Hello to everyone,

I've installed QRadar Community Edition on a Google Cloud VM but I can't figure out how to make the internal networking works.

Here's my issue: I got some VM's on the same subnet as QRadar, one of them is a firewall connected via VPN to another infrastructure, every machine is able to ping the others but QRadar's one. GCP gives you IPs with a /32 mask and, obviously, the gateway is outside that subnet. Before installing QRadar the VM is able to ping and being pinged but after the installation it is unable to ping anything but it's pingable from the other VMs.

I've tried to change network settings before the installation, changing the mask to /24. The results is that after the installation the machine is able to ping only the gateway, internet, but it's unable to ping the other VMs on the subnet and it isn't pingable from the other VMs.

I've also tried to use the command qchange_netsetup but it doesn't work on GCP serial console because the screen goes to black and I can't see anything.

Someone could help me?

Anyone as already installed the QRadar CE on GCP?

Thank you

Matteo

Hi Matteo,

if I understand correctly, you want to ping qradar..

By default, qradar cannot be pinged. This can be changed in iptables.pre...

Maybe this documentation will assist you...

https://www.ibm.com/docs/en/qradar-on-cloud?topic=tasks-advanced-iptables-rules-examples

Regards,

Ralph