vDefend / Avi Alarm: VTICS/VTIS Service is unreachable

Products

• VMware vDefend Firewall
• VMware vDefend Firewall with Advanced Threat Prevention
• VMware Avi Load Balancer

Issue/Introduction

Problem: Service reputation-service is degraded on the platform. It is unable to communicate with VTICS/VTIS service. 

Impact: 

VTICS/VTIS Service unreachable issue would lead to the loss of threat intelligence data required for various features on the platform:

• Signatures may not be up to date.
• There is an increased possibility of false positives (e.g., files being marked as Malicious even when they are published by a trusted source).

Environment

vDefend SSP Version: 5.0 and later
Avi Operations: 5.2 and later

Cause

Connectivity to VTICS/VTIS service can be broken for various reasons, including, but not limited to:

• There is intermittent network connectivity issue.
• VTICS/VTIS Health service is down.
• Configuration issues like platform proxy settings. 

Resolution

Maintenance Window Required: No

In the short term, customers who wish to mitigate the false positives may leverage the allow-listing capability of Malware Prevention Service functionality. Ensure your platform proxy settings are configured correctly and outbound network access is allowed to external VTICS/VTIS service. To navigate to Proxy settings in vDefend management UI, Go to System → Under Administration, Go to Server Configurations → Proxy Server.

VTICS/VTIS service unreachable could be temporary and may restore on its own. In such a case, the alarm will move to "Resolved" state. If this doesn't happen in minutes, then it is advisable to collect the vDefend platform support bundle and raise a support ticket with Broadcom support team.