IP Change

[shabeebpm]

Version

2.4.100

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

32

RAM

256GM

Storage for /

40TB

Storage for /nsm

30TB

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

In 2.4 version, i tried to change the Security Onion IP by running the iso file, and after changing the ip, I am not able to run sudo so-ip-update command as it says the command is not valid. please advise

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[zapphodd]

I too am interested in a working so-ip-update command.

[dougburks]

Please see the documentation:
https://docs.securityonion.net/en/2.4/ip.html
https://docs.securityonion.net/en/2.4/best-practices.html#configuration

[TotieBash]

I can attest that so-ip-update works on standalone install. I used it on various 2.3.x version and last I used it is last month 2.4.30 NOV patch version. The process I do is:

1. Make sure that the Standalone system works first "so-status". Also login to the web ui and check the grid status.
2. Then I manually change IP address using nmcli or nmtui.
3. Then I issue "so-ip-change". The script will detect that you change IP and will prompt you to confirm the IP address change.

[TotieBash]

Did you mean 2.3.100?

There is no 2.4.100 version release yet. The latest 2.4 variant is 2.4.30...

https://docs.securityonion.net/en/2.4/release-notes.html

[shabeebpm]

I am talking about the latest version security onion, 2.4.x. I tried different version under 2.4, but i am not able to change the IP after the installation. when i run the sudo so-ip-update, it is throwing the error as "Error: cannot update the ip on a distributed grid"

[TotieBash]

That "Error: cannot update the ip on a distributed grid" is hinting that you are on "distributed" and not "standalone" install. But then again that error could just be generic.

But I guess I just wanted to state that the so-ip-update script is only for standalone install and not for distributed install. I can only confirm it from my vantage point that it works on my various 2.4.x standalone install and even on old 2.3.x. I use it on official 2.4 iso image standalone install and I also use it on RHEL9 network install.

[shabeebpm]

The script was working in 2.3 version but not 2.4, and i am using standalone install only for 2.4.x version and i am getting this error. I downloaded the ISO from SO website and choose as standalone installation only.