Using VMware workstation 16 pro do determine what the management IP and gateway should be used

[iqworks]

I am using windows 10 on my laptop for the host. And the latest SO iso "WAHZU 2.3.70".
I have been trying to get a successful install since June. I am new to cyber security and to security onion. My first install seemed to work, but i think i have tried to do about 30 or so installs since June, yes, while waiting the 30+ minutes for everything to install only to get install issues that reffered me to the sosetup and errors log files. my errors.log was always empty and i had no clue where to start looking in the sosetup.log.
But during the last two days with the help and advice from you guys i successfully installed an import, standalone and eval VM.
YEA!!
So I thought i would describe my experience and explain what i finally did.
It seems like the complete install needs good IP addresses to get information it needs from github or other places during the install.
for this

I went to my command prompt in windows 10 and got the NAT VMnet8 IPv4

for this

I went into the VMware workstation 16 pro>edit>Virtual Network Editor

and for this, i used an IP address from a VMnet that was not used elswhere, in my case i used VMnet5 (.50.)

But now I am having issues with getting the SOC to come up, but thats my new challange.
I am just hoping this can help someone.
In the mean, thanks for your help with this one.
I am putting this in the ideas categories, not sure where to put it for now.
In fact, I wish i knew this while installing from " https://docs.securityonion.net/en/2.3/first-time-users.html " for those using windows 10 host and VMware workstation 16 pro.
thanks again !!

[tientmse62290]

I think you need to learn network basic first before get into an NSM

[iqworks]

HA, how much of the basics of networking do you suggest I know to start this post? That’s right, you can’t even tell me that. I will hold my true thoughts here about your reply 😊 This post is just to try to help others using the tools I have used in order to determine the IP addresses I used to get a complete install of security onion. I was not asking for information or a tutorial from an export. I was simply suggesting something I actually did that actually helped me to achieve a successful SO install so others might Have some help. From: tientmse62290 ***@***.***> Sent: Saturday, September 25, 2021 3:59 PM To: Security-Onion-Solutions/securityonion ***@***.***> Cc: iqworks ***@***.***>; Author ***@***.***> Subject: Re: [Security-Onion-Solutions/securityonion] Using VMware workstation 16 pro do determine what the management IP and gateway should be used (Discussion #5652) I think you need to learn network basic first before get into an NSM — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#5652 (comment)> , or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABKPV335SM36U74QYJ3ZFMTUDZH2VANCNFSM5EX7VWQQ> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub> . <https://github.com/notifications/beacon/ABKPV33BT2UVR2AULP2BDXDUDZH2VA5CNFSM5EX7VWQ2YY3PNVWWK3TUL52HS4DFWFCGS43DOVZXG2LPNZBW63LNMVXHJKTDN5WW2ZLOORPWSZGOAAKSDZY.gif>

…

-- This email has been checked for viruses by AVG. https://www.avg.com

[dougburks]

If Windows is already using 192.168.80.1, then you probably don't want to assign that same IP address to your VM.

[iqworks]

I guess the fact that i see 192.168.80.1 in my ipconfig means that windows is already using it? My next choice would be 192.168.80.0/24, could i use this as my management IP?
I entered my ubuntu IP address in so-allow.
right now when i try to use 192.168.80.1 from an ubuntu browser i get a blank screen, perhaps this is because windows is using it? Then again there could be any number of reasons for that.
I cannot seem to find info about what the management IP does inside security onion so I can get a better handle on what is needed there. Can you point me to a link(s)?
thanks for your help

[dougburks]

I guess the fact that i see 192.168.80.1 in my ipconfig means that windows is already using it?

Yes.

My next choice would be 192.168.80.0/24, could i use this as my management IP?

If the subnet mask is /24, then the .0 address is usually considered to be the network address and would not be assigned to an individual device in the network.

right now when i try to use 192.168.80.1 from an ubuntu browser i get a blank screen, perhaps this is because windows is using it?

Yes, you're trying to connect to a web server on your Windows host but there is no web server there.

I cannot seem to find info about what the management IP does inside security onion so I can get a better handle on what is needed there. Can you point me to a link(s)?

Just like your Windows host and your Ubuntu VM, Security Onion needs an IP address to communicate with other hosts. For more information, please see:
https://docs.securityonion.net/en/2.3/hardware.html#nic

Finally, we've discussed previously that basic networking knowledge is a prerequisite for cybersecurity in general and that basic networking questions are beyond the scope of this discussions forum:
#5131
#5134

Unfortunately, we cannot continue to teach you networking basics in this forum. Please consider studying networking on your own time.

