QRadar: Migrating QRadar appliances from 1 Gb Ethernet Interface to 10Gb Fibre

Answer

QRadar administrators should follow the steps below to migrate from 1 Gigabit Ethernet Interface to 10Gb Fibre.

1 Remove the HA Cluster on the Managed Hosts
2 Remove QRadar Managed Hosts from the Deployment
3 Remove the HA cluster on your QRadar Console
4 Reconfigure Interfaces on the Console and Managed hosts
5 Readd HA to the Console
6 Readd Managed Hosts to Deployment
7 Readd HA to Managed Hosts

Note: If you do not have HA appliances, skip the sections on HA and proceed to the next section. The steps on HA relate to HA appliance configurations only.

1 - Remove the HA Cluster on the Managed Hosts

Repeat this section for any Managed Host HA clusters that are being moved to 10 Gb Fibre.
1. Log in to the QRadar User Interface.
2. Go to the Admin tab.
3. Click System and License Management.
4. Select the HA cluster that you want to remove.
5. From the toolbar, select High Availability > Remove HA Host.
   
6. Click OK.
Note: The Managed Host system will restart when HA is removed.

2 - Remove QRadar Managed Hosts from the deployment

Repeat this section for any managed hosts that are being moved to 10 Gb Fibre.
1. Log in to the QRadar User Interface.
2. Go to the Admin tab.
3. Click System and License Management.
4. From the host table, select the host that you want to remove.
5. Click Deployment Actions > Remove Host.
   
6. Confirm the changes by clicking Remove in the dialog window.
7. Click Deploy Changes when Remove Host completes.

3 - Remove HA on your QRadar Console

1. Log in to the QRadar User Interface.
2. Select the Admin tab.
3. Click System and License Management.
4. From the host table, select the Console HA cluster.
5. From the toolbar, select High Availability > Remove HA Host.
   
6. Click OK.
Note: The system will restart when completed.

4 - Reconfigure interfaces on the Console and Managed Hosts

Repeat this section on each appliance that you are migrating to a 10 Gb Fibre connection.
1. Log in to the system as root via SSH connection.
2. Run the following command /opt/qradar/bin/qchange_netsetup
3. Select Next until you come to the Management interface page.
4. Use the direction keys to move the selection to 10 Gigabit interfaces.
5. Select Next.
6. Select Finish.
Note: The system will restart when qchange_netsetup is complete.

5 - Readd HA to the Console

1. Log in to the QRadar User Interface.
2. Select the Admin tab.
3. Click System and License Management.
4. From the host table, select the Console.
5. From the toolbar, select Actions > Add HA Host.
6. Click OK in the Confirm pop-up window.
7. Click Next on the Welcome Screen.
8. Add all relevant information in the HA Wizard and click Next.
9. Click Finish.
Note: The system will restart when HA is added.

6 - Readd Managed Hosts to Deployment

1. Log in to the QRadar User Interface.
2. Click System and License Management.
3. Click Deployment Actions > Add Host.
4. Add all relevant information and options.
5. Click Add
6. When Add Managed Host finishes, click Deploy Changes.

7 - Readd HA to Managed Hosts

1. Log in to the QRadar User Interface.
2. Select the Admin tab.
3. Click System and License Management.
4. Select the Managed Host on which you want to add HA.
5. From the toolbar, select Actions > Add HA Host.
6. Click Next on the Welcome Screen.
7. Add all relevant information in the HA Wizard and click Next.
8. Click Finish.
Note: The system will restart when HA is added.