I've configured a KVM host on a new Ubuntu 9.10 x64 server installation, and am having trouble getting an OSSIM (snort+nagios+openvas on debian Lenny) installation going as a guest. I've configured the 2 NICs on the host in /etc/network/interfaces as follows:
auto eth0 iface eth0 inet manual auto br0 iface br0 inet static address 192.168.1.242 netmask 255.255.255.0 network 192.168.1.0 broadcast 192.168.1.255 gateway 192.168.1.1 bridge_ports eth0 bridge_stp off bridge_maxage 12 bridge_fd 9 bridge_hello 2 auto eth1 iface eth1 inet manual auto br1 iface br1 inet static address 192.168.1.243 netmask 255.255.255.0 network 192.168.1.0 broadcast 192.168.1.255 bridge_ports eth0 bridge_stp off bridge_maxage 12 bridge_fd 9 bridge_hello 2
br0 will be used for the management/web interface of the OSSIM installation, and br1 is connected to the monitor port on the network switch. I'm having a problem getting OSSIM to use eth0 > br0 for management and eth1 > br1 as the interface to listen on. I've defined br0 and br1 in the KVM guest during virt-install:
virt-install --vnc -n ossim -r 3000 --vcpus=1 --os-type=linux --hvm --accelerate --network=bridge:br0 --network=bridge:br1 -c ~/isos/alienvault-ossim-installer-2.1.amd64.iso -f ~/imgs/ossim.qcow2 -s 40
I've tried configuring the interfaces in OSSIM after installation both by both running ossim-setup and by editing the guest's /etc/network/interfaces file directly. I end up with either a duplicate IP address error on my network for the address I assign to eth0 in the OSSIM guest, or the sensors (snort, etc) can't see traffic on eth1, or both. I assume this has something to do with having both br0 and br1 plugged into the same network switch and assigned addresses?
Anyone have any suggestions for how to make this work? Other KVM guests work fine on br0; since I don't need br1 (the device attached to the monitoring port) for any of the other guests is it possible to undefine br1/eth1 on the host and do a direct passthrough of the NIC device (intel PCI-e) to the guest? Thanks for any assistance.