QRadar: Network Bonding options in QRadar

Resolving The Problem

When bonding is configured in QRadar, there are two ways to implement bonding. The first is during the initial appliance configuration that uses the installation wizard when you set up the management interface. You cannot bond the Management Interface by using the QRadar UI. The second is using the UI in System and License Management to bond a secondary interface.

Bonding the management interface on an existing appliance

Administrators can update their IP address and change their bonding options through out-of-band management (IMM, iDRAC, and so on). SSH connections are not allowed to change IP addresses or update network configuration options for an appliance. To use qchange_netsetup, the administrator is required to remove the host from the deployment, run qchange_netsetup, then add the appliance back to the deployment.

1. Change your network setup by typing the following command: qchange_netsetup
2. Select the Internet protocol version to use for the appliance.
3. Select Yes to continue with bonded network interface configuration. 
   
4. Select interfaces to configure as bonded interfaces. The interfaces that you select must not already be bonded. 
   
5. Enter the bonding options. For more information about configuring specific bonding options, see your vendor-specific operating system documentation.
6. Update any network information settings as needed. Your appliance restarts automatically. Note: To create a hostname, see QRadar: Recommended practices for hostname creation.
7. Log in to the appliance and verify the configuration.

Bonding nonmanagement devices through the user interface

1. Log in to the QRadar user interface as an administrator.
2. Click the Admin tab.
3. Click the System and License Management icon.
4. Select the appliance with the interfaces to bond.
   
5. Click Actions > View and Manage System.
6. Click the Network Interfaces tab.
   
7. Highlight the interfaces to bond.
8. Type the IP address and the Netmask for the bonded connection.
   
9. Click Save.
    

Results
The interfaces are bonded on the QRadar appliance. The bonded interface is provided a new device name and the individual interfaces are listed in the user interface with the IP address defined by the administrator.