Cannot change location country with Velo Edge

Products

• Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

Vero Edge SSE setup where APIs used to create Cloud SWG IPSEC locations.

All locations are created successfully and users can access internet sites via Cloud SWG using Edge devices.

When looking at the Cloud SWG Edge IPSEC locations, the country reported is in the US even though these Edge devices are not in the US.

Cloud SWG Localization zone support requires valid Country information to be added to the location, but Cloud SWG admin cannot edit the country settings.

How does a Cloud SWG admin modify the country/time zone location settings for Edge IPSEC tunnels?

Environment

Cloud SWG.

Velo Edge.

Cause

Edge SSE APIs not setting up the country information correctly.

Resolution

Use the location management APIs to set the relevant country and timezone details.

To apply the change:

a) Retrieve all the Cloud SWG locations and identify the UUID associated with the one you want to change

# curl -u APIusername:APIpassword --location 'https://portal.threatpulse.com/api/rest/locations' 

and check for the location UUID and name of the IPSEC location you want to change e.g. 1-2-3-4-5

 

b) Dump location details for the IPSEC location with uuid 1-2-3-4-5 that requires the non US country / timezone setting

# curl -u APIusername:APIpassword --location 'https://portal.threatpulse.com/api/rest/locations/1-2-3-4-5'

 

{
  "uuid": "1-2-3-4-5",
  "name": "EdgeExampleTunnel",
  "physicalIdentifier": "a-b-c-d-e",
  "type": "ikev2-fqdn-firewall",
  "ip": null,
  "fqdn": "ipsec.example.com",
  "userFqdn": null,
  "primaryDstNatIp": null,
  "failoverDstNatIp": null,
  "apiManaged": true,
  "timeZone": “Pacific Time (America/Los_Angeles),
  "country": “US”,
  "addressLine1": "",
  "addressLine2": "",
  "zip": "",
  "comments": "Created by SSE automation for Edge SSE Internet.",
  "estimatedUsers": "RANGE_1001_TO_5000",
  "vni": 0,
  "estimatedBW": null,
  "site": null,
  "integrator": null
}

 

3. Take the JSON payload and change the country settings we want (highlighted example sets it to Country Ireland and Europe/Dublin time zone as an example). The additional uuid, name and type fields are required by the API, but the other fields returned in b) above are not.

# curl -vvv --location -u APIusername:APIpassword  --request PUT 'https://portal.threatpulse.com/api/rest/locations/1-2-3-4-5' --header 'Content-Type: application/json' --data '{

    "uuid": "1-2-3-4-5",
    "name": "EdgeExampleTunnel",
    "type": "ikev2-fqdn-firewall",
    "timeZone": "Europe/Dublin",
    "country": "IE",

}'