Question concerning nodes

[melyons1987]

Version

2.4.120

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

airgap

Hardware Specs

Exceeds minimum requirements

CPU

8+

RAM

32+

Storage for /

Over 40 TB available

Storage for /nsm

Over 40TB available

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

We have a large industrial environment we are deploying this on, in the Industrial Information Networks. We follow the Perdue model, with 1 shared L3.5 DMZ, 2 distinct L3 subnets, each with 6+ L2 below. Currently, the manager and search nodes reside in the DMZ.

My wish is to collect all into the shared DMZ and possibly put IDH's in the L2, as remote field locations allow network access into the L2 subnets directly. Is it possible have multiple managers or similar in the L3's to push the future agent updates to the various nodes in L2 machines and handle any L2 nodes? My desire is for minimal hole being put in the firewalls.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[InfosecGoon]

You could put Fleet Nodes into the L2, and those would act as points of contact for the IDH nodes to receive updates and send logs. You'd need to open a firewall for those Fleet Node IPs to get back to the Manager.

https://docs.securityonion.net/en/2.4/architecture.html#elastic-fleet-standalone-node

[melyons1987]

L2 cannot directly contact L3.5 would have to communicate through an L3 node

[melyons1987]

Assumption is salt+es is how configuration and final installation is handled, via the manager.

As I can only allow 1 level of traversal, I was hoping to have a 'proxy' manager at L3, below the Firewalls.