pfsense integration leads to Disconnect to Manager

[brusef]

Version

2.4.100

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

airgap

Hardware Specs

Exceeds minimum requirements

CPU

16

RAM

32

Storage for /

1 TB

Storage for /nsm

700 GB

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

No, one or more services are failed (please provide detail below)

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

Yes, there are additional clues in /opt/so/log/ (please provide detail below)

Detail

Following the steps to integrate a pfense firewall syslog has created an error state. SO front end states "Disconnected from manager". I'd imagine that the Administration Configuration file has those integration values in it and I could reconfigure it to connect to the front end. Am I right about that? If that is the way I'm not sure where it is.

so-elastalert and so-playbook are both "missing" in so-status

the salt call has the error below.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[brusef]

the so-elastic-fleet commands are return 401 / Unauthorized / Unauthorized messageds

[cm-ops]

Are there any clues in the Elasticsearch log? /opt/so/log/elasticsearch/securityonion.log

[brusef]

I looked but could not quite figure it out so I reran the so-setup script and got a clean install. The logs were retained. I reapplied the pfsense integration and did not replicate the error (yay!).
working with the integration is a bit ugly so I don't imagine that I'm going to be going back to find the root cause.
Thanks for getting back with this.