Delete and restore Forward node

[chape8]

Version

2.4.90

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

airgap

Hardware Specs

Meets minimum requirements

CPU

4

RAM

16

Storage for /

124

Storage for /nsm

100

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

Yes, there are additional clues in /opt/so/log/ (please provide detail below)

Detail

I have installed my distributed Security Onion.
Due to networking needs I have changed the netmask where the sensor was installed, previously mask 28 now mask 24.
The question is that I see that in the grid that sensor no longer reports data or anything similar, what can and should I do, has anyone deleted the sensor after installing it and then reconfiguring it?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[dougburks]

What exactly did you change on the forward node?

What exactly did you change on the manager?

Can the forward node ping the manager?

Did any IP addresses change?

Are there any firewalls or other network devices between the forward node and manager that may be interfering with traffic?

[chape8]

What changed was the IP address, including the network mask of the forward node.

From the manager, you can reach (ping) the forward whose IP was changed.

There has been no change in the manager.

[dougburks]

Please see the IP Address section of the documentation:
https://docs.securityonion.net/en/2.4/ip.html