FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
mbenvenuti
Staff
Staff
Article Id 314831
Description This article describes how to validate Super IP change.
Scope FortiSIEM.
Solution

The recommended way to change appliance IP is by running the configFSM.sh command and navigate through the menus to apply the new IP.

But this script may get stuck because of some side customizations or an abnormal state that the normal process cannot handle. To fix that, follow the steps to check the new IP changes and eventually update the Super node manually:

 

  1. Check the current configuration:

 

From the next command from super CLI as root, check where the targeted IP is set or not:


ifconfig eth0
cat /etc/hosts
psql -U phoenix phoenixdb -c "select ip_addr from ph_sys_server where mode=2 and ( role is NULL or role = 0 );"
psql -U phoenix phoenixdb -c "select value from ph_sys_conf where property like 'svn_url%';"
cat /opt/phoenix/config/phoenix_config.txt | egrep -wi 'APP_SERVER_HOST|MON_SERVER_HOST|PARSER_SERVER_HOST|parser_server_host'

 

  1. Proceed with the changes:
  • Change Machine IP with the following commands:


nmtui
=> Edit a connection
=> Edit eth0
=> Update DNS servers
=> OK
=> Back
=> Quit
systemctl restart NetworkManager

 

  • Update /etc/hosts file with correct IP:


vi /etc/hosts

 

  • Update at the application level:


new_ip='type_your_new_ip_here'
psql -U phoenix phoenixdb -c "update ph_sys_server set ip_addr='${new_ip}' where mode=2 and ( role is NULL or role = 0 );"
psql -U phoenix phoenixdb -c "update ph_sys_conf set value = 'https://${new_ip}/svn' where property = 'svn_url';"
psql -U phoenix phoenixdb -c "update ph_health_status set host_ip='${new_ip}' where nodetype=0;"

 

  • Update APP_SERVER_HOST, MON_SERVER_HOST, PARSER_SERVER_HOST, parser_server_host value in phoenix_config.txt:

 

vi /opt/phoenix/config/phoenix_config.txt
phLicenseTool --hostip ${new_ip}

reboot