QRadar: Network connectivity issues when using virtual appliances with dynamic MAC address

Troubleshooting

Problem

QRadar® virtual appliances with dynamic MAC address assignation might become inaccessible when using SSH after a reboot or network service restart. When the problem occurs, the error "Device xxx has different MAC address than expected" appears.

Symptom

When accessing the QRadar host by using SSH, it reports "No route to host".

ssh: connect to host <QRadar IP ADDRESS> port 22: No route to host

The Console's user-interface does not load and reports timeout.

Cause

QRadar requires static MAC address configuration on its interfaces. A host with dynamic MAC address assignation can acquire a new MAC address, which causes a mismatch on the network configuration files and the host becomes unreachable.

Environment

QRadar® deployments with virtual appliances.

Diagnosing The Problem

Administrators can log in to the VM from the serial console connection provided by the respective virtual platform or hypervisor and confirm the MAC address mismatch.

Log in to the virtualization platform portal and start a serial or console connection to the appliance.
Note: You must request this access to your virtual platform or hypervisor administrator.
Review the network settings of the virtual machine. The following image shows an example of a VM running on Microsoft Hyper-V with dynamic MAC address settings.

Verify the error by checking the status of the network service.

systemctl status network -l

Output Example:

systemd[1]: Starting LSB: Bring up/down networking...
network[1280]: Bringing up interface ens192: ERROR : [/etc/sysconfig/network-scripts/ifup-eth]
               Device ens192 has different MAC address than expected, ignoring.
network[1280]: [FAILED]
systemd[1]: network.service: control process exited, code=exited status=1
systemd[1]: Failed to start LSB: Bring up/down networking.
systemd[1]: Unit network.service entered failed state.
systemd[1]: network.service failed.

Check the MAC address reported by the OS.

 ip -f inet link show ens192

The following output shows the MAC address 00:50:56:8f:41:fb associated to the management interface ens192.

2: ens192: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc prio state UP mode DEFAULT group default qlen 1000
    link/ether 00:50:56:8f:41:fb brd ff:ff:ff:ff:ff:ff

Check the MAC address reported in the network configuration files.
```
grep HWADDR /etc/sysconfig/network-scripts/ifcfg-<INTERFACE>
```
The following output shows the MAC address 00:50:56:9e:33:58 associated to the management interface ens192.
```
HWADDR=00:50:56:9e:33:58
```
Result
The MAC address mismatch is shown, and administrators can proceed to the Resolving the Problem section.

Resolving The Problem

Administrators must engage their respective virtualization platform or hypervisor administrator to configure the virtual machine to have a static MAC address and reconfigure the configuration files, with the static MAC address provided.

IMPORTANT

Some hypervisors require the virtual machine to be powered off to edit the hardware, causing downtime on the services. The administrator must address this requirement with their Hypervisor Administrator and schedule this activity during a maintenance window when required.

The following image shows an example of a virtual machine running on Microsoft Hyper-V with static MAC address settings. This MAC address needs to be configured in the configuration files.

To reconfigure the configuration files, run the following steps:

Power on the virtual machine.
Log in to the virtualization platform portal and start a serial or console connection to the appliance.
Check the MAC address matches the virtual machine network settings. In this article, the MAC address 00:50:45:9E:B9:02 is used as example
Note: On Linux, the MAC address can be lowercase, thus 00:50:45:9E:B9:02 can be written as 00:50:45:9e:b9:02.
```
 ip -f inet link show ens192
```
The following output shows the MAC address 00:50:56:8f:41:fb associated to the management interface ens192.
```
2: ens192: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc prio state UP mode DEFAULT group default qlen 1000
    link/ether  00:50:45:9e:b9:02 brd ff:ff:ff:ff:ff:ff
```

Reconfigure the HWADDR in the configuration files.

Back up the current file. Change the interface name accordingly.

mkdir -p /store/IBM_Support/
cp -fv /etc/sysconfig/network-scripts/ifcfg-<INTERFACE> /store/IBM_Support/

Edit the HWADDR with the one provided by the administrator.

sed -i 's/HWADDR=.*/HWADDR=<MAC ADDRESS>/' /etc/sysconfig/network-scripts/ifcfg-<INTERFACE>

Output example:

sed -i 's/HWADDR=.*/HWADDR=00:50:45:9e:b9:02/' /etc/sysconfig/network-scripts/ifcfg-ens192

Restart the network service.

systemctl restart network; systemctl status network

Output example:

● network.service - LSB: Bring up/down networking
   Loaded: loaded (/etc/rc.d/init.d/network; bad; vendor preset: disabled)
   Active: active (exited) since Wed 2022-12-14 20:43:32 AST; 26s ago
     Docs: man:systemd-sysv-generator(8)
  Process: 21665 ExecStop=/etc/rc.d/init.d/network stop (code=exited, status=0/SUCCESS)
  Process: 21930 ExecStart=/etc/rc.d/init.d/network start (code=exited, status=0/SUCCESS)
    Tasks: 0
   Memory: 0B
Dec 14 20:43:26 <HOSTNAME> systemd[1]: Starting LSB: Bring up/down networking...
Dec 14 20:43:28 <HOSTNAME> network[21930]:  Bringing up loopback interface:  /sbin/ifup-local:
 line 116: [: Cannot get device ring settings: Operation not supported
Dec 14 20:43:28 <HOSTNAME> network[21930]: 0: integer expression expected
Dec 14 20:43:28 <HOSTNAME> network[21930]: [  OK  ]
Dec 14 20:43:32 <HOSTNAME> network[21930]: Bringing up interface ens192:  [  OK  ]
Dec 14 20:43:32 <HOSTNAME> systemd[1]: Started LSB: Bring up/down networking.

Use SSH to log in to the QRadar Console as the root user.
Optional. SSH to the Managed Host if the problem occurred on it.

Result
The MAC addresses now match, and the network connectivity is restored. If the network service does not start successfully, review again the settings with your virtualization platform administrator and do this procedure again.

If network settings are correct and MAC address matches, but the network connectivity is not restored, contact QRadar Support for assistance.

Related Information

QRadar: What configurations need to be updated after replacing a system board (…

Document Location

Worldwide

Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both.

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSV4BL","label":"IBM QRadar"},"ARM Category":[{"code":"a8m0z000000cwtNAAQ","label":"Deployment"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Tips