IBM Support

QRadar: Rebuilding a new QRadar Network Insights appliance with QRadar 7.3.3 requires a Napatech firmware downgrade

Troubleshooting


Problem

Administrators who receive a new 6200, 6300, or 6400 QRadar Network Insights appliances might receive hardware provisioned with the latest version of QRadar. If the appliance requires installation of QRadar® Network Insights to version 7.3.3, the Napatech firmware needs to be flashed to support QRadar 7.3.3. This technical note advises customers how to use the qni733flashNapatech.sh utility for 1901, 1910, and 1920 QRadar Network Insights appliances.

Cause

When a new QRadar® Network Insights (QNI) appliance is received by a customer, the appliance comes with the most current version of QRadar. The QRadar Network Insights 7.4 ISO and SFS builds have a utility to upgrade the Napatech card to support 7.4 versions of QRadar. The Napatech card installed has a version of firmware that is compatible for 7.4.x appliances. Administrators who have a QRadar 7.3.3 deployment need to change the Napatech firmware to match the QRadar Network Insights 7.3.3 version. 

Resolving The Problem

A utility qni733flashNapatech.sh is available for customers who need to update Napatech firmware on QRadar Network Insights appliances. The utility detects the appliance module for the QRadar Network Insights appliance and is intended to update Napatech firmware on the following:
 
Appliance Model type Supports qni733flashNapatech.sh?
1920 QRadar Network Insights 6200 Yes.
1901 QRadar Network Insights 6300 Yes.
1910 QRadar Network Insights 6400 Yes.
Software or virtual QRadar Network Insights appliance installations 6500 No.
QRadar Network Insights 1940 6600 No. QRadar Network Insights 1940 appliances are not affected by this Napatech firmware issue.
Napatech cards not preinstalled by IBM N/A No.
Before you begin
  1. Download the qni733flashNapatech.sh utility from Fix Central:  7.3.3-QNI-SCRIPT-NapatechFirmware
  2.  The qni733flashNapatech.sh utility checks the model type to ensure firmware is only updated on 6200, 6300, and 6400 appliances. Optionally, administrators can manually confirm the model type for an appliance with the command: /opt/qradar/bin/myver -a
  3. The qni733flashNapatech.sh utility when completed, prompts to either reboot or install QRadar Network Insights 7.3.3. On a QRadar Network Insights version 7.4.1 or later appliance it is important to shutdown the appliance. A reboot allows the 7.4  Napatech firmware to be updated.
  4. You must have a method to connect to or remotely manage the QRadar Network Insights appliance.
    • To install QRadar Network Insights 7.3.3, a Cdrom or remote management interface is required to mount the the QRadar Network Insights 7.3.3 ISO. For more information, see: QRadar: Mounting ISOs using an IMM or XCC.
    • If you do not have an IP address on the appliance or remote management configured, you might be required to connect to the serial port of the appliance.  For more information, see: Installing the QRadar SIEM appliance.
  5. Administrators installing QRadar Network Insights 7.3.3, see Release of the QRadar Network Insights 7.3.3 ISO.

Verifying the Napatech firmware version

  1. Connect to the appliance by using a notebook with a serial connection or remote management, such as IMM or XCC.
    Note: If the appliance is added to the QRadar deployment, SSH connections are restricted by security policy.  You must SSH to the QRadar Console, then open an SSH session to the QRadar Network Insights appliance.
  2.  Optional. To confirm the model type is 6200, 6300, or 6400 for your QRadar Network Insights appliance, type: /opt/qradar/bin/myver -a
  3. To verify the Napatech card firmware information, type: 
    /opt/Napatech3/bin/adapterinfo

    adapterinfo (v. 3.17.2.23-0e288)
==============================================================================
System: 3.17.2.23
------------------------------------------------------------------------------
Adapters:  2
Ports:     8
==============================================================================
Adapter 0: NT40A01-01-SCC-4x10/1-E3-SLB-ANL Analysis Network Adapter
------------------------------------------------------------------------------
Bus ID:             0000:06:00.0
PCI ID:             18F4:0145
FPGA ID:            200-9232-55-05-00
Feature level:      N-ANL10
Profile:            Capture
Supported profiles: Capture

