for any Detectors which were previously enrolled and connected (i.e., re-enrollment to force association with the correct region).

 

Resolution

Outline of steps to follow

1. Firstly, if the bundle enrollment errs out, and doesn't actually complete (so the new CDS doesn't appear in the list of Servers and Detectors) - you are in luck. The fix is really easy! Don't add the new Detector, confirm that all Detectors for the Enforce Server have the same regions as per "Cause" section of this KB.
2. If however the bundle appears to have completed, but now all CDS show as Disconnected (or unknown), you most likely have to redo all existing Detectors with new bundles. This step will require opening a case with Broadcom Support.