Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've configured a KVM host on a new Ubuntu 9.10 x64 server installation, and am having trouble getting an OSSIM (snort+nagios+openvas on debian Lenny) installation going as a guest. I've configured the 2 NICs on the host in /etc/network/interfaces as follows:

auto eth0
iface eth0 inet manual
auto br0
iface br0 inet static
        address 192.168.1.242
        netmask 255.255.255.0
        network 192.168.1.0
        broadcast 192.168.1.255
        gateway 192.168.1.1
        bridge_ports eth0
        bridge_stp off
        bridge_maxage 12
        bridge_fd 9
        bridge_hello 2

auto eth1
iface eth1 inet manual
auto br1
iface br1 inet static
        address 192.168.1.243
        netmask 255.255.255.0
        network 192.168.1.0
        broadcast 192.168.1.255
        bridge_ports eth0
        bridge_stp off
        bridge_maxage 12
        bridge_fd 9
        bridge_hello 2

br0 will be used for the management/web interface of the OSSIM installation, and br1 is connected to the monitor port on the network switch. I'm having a problem getting OSSIM to use eth0 > br0 for management and eth1 > br1 as the interface to listen on. I've defined br0 and br1 in the KVM guest during virt-install:

virt-install --vnc -n ossim -r 3000 --vcpus=1 --os-type=linux
  --hvm --accelerate --network=bridge:br0 --network=bridge:br1
  -c ~/isos/alienvault-ossim-installer-2.1.amd64.iso -f ~/imgs/ossim.qcow2 -s 40

I've tried configuring the interfaces in OSSIM after installation both by both running ossim-setup and by editing the guest's /etc/network/interfaces file directly. I end up with either a duplicate IP address error on my network for the address I assign to eth0 in the OSSIM guest, or the sensors (snort, etc) can't see traffic on eth1, or both. I assume this has something to do with having both br0 and br1 plugged into the same network switch and assigned addresses?

Anyone have any suggestions for how to make this work? Other KVM guests work fine on br0; since I don't need br1 (the device attached to the monitoring port) for any of the other guests is it possible to undefine br1/eth1 on the host and do a direct passthrough of the NIC device (intel PCI-e) to the guest? Thanks for any assistance.

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.