ESA 16 shows policy error: [Error] Firewall is disabled by administrator policy.

Products

• Endpoint Security Complete

Issue/Introduction

Feature Health Status:
Firewall

Health Details:
[Error] Firewall is disabled by administrator policy.

In CLI there are no any policy inconsistency errors, as well in the cloud console

Environment

ESA 16

Cause

The error occurred because the firewall policy obtained from ICDm contains an invalid IP address: "0.0.0.0". As a result, the sep_blade_firewall client failed to parse this policy and stayed in its default state, which is disabled.

The error is reported because the firewall policy obtained from OCDm is enable, but the firewall on the client is disabled. 

When we try to enter this invalid IP address ("0.0.0.0") via ICDm -> New firewall rule -> Add Host, ICDm correctly prevents it and requires a valid IP address. However, if we enter it via ICDm -> Create Host Group -> Add Host, ICDm fails to prevent it. This is an error in ICDm that needs to be fixed by the ICDm team.

 In comparison this with SEPM, and SEPM correctly prevents the invalid IP address "0.0.0.0" in both places.

Resolution

We will add this restriction on the UI, as a workaround could you please remove this exception from the policy with the IP 
"ip_start": "0.0.0.0"