Guardicore: Inventory Discovery & Change Request Export

The Guardicore integration does two things, and you can enable either or both on one account:

• Inventory discovery reads the assets from your Guardicore management center and brings them into Connect's Inventory, one item per asset with its IPs, labels, and MAC address.
• Change request export pushes a Connect change request that has passed a Boundary evaluation into Guardicore as segmentation policy rules, in a ruleset of its own, and publishes them.

Before you start

Prerequisite	Why it's needed	Where to check
The hostname of your management center, for example customer-12345.saas.guardicore.com	Every API call goes to it	Your browser's address bar when you're signed in
A Guardicore user that can read assets	Discovery lists assets	Guardicore user management
For export, the same user must also be able to create, edit, delete, and publish policy rules	Each export creates or updates rules in the connect-change-requests ruleset and publishes a revision	Guardicore user management
The management center reachable from the internet over HTTPS	Connect connects to it from the cloud	If your management center is only reachable inside your network, contact FireMon Support

If you're only discovering inventory, a read-only user is enough. Export needs write access to policy, but only to rules in its own ruleset; it never touches other rulesets.

Set up a Guardicore account

1. In Connect, go to Settings > Accounts and add a new account.
2. Cloud Provider: Guardicore. Give it an ID (any identifier that's unique among your accounts), a name, and a project.
3. Save. You land on the Provision page.
   • Under Configure for, leave Import checked for inventory discovery and Export checked for change request export. Uncheck whichever you don't want.
   • Under Credentials, fill in the Hostname, Username, and Password. The password must be re-typed on every save of this page; see Passwords and tokens are never shown back to you.
4. Save. If Import is enabled, the first discovery starts on its own.

Inventory discovery

Each asset becomes one inventory item of type Asset, sourced from Guardicore:

Asset field	Where it lands
Name	The item's name and hostname
IP addresses of every network interface	The item's IP addresses
Labels	The item's tags, one per label key
First interface's MAC address	The item's MAC address
Last seen	The item's last-seen time, which Decommission uses to spot idle assets

Assets are matched between runs by their Guardicore ID. An asset that no longer exists is removed on the next run.

Verify it landed

What to check	Where to look
The account has no errors	Settings > Accounts: no warning icon on the Guardicore account, and its Provision page shows no Resource Errors
The item count	Integrations in the main navigation: the Guardicore row is Active and its Items count roughly matches Assets in the management center
The items themselves	Inventory > Resources, filtered by Vendor > Guardicore. Open one: its IPs, tags, and MAC should match the asset

Change request export

Export is driven by Boundaries. When a change request is evaluated against a Boundary and the result is Pass or Review, Connect exports it to every target listed on that Boundary. Fail and error results export nothing.

1. Open the Boundary (or create one) under Boundaries.
2. In Target(s), select your Guardicore account. It appears as Guardicore (your account name). Only accounts with Export enabled are listed.
3. Save the Boundary. From now on, every change request that passes it is exported.

To test it, create a change request under Change with at least one rule and submit it. Once the evaluation finishes with Pass or Review, the rules are in Guardicore.

What Guardicore receives

Each rule in the change request becomes one Guardicore rule in a ruleset named connect-change-requests, on the Corporate network profile. Connect never writes outside that ruleset.

Change request	Guardicore rule
Allow / Deny	ALLOW / BLOCK
Source or destination Any	Matches all
CIDR	The CIDR as a subnet
Inventory item or Group	The members' IP addresses as /32 subnets, resolved at export time
TCP / UDP with a port or port range	The matching protocol and ports
ICMP, All TCP, All UDP, All Traffic	The matching protocols with no port restriction
A Pass result	The rule is published enabled, and enforces immediately
A Review result	The rule is published disabled, visible in Guardicore for a person to approve and enable

Every rule's Comments field carries the change request ID, rule ID, name, approval time, approver, and justification, so it's traceable back to Connect.

After writing the rules, Connect publishes a revision scoped to the connect-change-requests ruleset, and only if every rule was written successfully. If a rule fails, Connect reverts the rules it already wrote and publishes nothing, so a missing Deny is never left enforcing beside a published Allow. Unpublished rules don't enforce, so if that revert or the publish step itself fails, the leftover rules remain as unpublished drafts in Guardicore. Discard them there, then re-evaluate the change request.

Verify it landed

In the Guardicore management center, open the policy rules and filter by the connect-change-requests ruleset. You should see one rule per change request rule, with Comments beginning Connect CR: <id>, and a published revision. A Review result shows the rules disabled.

How changes are handled

Action	Result
Re-evaluate or edit the change request	Existing rules are updated in place (matched by the rule ID in their comments), new rules are added, and rules for removed change request rules are deleted, then a new revision is published. No duplicates are created.
Delete the change request in Connect	Its rules are left in place in Guardicore. Remove them by hand.
Edit a rule's comments in Guardicore	Connect can no longer match it, and the next export creates a fresh rule beside it. Leave the comments alone.
Edit anything else on a rule in Guardicore	Overwritten on the next export of that change request.

Details and edge cases

Rules that can't be expressed are rejected before anything is written. Guardicore has no equivalent for a negated source or destination, a custom IP protocol, or a Connect port-range-size service, and won't accept a rule with no services. A change request containing any of those isn't exported at all. The evaluation still records its result; only the export is skipped.

Multi-rule change requests share their resolved addresses. When several rules in one change request reference Groups or inventory items, every exported rule receives the combined set of resolved IPs, not just its own. A change request with one rule, or whose rules use CIDRs and Any, is exact. Keep Group-based rules to one per change request where precision matters.

Nothing in Connect records the export. The change request page shows the Boundary result, not whether Guardicore accepted the rules. Check Guardicore itself, as described under Verify it landed.

For common issues, see Troubleshooting.

Guardicore documentation

Guardicore's product documentation is published on the Akamai TechDocs site and requires a customer login. The relevant topics are Policy rules, Rulesets, and Publishing a policy revision.