Caveats

ipset Kernel Module

When enforcement is enabled and preserve rules is disabled in the Agent Config profile, the agents running on Linux hosts ensures that the ipset kernel module has a sufficiently large max_sets configuration. In case a change is needed, the agent reloads the ipset kernel module with a new max_sets value. If Preserve Rules is enabled, the agents check the current ipset module max_sets value, but does not make any change. The current configured max_sets value can be found in cat /sys/module/ip_set/parameters/max_sets.

Host Firewall Backup

The first time that enforcement is enabled in the Agent Config profile, the agents running on Linux hosts, store the current content of ipset and ip[6]tables in /opt/cisco/tetration/backup before taking control of the host firewall.

Successive disable or enable transitions of enforcement configuration do not generate backups. The directory is not removed after agent uninstallation.