Dual network interfaces in manager and search nodes

[clopmz]

Version

2.4.100

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

6

RAM

24GB

Storage for /

384GB

Storage for /nsm

384GB

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi all,

I have installed one manager node and one search node. Both servers have two configured network interfaces. I would like to use one interface for admin tasks (access via ssh and web interface) and use the other network interface for the rest of tasks between manager and search node (sensors can connect to this secondary network also).

Is this possible? Can I configure manager node to access to search node via secondary network interface?

Thanks

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Are you changing the management interface or adding the secondary one for your other admin tasks?

[clopmz]

Hi @cm-ops . My idea is to use one interface for management tasks only and the other one to rececive logs, run querys from manager to search node etc .... Both nic interfaces are installed before procedeed with securityonion ...

[cm-ops]

As long as you aren't changing the management interfaces on the nodes, you should be able to add an additional interface. I have seen multiple interfaces set up in a bond as well, for example bond1 and still work.

If you are splitting the functions, for example node communication via salt on one interface, log ingest on another, you may encounter issues.