Thanks.

[iqworks]

Ok, I will, thanks for your help thus far. From: Doug Burks ***@***.***> Sent: Tuesday, September 28, 2021 10:08 AM To: Security-Onion-Solutions/securityonion ***@***.***> Cc: iqworks ***@***.***>; Author ***@***.***> Subject: Re: [Security-Onion-Solutions/securityonion] Using VMware workstation 16 pro do determine what the management IP and gateway should be used (Discussion #5652) I guess the fact that i see 192.168.80.1 in my ipconfig means that windows is already using it? Yes. My next choice would be 192.168.80.0/24, could i use this as my management IP? If the subnet mask is /24, then the .0 address is usually considered to be the network address and would not be assigned to an individual device in the network. right now when i try to use 192.168.80.1 from an ubuntu browser i get a blank screen, perhaps this is because windows is using it? Yes, you're trying to connect to a web server on your Windows host but there is no web server there. I cannot seem to find info about what the management IP does inside security onion so I can get a better handle on what is needed there. Can you point me to a link(s)? Just like your Windows host and your Ubuntu VM, Security Onion needs an IP address to communicate with other hosts. For more information, please see: https://docs.securityonion.net/en/2.3/hardware.html#nic Finally, we've discussed previously that basic networking knowledge is a prerequisite for cybersecurity in general and that basic networking questions are beyond the scope of this discussions forum: #5131 <#5131> #5134 <#5134> Unfortunately, we cannot continue to teach you networking basics in this forum. Please consider studying networking on your own time. Thanks. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#5652 (reply in thread)> , or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABKPV3YRPNBDIDILKF7OQALUEHY6VANCNFSM5EX7VWQQ> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub> . <https://github.com/notifications/beacon/ABKPV3ZCVMD5PSRRR2B4FJLUEHY6VA5CNFSM5EX7VWQ2YY3PNVWWK3TUL52HS4DFWFCGS43DOVZXG2LPNZBW63LNMVXHJKTDN5WW2ZLOORPWSZGOAAKVGRY.gif>

…

-- This email has been checked for viruses by AVG. https://www.avg.com

[iqworks]

I do not mean to drag you guys into answering questions about basic networking issues. Its just that for me right now, security onion and basic networking are a blur to me right now because all of this is new to me. But, I will differentiate where they both begin and end. Security onion allows you to use tools for various cybersecurity monitoring etc. I will continue to learn about those networking basics so I do not cross the lines of this forum. After all, its only a computer and only software 😊 From: Doug Burks ***@***.***> Sent: Tuesday, September 28, 2021 10:08 AM To: Security-Onion-Solutions/securityonion ***@***.***> Cc: iqworks ***@***.***>; Author ***@***.***> Subject: Re: [Security-Onion-Solutions/securityonion] Using VMware workstation 16 pro do determine what the management IP and gateway should be used (Discussion #5652) I guess the fact that i see 192.168.80.1 in my ipconfig means that windows is already using it? Yes. My next choice would be 192.168.80.0/24, could i use this as my management IP? If the subnet mask is /24, then the .0 address is usually considered to be the network address and would not be assigned to an individual device in the network. right now when i try to use 192.168.80.1 from an ubuntu browser i get a blank screen, perhaps this is because windows is using it? Yes, you're trying to connect to a web server on your Windows host but there is no web server there. I cannot seem to find info about what the management IP does inside security onion so I can get a better handle on what is needed there. Can you point me to a link(s)? Just like your Windows host and your Ubuntu VM, Security Onion needs an IP address to communicate with other hosts. For more information, please see: https://docs.securityonion.net/en/2.3/hardware.html#nic Finally, we've discussed previously that basic networking knowledge is a prerequisite for cybersecurity in general and that basic networking questions are beyond the scope of this discussions forum: #5131 <#5131> #5134 <#5134> Unfortunately, we cannot continue to teach you networking basics in this forum. Please consider studying networking on your own time. Thanks. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#5652 (reply in thread)> , or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABKPV3YRPNBDIDILKF7OQALUEHY6VANCNFSM5EX7VWQQ> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub> . <https://github.com/notifications/beacon/ABKPV3ZCVMD5PSRRR2B4FJLUEHY6VA5CNFSM5EX7VWQ2YY3PNVWWK3TUL52HS4DFWFCGS43DOVZXG2LPNZBW63LNMVXHJKTDN5WW2ZLOORPWSZGOAAKVGRY.gif>

…

-- This email has been checked for viruses by AVG. https://www.avg.com