Unable to get past setting an IP during post install setup / The IP being routed by Linux is not the IP....

[boredchilada]

Version

2.4.60

Installation Method

Security Onion ISO image

Description

installation

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

6

RAM

32

Storage for /

250

Storage for /nsm

250

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

Less than 1Gbps

Status

No, one or more services are failed (please provide detail below)

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I'm currently on proxmox 8.1.4 and im trying to install SO but im not able to get past the setup network portion of the installation due to this message.

The IP being routed by Linux is not the IP address assigned to the management interface (ens18).
This is not a supported configuration, please remediate and rerun setup.

I've been troubleshooting for about two days now, and nothing i do really works. I've tried setting the vms ip to static, nope. DHCP doesnt work either. I gave it a static address via my top level firewall. Still doesnt work.

At this point I dont really know whats going or why its not going forward.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[boredchilada]

currently my proxmox config is as so

[boredchilada]

Both interfaces on the SO VM inside proxmox receive an IP,

management has an IP in the 10.0.0.1/24
monitor has an ip in the 10.99.40.1/24

heres the vm settings

[boredchilada]

Do you mean the actual server interface that is going to be used for monitoring?

im currently working on converting to ovs on proxmox but currently no. I can include it into my bridge though?

I'm currently working with proxmox community to get it to OVS properly so heres more context

Top level NGFW <-> dumb switch <-> Cisco switch 2960x <-> wifi router

Currently the proxmox server is connecting via one interface (eno3) to the cisco switch, the 2nd interface(enp5s0) connects back to the dumb switch. Something like this

I'm aiming for a OVS config such as this one:

[boredchilada]

This is weird, its only allowing to use one interface out of 3 , and only that one?

I currently have 3 and its only letting me choose the one the middle, so not net0 or net2 just net1...?

[reyesj2]

Check your ip route for duplicate gateways
Your monitor interface should not have an ip address assigned it should get connected to a SPAN port or TAP to ingest traffic. You can also look at setting up ingesting traffic from a vnic in proxmox https://docs.securityonion.net/en/2.4/proxmox.html#virtual-nic

[boredchilada]

Ok, so i finally made sense of all this and just created a SPAN port on my switch of all my ports and plugged the monitor interface from proxmox which is passed through pci , everything works well and getting up to 60mb/s packet ingestion at times: