Manager Node - Intermittent connection

[YvesEutelsat]

Version

2.4.20

Installation Method

Security Onion ISO image

Description

installation

Installation Type

Distributed

Location

airgap

Hardware Specs

Exceeds minimum requirements

CPU

8

RAM

64G

Storage for /

250

Storage for /nsm

206G

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

No, there are no additional clues

Detail

Good day,

I'm trying to install a distributed deployment version 2.4.20.

When there is no node link to the Manager node, I can navigate web interface, connect through SSH without problem. As soon as I added a Search Node, I'm having connection interruption when logging through Web Interface, can't connect through SSH on the Manager Node.

I added a Sensor Node which the Manager Node seems to recognize. When trying to add Sensor Node on Manager from command line (so-firewall-minion --role=SENSOR --ip=x.x.x.x) output is "Already exists". I'm using command line because I have connection issue through web interface. Yes, I did add my host to access Manager Node via Web Interface.

Any assistance would be much appreciated.

Thanks

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[dougburks]

Have you double-checked that each of your devices has a unique IP address (manager, search node, and your workstation)?

Was the search node a fresh installation or was it some sort of clone?

Are all devices in the same subnet or are they communicating through a firewall, router, or other network device?

[dougburks]

You could install 2.4.10 first and then upgrade to the newly released 2.4.30. However, I'd recommend that you:

• download the new 2.4.30 ISO image and verify it as shown at https://securityonion.net/download
• install your manager and verify that it works correctly
• then install your search node and verify that it works correctly
• then install your forward node and verify that it works correctly

[YvesEutelsat]

I downloaded 2.4.30 and verified it. I installed the manager and it was working fine. I was able to login into the web interface, ping, SSH.
To my knowledge, manager seems to work fine.

Then I installed the search node and added to the grid. As soon as I do that, the manager node become unstable: can't login, can't SSH. When I able to connect to manager, it is only for a short period of time (less than 2 min).

I removed the search node from the "Accepted members", the manager is back to normal.
Manager is on a VM.
Search is not on a VM.

I'm not sure what I'm doing wrong. Much appreciated all your assistance so far.

[dougburks]

Have you double-checked that the manager and search node have unique hostnames?

[YvesEutelsat]

I was able to find the setting missing. The installation process is different between 2.3.x and 2.4.x. So I was missing the NTP server configuration. Once setup the NTP server, now Manager, Search, and Sensor node are communicating. My next troubleshooting is the data is not flowing from Sensor to Manager.

Thanks for your support

[dougburks]

My next troubleshooting is the data is not flowing from Sensor to Manager.

If you have further questions or problems, please start a new discussion.