The IP being routed by Linux is not the IP address assigned to the management network interface.

[ivanrdrgz]

Hello everyone,

I am using ESXi from vSphere Client, and in my network, my SecurityOnion server is connected to a pfSense firewall through the management interface. The gateway for Security Onion is 192.168.30.1 and its IP address is 192.168.30.10/24. I am sure that the network itself is well configured and that the IP addresses are well given. The sniffing interface is connected to a vSwitch (in ESXi I can't create an interface without connecting it to a vSwitch), which has no other machines connected to it. My sniffing interface gets automatically IP address 192.168.40.10 and I don't know why, I did not configure it, I don't even have any subnet with that range, but I don't have the oportunity of remove it, because I'm still stucked in managment NIC configuration.

ens192 should be down because i just create the interface, but I did not configure it.

The error appears after select NIC for maganagement, and it is the next one:
The IP being routed by Linux is not the IP address assigned to the management network interface (ens160). This is not a supported configuration, please remediate and rerun setup".
I'm using an Standalone config, and I have seen that configuring DHCP in pfSense solves this, but I don't want dynamic address assignment at all.

Thank you all in advance.

[dougburks]

What version of Security Onion are you using? 2.3.x or 2.4.x?

How are you installing it? Are you using our Security Onion ISO image or installing some other distribution and then performing a network installation? If you're performing a network installation, have you tried using our Security Onion ISO image to see if it avoids this issue?

[ivanrdrgz]

Hi! Thanks for the answer!

I'm using the official iso downloaded from this github (version 2.3.230, because i started this project it in april I think). This days I was trying some new things, I deleted few times the iso from the VM hard drive and started from the begining, the problem it seemed to be solved, but the installation was not finished, because after choosing not to use a proxy server, the following error appeared:
"The so-preflight script failed checking one more URLs required by setup. Check /root/sosetup.log".
Right now I'm doing airgap installation and I'm at this point:

It seems that it can work, but I don't know to what extent the airgap installation will affect the experience. Is there any problem with using the airgap installation? If the installation with internet access is better, how can I solve the described problem?

Thank you very much for your help.

[dougburks]

I'm using the official iso downloaded from this github (version 2.3.230, because i started this project it in april I think).

2.3.230 is an older version and 2.3.x will reach End Of Life in less than 6 months:
https://blog.securityonion.net/2023/10/6-month-eol-notice-for-security-onion-23.html

For this reason, we'd recommend that you download the latest 2.4 ISO image:
https://blog.securityonion.net/2023/10/security-onion-2420-now-available.html

because after choosing not to use a proxy server, the following error appeared:

If your Security Onion machine must go through a proxy server, you'll want to correctly configure that proxy server when prompted:

Right now I'm doing airgap installation and I'm at this point. It seems that it can work, but I don't know to what extent the airgap installation will affect the experience. Is there any problem with using the airgap installation?

If you go with an airgap installation, it will only get updates when we release a new ISO image.

[ivanrdrgz]

Hello and thank you again for your response.

I will seriously consider an OS upgrade. Although I already knew about the new version, I had not updated it because this is for an academic project lasting a couple of months.
I don't use proxy, that's why I didn't select it in the dialog box you were showing me.
It seems that with the airgap version the installation is complete, and I can now access the machine from another host.

Thank you very much for your help, you have been very kind. Any other problems I have, I will not hesitate to open a different post.
Best regards.

[antimidas651]

Exact same problem regardless of which NIC I select. I have followed all advice found such as switching from VirtIO to E1000, dropping to one NIC, and even setting reservations at the DHCP server. It does not matter what I do. I always get the same error message. If I drop to one NIC, it stops and tells me I must at least have two. And I downloaded the ISO today, so I know it is the latest.

It would be nice if an answered post actually had an answer. Google keeps taking me back to these posts that basically say, "nevermind" or "I found an answer" but without ever providing any information. At this point, I can only mark this up to bad software and to look for alternatives.

[TotieBash]

@antimidas651 you need to create a new ticket.. What error are you getting? send screenshot.

[lestus]

Completely agree with @antimidas651 and having the same problem, no matter what I do for NICs I end up in the same place with the error: IP being routed by Linux is not the IP address assigned to the management network interface.
@TotieBash literally the title of the thread.. what did you think?

[petiepooo]

See where your sniffer interface IPv4 configuration says "Automatic"? That means it's a DHCP client. If you don't want it pulling an IP from DHCP, Try setting that to "Manual" and leave everything else under it unconfigured. If that doesn't work, set it to "Disabled".