Guardicore

The Guardicore integration does two things, and you can enable either or both on one account:

• Inventory discovery reads the assets from your Guardicore management center and brings them into Connect's Inventory, one item per asset with its IPs, labels, and MAC address.
• Change request export pushes a Connect change request that has passed a Boundary evaluation into Guardicore as segmentation policy rules, in a ruleset of its own, and publishes them.

Before you start

Prerequisite	Why it's needed	Where to check
The hostname of your management center, for example customer-12345.saas.guardicore.com	Every API call goes to it	Your browser's address bar when you're signed in
A Guardicore user that can read assets	Discovery lists assets	Guardicore user management
For export, the same user must also be able to read, create, edit, delete, and publish policy rules	Each export reads the connect-change-requests ruleset, creates or updates rules in it, and publishes a revision. Without read access, the export stops before writing anything	Guardicore user management
The management center reachable from the internet over HTTPS	Connect connects to it from the cloud	If your management center is only reachable inside your network, contact FireMon Support

If you're only discovering inventory, a read-only user is enough. Export needs write access to policy, scoped to rules in its own ruleset.

Set up a Guardicore account

1. In Connect, go to Integrations and click New Integration Account.
2. Provider: Guardicore. Give it a name and a project. The name is the label shown throughout Connect, so use something you and your team will recognize.
3. Click Continue to Provisioning. On the Provision page:
   • Under Configure for, Import covers inventory discovery and Export covers change request export. Both use the same credentials, so a provisioned account does both.
   • Under Credentials, fill in the Hostname, Username, and Password. Once saved, the password opens blank; leave it blank to keep it. See Passwords and tokens are write-only.
4. Click Provision Account, then press Test to confirm Connect can reach the management center, sign in, and read assets. The first discovery starts on its own.

Inventory discovery

Each asset becomes one inventory item of type Asset, sourced from Guardicore:

Asset field	Where it lands
Name	The item's name and hostname
IP addresses of every network interface	The item's IP addresses
Labels	The item's tags, one per label
The first MAC address among its interfaces	The item's MAC address
Last seen	The item's last-seen time, which Decommission uses to spot idle assets

Assets are matched between runs by their Guardicore ID. Assets the management center has marked deleted are left out, so an asset dropped there is removed from Inventory on the next run.

Verify it landed

What to check	Where to look
The account is healthy	Integrations: the Guardicore row's Status stays clear, and the account's Provision page shows a Provisioned tag
The item count	Integrations in the main navigation: the Guardicore row's Assets count roughly matches Assets in the management center
The items themselves	Inventory > Resources, filtered by Vendor > Guardicore. Open one: its IPs, tags, and MAC should match the asset

Change request export

Export is driven by Boundaries. When a change request is evaluated against a Boundary and the result is Pass or Review, Connect exports it to every target listed on that Boundary. Fail and error results stop at the evaluation.

1. Open the Boundary (or create one) under Boundaries.
2. In Target(s), select your Guardicore account. It appears as Guardicore (your account name). An account that hasn't been provisioned yet is named under the field instead, and is offered once it is.
3. Save the Boundary. From now on, every change request that passes it is exported.

To test it, create a change request under Change with at least one rule and submit it. Once the evaluation finishes with Pass or Review, the rules are in Guardicore.

What Guardicore receives

Each rule in the change request becomes one Guardicore rule in a ruleset named connect-change-requests, on the Corporate network profile. Every rule Connect writes lands in that ruleset.

Change request	Guardicore rule
Allow / Deny	ALLOW / BLOCK
Source or destination Any	Matches all
CIDR	The CIDR as a subnet
Inventory item or Group	The members' addresses, resolved at export time, with single addresses as /32 (IPv6: /128)
TCP / UDP with a port or port range	The matching protocol and ports. Guardicore's ports run from 1 to 65535, so a port of 0 stops the export
ICMPv4 with a type and code	An ICMP match for that type and code
ICMPv6, with a type and code or all of it	Can't be expressed: Guardicore's ICMP matching is IPv4 only, so the export stops
All ICMPv4, All TCP, All UDP, All Traffic	The matching protocols, across all ports. All Traffic becomes TCP, UDP, and ICMP
A request whose overall state is Pass	The rule is published enabled, and enforces immediately
A request whose overall state is Review or Fail	The rule is published disabled, visible in Guardicore for a person to approve and enable

The request's overall state decides this, not the Boundary that exported it. A request failed by one Boundary still reaches Guardicore when a Pass Boundary targeting it also matched, and its rules arrive disabled.

Every rule's Comments field carries the change request ID, rule ID, name, the time and user of the request's last update (Updated and Updated by), and justification, so it's traceable back to Connect.

If Connect can't read the connect-change-requests ruleset, nothing is written. After writing the rules, Connect publishes a revision scoped to that ruleset, once every rule is written successfully. If a rule fails, Connect removes the rules it already created, reverts the ones it changed, and leaves the revision unpublished, so an Allow only ever enforces alongside its matching Deny. Unpublished rules sit inert, so if that cleanup or the publish step itself fails, the leftover rules remain as drafts in Guardicore. Discard them there, then re-evaluate the change request.

Verify it landed

In the Guardicore management center, open the policy rules and filter by the connect-change-requests ruleset. You should see one rule per change request rule, with Comments beginning Connect CR: <id>, and a published revision. A request in Review or Fail shows its rules disabled.

How changes are handled

Action	Result
Re-evaluate or edit the change request	Existing rules are updated in place (matched by the rule ID in their comments), new rules are added, and rules for removed change request rules are deleted, then a new revision is published. No duplicates are created.
Delete the change request in Connect	Its rules are left in place in Guardicore. Remove them by hand.
The request stops passing, or its Boundary no longer targets the account	Its rules are left in place, enabled as they were. Disable or remove them by hand.
Edit a rule's comments in Guardicore	Connect matches rules on those comments, so the next export creates a fresh rule beside it. Leave the comments as they are.
Edit anything else on a rule in Guardicore	Overwritten on the next export of that change request.

Details and edge cases

A rule Guardicore can express is checked before anything is written. Guardicore states sources and destinations directly, supports TCP, UDP, and ICMP, takes ports from 1 to 65535, matches ICMP for IPv4 only, and requires at least one service on every rule. A change request that steps outside those stops at the evaluation: the result is recorded, and the export is skipped.

Multi-rule change requests share their resolved addresses. When several rules in one change request reference Groups or inventory items, each of those rules receives the combined addresses of the whole request, including other rules' CIDRs, rather than its own alone. A change request with one rule, or whose rules use CIDRs and Any, is exact. Keep Group-based rules to one per change request where precision matters.

Guardicore is where the export is recorded. The change request page shows the Boundary result; Guardicore shows whether the rules arrived. Check it as described under Verify it landed.

For common issues, see Troubleshooting.

Guardicore documentation

Guardicore's product documentation is published on the Akamai TechDocs site and requires a customer login. The relevant topics are Policy rules, Rulesets, and Publishing a policy revision.