Issues with SO install + accessing the web manager

[zmagez]

This is my second time trying to install SO on my VM network and I am having multiple issues as this is the first time I am using it. I got it installed the first time, and couldn't figure out how to access the web manager or set up SO with my VM network. (This is for a class btw)
So I decided to do a fresh install.
(My SO version is 2.3.200)
During the fresh Install, I have a NAT nic and a bridged nic, but when I go to select the management nic, it states that the NAT nic is "link down" and failed preflight checks, and will be stuck on the install.

I also don't know how to correctly configure SO for my VM network. My professor told me to switch the bridge nic to my VM net after the install, but I haven't figured out how to link it with my firewall box. Here's my network currently:

Host network:
192.168.1.0/24
Gateway: 192.168.1.1
(network adapter for vm net) 192.168.2.254

VM net:
192.168.2.0/24
Gateway: 192.168.2.1 (pfsense)
192.168.2.2-5 (windows + linux machines)

I would appreciate all the help I can get, I've watched videos for the install and documents on getting it to run with pfsense, but I just need the minor details on what exactly to do to fix this "link down", as well as how to actually link it with my vm network corrently.
Thank you.

[InfosecGoon]

I'm sorry, I'm having a little bit of trouble following your network topology.

You have two network adapters in the VM that you've installed Security Onion on -- one is a NAT interface, one is a Bridged interface. Which of these networks is the NAT interface on? Is the management interface for the Security Onion box behind the PFSense firewall (2.0/24 network) or the Host network (1.0/24)? And what are you using as your hypervisor platform?

[zmagez]

I am on VMware, the NAT is through my host network (1.0/24). I will provide some images to help give a better understanding.

(SO Adapters)

(NAT adapter)

(VM networks)

I just tried to do another install, it finally said that my NAT nic was UP, but it still failed preflight checks, and gets stuck on 2% on the last install page.

And for the management interface, I don't exactly know how to set that up, but I was told that for the install you have to have a bridge nic and after the install to change it to the VM net and then link it to the pfsense box.

[InfosecGoon]

I think we might have a bit of a vocabulary problem here -- let me define some of the terms so we're on the same page.

Management Interface -- this is the interface on your Security Onion standalone installation that has an IP address assigned to it and is used for active interaction with other endpoints on your network. For example, the management interface is where an analyst would connect to use the web console, or where an endpoint would forward logs for ingestion.

Monitor Interface(s) -- this/these are the interfaces that are configured in promiscuous mode to listen to traffic on the network. It does not have an IP address attached to it.

For your VMWare installation, you'll want to have a network interface that can have an IP address attached to it and connect to the Internet (for your Management Interface) and you'll want one that's on the bridge network that you want to monitor (that's your Monitor Interface).

So given what you've outline above, you'll want to put one on VmNet3 and one on the VM network, whatever you've named it. It's important that the one that you designate as the Management Interface has Internet access, or else you'll fail the preflight check, which seems to be what's happening here.