FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
Andy_G
Staff
Staff
Article Id 195707

Description
This article will describe how to change the IP address of a Virtual Appliance

Solution version 6.x 


configFSM.sh

Choose no time zone change, and type of Target <S|W|C>
And then
change_network_config 
And <Next> ...
til
<Run>

Solution version 5.x

Here is a step by step guide. 

1. Run a script to change IP as below

      1.1 Please log into AO using a local console, do not do this through ssh as the connection will fail after the IP changes

      2.2 Go to the following directory 

#cd /opt/phoenix/deployment/jumpbox

      1.3 Run:

#./vami_set_phip.py

       Enter new IP when prompt "Input hostip"

2.Check the following and make the proper changes which will be needed for the update:

2.1 Verify Hostname + IP are correctly change
a. Verfiy Hostname has Changed: “hostname” at linux prompt should return <New Hostname>.
b. Check /etc/hosts, There should be an entry as:   <New-IP> <New Hostname>.
c. Check /etc/sysconfig/network-scripts/ifcfg-eth0 has same values as those entered in step 1c.
 
2.2 Verify License Now Matches with the following command: 
#phLicenseTool --verify
 
2.3 Go to the following directory and edit phoenix_config.txt
#cd /opt/phoenix/config/
#vi phoenix_config.txt
 
2.4 Search and Replace <Old-IP> with <New-IP>
 
2.5 Change values in CMDB by entering the following commands:
#su postgres
#psql -U phoenix -d phoenixdb
 
Note svn_url row likely has a value of previous IP Address. Change this by:
=> select * from ph_sys_conf where property=’svn_url’;
=> update ph_sys_conf set value=’http://<New-IP>/repos/cmdb’ where property=’svn_url’;
=> select * from ph_sys_server where id='1';
 
Note ip_addr column likely has value of <Old-IP>. Change this by:
=> update ph_sys_server set ip_addr=’<New-IP>’ where id=’1’;
=> \q

If there are workers, the rows in ph_sys_server entries in ph_sys_server also have to be changed to the correct IPs

2.6 Reboot and contact FortiSIEM Support to reset the license.

2.7. Re-Register the FortiSIEM-VA again after the license is reset

2.8 SSH into the FortiSIEM-VA after the registration process.

2.9 phstatus command should show all process as up.

2.10 Log into GUI, check admin->Cloud Health. This should match values given by phstatus. Should also display the new hostname and new host ip.

3. If the admin need to move the appliance into a completely different network segment, please follow the additional steps.
 
3.1 Configure Network From VM Console

3.2 Log Into ESX Host. Bring up Console on the FortiSIEM VA.

3.3 Select Configure Network.

3.4 Enter the correct Host IP, Network Mask, Gateway, and DNS Servers.
 
3.5 Configure Proxy If Needed.
 
3.6 Enter the Correct Host Name.
 
3.7 When Prompted for “Mount Point”, DO NOT ENTER ANYTHING, use Control-C to Escape.


 
Contributors