Configure sensor NICs after install

[cctbalan]

Folks
After installation found out that the additional NICs were not configured as sensors.
Ran nmcli and found out they were disabled.
"In the old days," you just ran setup from the GUI to configure additional NICs.
How can I easily configure additional NICs to be sensors after installation?
We have three additional NICs and want to connect to span port in different subnets.
Thank you in advance!

/CB

[cctbalan]

I see that innovate-support already answered this question 20d ago - is this answer still valid?

20d ago
Author innovate-support
"Thanks so much. That worked. For those who use these discussion boards to get detailed answers, here's the steps I took to accomplish this.

Possibly snapshot your VM just in case you screw something up.
Add additional interface to VM and reboot just to make sure OS picks it up and applies drivers
Log into OS and run ifconfig command to see what name was applied to it. My particular one got named ens160. Yours will probably be different.
Run nmcli con show command to view current interface bond-slaves
Run the following command to bond to the new interface, making sure your interface name is correct. Mine was ens160
sudo nmcli con add type ethernet ifname ens160 master bond0
Run nmcli con show command again to confirm it was added as a bond-slave
You should now be able to see data being collected on the newly monitored interface"

[cctbalan]

One install for everything - all in one

[soadmin@securityonion ~]$ sudo nmcli con show
[sudo] password for soadmin:
NAME UUID TYPE DEVICE
em2 e1b31e39-42b5-4852-b11a-2ed88b2c637b ethernet em2
em1 ab82c0bb-14bd-4124-b499-e6ff13138881 ethernet --
em3 12830018-0847-409d-b7a3-9bae89d8f295 ethernet --
em4 71d6ce32-27fa-4c48-89a7-33cf4bd6c1cb ethernet --
[soadmin@securityonion ~]$

[cm-ops]

When you ran setup, did you select any interfaces as monitoring interfaces? That should have created the bond interface bond0, which I do not see in your output.

[voglaj]

Yes, we selected em1, em3, and em4 as monitoring interfaces. They were disconnected when I looked using nmcli commands, but I was able to reconnect them, yet they are still not showing up as sensors on the web console. (I am an intern for @cctbalan)

[cm-ops]

From the looks of it there is no bond0 interface configured to add the NICs to. Have you attempted to run setup again?

[voglaj]

Am I able to run the setup again through an ssh connection or does it need to be done locally? Would I see the bond0 interface in the output of that command?

[cm-ops]

Yes, you can run setup again through an ssh session. When you run sudo nmcli con show you should see the bond0 interface and the bond slaves. Like below.

[voglaj]

After running the setup again, I installed SO as standalone and included the NICs as monitoring interfaces, and I now see the bond interface and slaves. Thank you very much for your help!

[cctbalan]

@voglaj indicates that to start the installation again through ssh:
"sudo so-setup-network" once you are in the /securityonion directory. And if you run nmcli con show, it shows all the bond0 interfaces. The Grid screen on the web interface only shows the single machine but it should be tracking all the incoming interfaces. They seem to all be functional at this point!

Thanks,