Sensors not connecting to Manager.

[jimrincan]

Version

2.4.200

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

airgap

Hardware Specs

Exceeds minimum requirements

CPU

8

RAM

32

Storage for /

4TB

Storage for /nsm

4TB

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Our Sensors are currently unable to establish a connection to the Manager. During installation, we receive an error indicating that a connection to the Manager cannot be made, along with a prompt to run the following command:

so-firewall includehost minion

The Sensor IP addresses were already added during the Manager upgrade, and when we re-run the command, the system responds that the IP is already included. Despite this, the Sensors still fail to connect.

While troubleshooting, we noticed that the sobridge interface does not appear when running ip addr. These Sensors were able to connect successfully on version 2.4.180, but the issue has persisted across versions 2.4.190, 2.4.200, and now 2.4.210. Our Network Team has confirmed that no network changes have been made during this period.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

If you run the following on your sensor, what does it show? curl -s $MSRVIP:4505 --connect-timeout 5 (replace $MSRVIP with your manager's IP)

[jimrincan]

Greetings, I ran the command and got nothing in return.

[cm-ops]

How about from your sensor, nc -vz $MSRVIP 4505 (replace $MSRVIP with your manager's IP)