Suricata issue in PFSense
-
@sstatjm said in Suricata issue in PFSense:
Okay, that shows everything is running on the same underlying single physical interface -
ix1
. Your two VLANs are running on virtual interfacesix1.50
andix1.60
.The first thing to check is that the Promiscuous Mode checkbox on the INTERFACE SETTINGS tab is NOT checked on all three interfaces: LAN, iOT, and Trejah. If you make any change to any of these interface settings, restart Suricata on the affected interface.
Promiscuous Mode would be the most likely cause of seeing an IP address on an interface where you do not normally expect it. It's also possible that you have a port misconfiguration in your managed switch. A third possibility is something changed with regards to promiscuous mode upstream in the Suricata binary, but I am not aware of any issues being reported there. Nothing has changed around that code in the PHP GUI in eons (that I can recall).
If this is a sudden change in behavior, then I would first suspect an issue in the Layer 2 infrastructure. Maybe a port was mistakenly misconfigured on the switch, or somebody plugged something into the wrong switch port ???
-
@bmeeks Suricata is restarted. Promiscuous mode is unchecked. Nothing connected incorrectly to switch.
-
@sstatjm said in Suricata issue in PFSense:
@bmeeks Suricata is restarted. Promiscuous mode is unchecked. Nothing connected incorrectly to switch.
If you want to share the alerts in question, me having a look at them might be helpful. I would also need to know the IP subnets you have assigned to each interface: LAN, iOT, and Trejah. I assume those are RFC1918 space, so there would be no security concerns with sharing the IP subnets as those are non-routable on the Internet anyway.
-
All this is on LAN interface with the .60.50 which is VLAN 60 sources showing in there.
-
Curious, so no
192.168.50.x
entries show up on the LAN, or did you just not include them as they may be expected?The most straightforward explanation is that promiscuous mode is enabled even if not explicitly showing as such in the GUI.
From one of your earlier replies I got the impression this behavior just suddenly started happening, and prior to that you never saw
192.168.60.50
addresses in alerts on the LAN. Is that correct?Has anything changed in your environment that might coincide with this change in behavior? Promiscuous Mode can't just turn on by itself with no user action. Have you updated any software or firmware either on pfSense or in the managed switch infrastructure? Might a port VLAN setting have been accidentally altered?
If you can, try rebooting the firewall to be sure there are no duplicate Suricata processes running that may still have promiscuous mode enabled. In rare cases multiple Suricata instances can get started on the same interface, and then all but the most recently launched one stop responding to configuration changes. Running this command can show if any duplicates are running:
ps -ax | grep suricata
You should see one Suricata instance per interface, so four instances for you counting your WAN.
-
@bmeeks I must have missed that for the iOT. I will reboot the pfsense then. I have made no changes recently. Promiscous mode is off. I dont have WAN running suricata
-
@sstatjm reboot is done so will see if it still show up in there again.