Introduction
Seconion is a powerful platform for network security monitoring, but deploying it in airgap environments can present unique challenges. This post explores a specific issue encountered when converting a Seconion instance to QEMU for use in Cisco Modeling Labs (CML). During the conversion process, network adapter names became unlabeled, causing the installation to fail. Here, we outline the steps taken to resolve this issue by renaming the adapters to ens3 and ens4 and ensuring a successful installation.
Prepping the Airgap Seconion for QEMU
In airgap scenarios, the Seconion instance is initially prepared without internet access. This requires a complete offline installation with all necessary packages and dependencies pre-downloaded. Once the Seconion environment was ready, it was converted to QEMU format using standard conversion tools to integrate it into CML. However, after booting the QEMU instance, it was discovered that the network adapters were not labeled correctly.
Identifying Network Adapter Issues
Upon inspecting the network configuration using the nmcli command, we noticed that the network adapters appeared as generic Wired_Connection_1 and Wired_Connection_2. This generic naming prevented Seconion from correctly identifying its primary and secondary network interfaces, halting the installation.
Command to check the connections:
nmcli connection show
Example output:
NAME UUID TYPE DEVICE
Wired_Connection_1 a123b456-c789-012d-345e-67890fghij12 ethernet eth0
Wired_Connection_2 b987c654-d321-432f-654e-12345abcde98 ethernet eth1
Renaming Network Adapters to ens3 and ens4
To resolve the issue, we needed to manually rename these connections. First, we identified the UUIDs of the connections. Then, we proceeded with renaming the adapters:
Renaming Wired_Connection_1 to ens3:
sudo nmcli connection modify a123b456-c789-012d-345e-67890fghij12 connection.id ens3
Renaming Wired_Connection_2 to ens4:
sudo nmcli connection modify b987c654-d321-432f-654e-12345abcde98 connection.id ens4
Verifying and Activating the Connections
After renaming, we verified the new names using:
nmcli connection show
Expected output:
NAME UUID TYPE DEVICE
ens3 a123b456-c789-012d-345e-67890fghij12 ethernet eth0
ens4 b987c654-d321-432f-654e-12345abcde98 ethernet eth1
Next, we activated the connections:
sudo nmcli connection up ens3
sudo nmcli connection up ens4
Restarting Seconion Installation
With the network adapters properly labeled as ens3 and ens4, the Seconion installation could proceed. After a final verification of network connectivity:
ip addr
ping -c 4 8.8.8.8
The installation completed successfully, confirming that the manual adapter renaming was the key step in resolving the issue.
Conclusion
Network adapter naming consistency is crucial when deploying Seconion in airgap environments and converting it to QEMU for CML integration. By manually adjusting the adapter names to ens3 and ens4, we ensured that the installation could proceed without further issues. This approach can be a valuable reference for similar deployments in isolated network environments.
For further reading, consider exploring documentation on QEMU network adapter configurations and Seconion deployment best practices.