    Results
    The Napatech firmware revision is displayed. If the reported firmware (FPGA ID) does not match one of the entries in the following tables, you should review the instructions provided for your QRadar software version:
    Expected firmware (FPGA ID) Model type Appliance
    200-9232-55-05.ntimg 6200 1920 QRadar Network Insights
    200-9234-55-01.ntimg 6300 1901 QRadar Network Insights
    200-9232-55-05.ntimg 6400 1910 QRadar Network Insights
    Note: Firmware 200-92xx-xx-xx-xx versions indicate that the appliance is QRadar V7.3.3 or earlier appliances. If the QRadar Network Insights appliance is installed with V7.4.1 or later the output for the firmware version is displayed as 200-95xx-xx-xx-xx

     

Downgrading the Napatech firmware on a 7.3.3  QRadar Network Insights appliance

Administrators with QRadar 7.3.3 appliances can use the qni733flashNapatech.sh utility to ensure the QRadar Network Insights 7.3.3 appliance's Napatech card is flashed to the correct version.
  1. Connect to the appliance by using a notebook with a serial connection or remote management, such as IMM or XCC.
    Note: If the appliance is added to the QRadar deployment, SSH connections are restricted by security policy.  You must SSH to the QRadar Console, then open an SSH session to the QRadar Network Insights appliance.
  2.  Log in to the appliance as root user.
  3. To confirm the model type is 6200, 6300, or 6400 for your QRadar Network Insights appliance, type: 
    # /opt/qradar/bin/myver -a
6200
    Note: If the command does not return  6200, 6300 or 6400, you may need to reinstall QRadar Network Insights and use an activation key for your model type. For more details, refer to Install Menu does not Display a Select Option for QNI 6200 Appliances (APAR IJ18213).
  4. Copy the qni733flashNapatech.sh utility to the /storetmp directory on the QRadar Network Insights appliance by using SCP.
  5. Navigate to the /storetmp directory where the qni733flashNapatech.sh utility  is located.
  6. Run the flash program qni733flashNapatech.sh utility using the command: 
    sh qni733flashNapatech.sh
  7. Follow the prompts on the screen for the qni733flashNapatech.sh utility.
  8. When the Napatech firmware re-image is complete, reboot the appliance.
  9. When the system is back online, verify what firmware version of your Napatech card.  

    Results
    After verifying the firmware version is correct, the Napatech card should run with no errors. If you continue to experience issues, contact IBM® QRadar® Support for assistance.

Downgrading a QRadar Network Insights 7.4.x appliance to version 7.3.3

When you purchase a new QRadar Network Insights appliance, it comes provisioned with the most current QRadar version. Administrators who have Consoles with QRadar 7.3.3 installed, need to downgrade their newly purchased QRadar Network Insights appliance to version 7.3.3 and re-image the Napatech card to the correct firmware version. Due to the issue Install Menu does not Display a Select Option for QNI 6200 Appliances (APAR IJ18213), it is advised to re-image the Napatech firmware before installing QRadar Network Insights 7.3.3. To complete the installation, you need to download the 7.3.3 QRadar Network Insights ISO from Fix Central.
  1. Connect to the appliance by using a notebook with a serial connection or remote management, such as IMM or XCC.
    Note: If the appliance is added to the QRadar deployment, SSH connections are restricted by security policy. You must SSH to the QRadar Console, then open an SSH session to the QRadar Network Insights appliance. 
  2. Log in to the appliance as root user.
  3. Use the steps in the section Verifying the Napatech firmware version to ensure that the QRadar Network Insights 7.3.3 firmware is not already installed.
  4. Downgrade your Napatech firmware. For more information, see the section, Downgrading the Napatech firmware on a 7.3.3 QRadar Network Insights appliance.
  5. When the Napatech firmware re-image is complete, it will prompt you to either reboot or reimage the appliance. Shut down the appliance to avoid the Napatech firmare being updated to 7.4.x before QRadar Network Insights 7.3.3 is installed.
  6. Mount the QRadar Network Insights 7.3.3 ISO image by using a Cdrom or remote management, such as IMM or XCC.
  7. Install QRadar Network Insights 7.3.3. on the QRadar Network Insights appliance.

    Results
    After QRadar Network Insights 7.3.3 is installed and the firmware version has been verified as correct, the Napatech card should run with no errors. If you continue to experience issues, contact IBM® QRadar® Support for assistance.

Document Location

Worldwide

[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SS6E69","label":"IBM QRadar Network Insights"},"ARM Category":[{"code":"a8m0z000000cwtJAAQ","label":"QRadar Network Insights"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.3.3","Type":"SW"}]

Document Information

Modified date:
19 May 2021

UID

ibm16443715

Page Feedback