Hello Community,

I'm an instructor and create many QRadar SIEM labs for my students.  We use VMWare to host our labs and I have found that when I create a template from a working QRadar appliance and then deploy copies of it, the network information is gone when they come online.  Then I need to re-provision it using the qchange_netsetup command.  This is time consuming for the hundreds of VMs I create each year.  Just wondering if anyone can shed some light on how to resolve this.  I am currently using QRadar version 7.4.3 FixPack 5.

Regards,

Ben

Hi Ben,

Are the /etc/sysconfig/network-scripts/ifcfg-xxx files populated on the new machines?

Is the MAC address in  those files set correctly if they are?

You may have to change it manually.

Connect to vCenter Server using the vSphere Client Right-click the virtual machine and click Edit Settings. Click Network adapter and note the MAC Address.

For example, you see a MAC Address similar to:

xx:xx:xx:xx:xx:xx

1.Power on the Linux virtual machine.

2.Open a console and log in as root.

3.Change directory to etc/sysconfig/network-scripts.

4.Edit ifcfg-eth0 using a plain text editor and update the MAC address to reflect the MAC address in Step 3.

Thanks

Thanks John,

That is definitely the issue as it has the old MAC address in the config file.  Changing the file and rebooting brings the new VM onto the network.  This is still a manual fix, but may be fast than running qchange_netsetup.  I'll see if I can automate this step.

Regards,

Ben