Use bonding to increase the available bandwidth or the fault tolerance of your IBM®
QRadar® appliances by combining 2
or more network interfaces into a single channel.
Before you begin
Note: The QRadar appliance
network management interface, including bonding options, is configured only at the UNIX shell prompt during setup.
Configure the management interface on a QRadar
Console before you add a managed host.
See Configuring bonded
management interfaces for more information about configuring the management interface.
You can't bond an existing slave interface. You can bond management interfaces only at the shell
prompt. You can bond crossovers from the High Availability (HA) configuration
screen.
Procedure
-
On
the navigation menu (
), click
Admin.
-
In the System Configuration section, click .
-
From the Display menu, click Systems.
-
Select the host for which you want to configure network interfaces.
-
Click , and click the Network Interfaces tab.
-
To edit a network interface, follow these steps:
-
Select the device that you want to edit, and click Edit.
-
In the Role list, select the role for the device:
- Choose Regular when the device is used for:
- Data collection (logs/flows(NetFlow/s Flow))
- Web UI
- Backup/restore (not limited to iSCSI but can be NFS)
This interface must have an IP address. The subnet of the interface cannot be the same
subnet used by the management interface.
Tip: Log sources that use the
TCP protocol might experience asymmetric routing. If your log sources use the
UDP protocol, they are not affected.
- Choose Monitor when the device is a IBM
QRadar Flow Collector that is used for
packet collection. This interface does not require an IP address.
- Choose Disabled to prevent the device from being used for any network
connectivity.
-
To apply the configuration to the active HA node, click Apply this interface
configuration and IP address to the active HA node.
-
Click Save.
-
To create a bonded network interface, follow these steps:
You can bond two or more interfaces that have either a regular or monitor role that is assigned
to them. You can bond only interfaces that are assigned the same roles.
-
Select the device and click Bond.
-
Type the IP address and netmask.
-
To apply the configuration to the active HA node, click Apply this interface
configuration and IP address to the active HA node.
Note: By selecting this option, you keep the interface active on whichever of the two
high-availability (HA) nodes is active. You can use this option on an interface that is used to
receive inbound data, such as syslog messages or netflow data records. This option migrates data
between the primary and secondary nodes, to whichever one is active.
-
Enter a bonding option. The default bonding option that is configured on this interface is
mode=4.
Note:
Bonded interfaces support various modes of operation, depending on the capabilities of the switch
that they are connected to. The following table describes the supported bonding modes that you might
use.
Table 1. Bonding
modes
Bonding modes |
Bonding name |
Description |
mode=1 |
Active backup |
Only one slave is active. Another slave becomes active when the active slave fails. |
mode=4 |
802.3ad |
Uses Link Aggregation Control Protocol (LACP) to create aggregation groups that share duplex
settings and speed. |
For more information about configuring specific bonding options, see your vendor-specific
operating system documentation.
-
Click Add and select the interface that you want to add as a slave, and
then click OK.
-
Click Save to create your bonded interface.
-
To break a bonded interface back into single interfaces, select the bonded device, and then
click Unbond.
What to do next
If the connection doesn't work when you configure your bonded interface settings, use SSH to log
in to the host, and look in the /var/log/message log file for any network
interface errors.
You can also try changing the setting to mode=1, or you can physically disconnect all but one of
the Ethernet connections in the bonded interface group. If this workaround works, verify that your
switch infrastructure supports the mode that you are trying to use. Switches don't always support
mode=4.