Configure nodes
Set node label
| Product | Guardian |
| Syntax set | ids configure vi node <ip> label <label> |
| Syntax erase | ids configure vi node <ip> label |
| Description | Set the label to a node, the label will appear in the
|
| Parameters |
|
| Where | CLI |
| To apply | It is applied automatically |
| Note | You can also change this configuration from the Web UI. |
Set default live traffic label formatting
| Product | Guardian |
| Syntax | conf.user configure vi default_node_live_label
<operation>[:<param>][,<operation>[:<param>]] |
| Description | The default formatting operation(s) applied to labels coming from live traffic. More operations can be applied sequentially. See also the "Set protocol-specific live traffic label formatting" configuration for details |
| Parameters |
|
| Where | CLI |
| To apply | It is applied automatically |
Set protocol-specific live traffic label formatting
| Product | Guardian |
| Syntax | conf.user configure vi node_live_label <protocol>
<operation>[:<param>][,<operation>[:<param>]] |
| Description | Protocol-specific formatting operation(s) applied to labels coming from live traffic. More operations can be applied sequentially. |
| Parameters |
For an example, see the table below. |
| Where | CLI |
| To apply | It is applied automatically |
| Operations | Input label | Output label | Comment |
|---|---|---|---|
utf8:- |
lab¿1 ¿test¿. | lab-1 -test-. | The utf8 operation replaces not allowed characters with the
set parameter '-' |
alnum |
test1 | test1 | Unchanged because all characters are valid |
alnum |
lab,1 | lab 1 | The alnum operation replaces a not allowed character |
alnum,strict |
lab,1 | The strict operation detects a change between the initial
input 'lab,1' and the alnum output 'lab 1', the label is cleared |
|
alnum,mark,utf8,strict |
lab,1 | lab 1 | The mark operation sets alnum output (lab 1)
as default, for the following strict operation. The
utf8 operation has no effect, and strict
detects no changes so has no effect either |
prefix |
host_n.domain1.it | host_n | The prefix operation keeps only the hostname part |
Set node Device ID with priority
| Product | Guardian |
| Syntax | ids configure vi node <ip> device_id_with_priority
<device_id>;<priority> |
| Description | Adds the Device ID to the set of node Device IDs. The final Device ID, used for node grouping under Assets is the one with the highest priority |
| Parameters |
|
| Where | CLI |
| To apply | It is applied automatically |
Override node Device ID
| Product | Guardian |
| Syntax | ids configure vi node <ip> device_id_override
<device_id> |
| Description | Adds the Device ID to the set of node Device IDs, giving it the maximum priority value. This Device ID will be used for node grouping under Assets |
| Parameters |
|
| Where | CLI |
| To apply | It is applied automatically |
| Note | You can also change this configuration from the Web UI. |
Enable or disable node
| Product | Guardian |
| Syntax | ids configure vi node <ip> state
[enabled|disabled] |
| Description | This directive permits to disable a node. This setting has effect in the graph: a disabled node will not be displayed. |
| Parameters | ip: The IP address of the node |
| Where | CLI |
| To apply | It is applied automatically |
| Note | You can also change this configuration from the Web UI. |
Enable or disable same ip node separation
| Product | Guardian |
| Syntax | conf.user configure check_multiple_macs_same_ip enable
[true|false] |
| Description | This directive permits to enable the separation of L3 nodes with same IP but different MAC address. The nodes with the desired IP addresses will be treated as L2 nodes and appear as distinct assets. If the nodes already exist as L3 nodes upon the application of the configuration, they will be deleted and the new logic will start to execute with empty statistics. The values of |
| Where | CLI |
| To apply | In a shell console execute: service n2osids stop
|
Configure same ip node separation
| Product | Guardian |
| Syntax | conf.user configure check_multiple_macs_same_ip ip
<ip_address> |
| Description | Selects the ip of the nodes which should be separated as per the strategy described in the previous box. |
| Parameters | ip_address: The IP of the node to be configured |
| Where | CLI |
| To apply | In a shell console execute: service n2osids stop
|
Allow grouping into a single asset of nodes having the same IP address and distinct MAC addresses when check_multiple_macs_same_ip enable is set to true
| Product | Guardian |
| Syntax | conf.user configure check_multiple_macs_same_ip group_by_ip
[true|false] |
| Description |
Groups nodes that share the same IP address but have different MAC addresses into a single asset. This option is intended for environments with static IP addresses only. Dynamic IP networks are out of scope. |
| Parameters | The values of true or false enables, or
disables, the feature (default: false). |
| Where | CLI |
| To apply | It is applied automatically |
Require confirmed MAC addresses to separate L3 nodes with same IP but different MAC address when check_multiple_macs_same_ip enable is set to true
| Product | Guardian |
| Syntax | conf.user configure check_multiple_macs_same_ip require_confirmed_macs
[true|false] |
| Description |
When enabled, the separation of L3 nodes with the same IP address but different MAC addresses is allowed only for nodes with confirmed MAC addresses. This option is intended for environments with static IP addresses only. Dynamic IP networks are out of scope. |
| Parameters | The values of true or false enables, or
disables, the feature (default: false). |
| Where | CLI |
| To apply | It is applied automatically |
Delete node
| Product | Guardian |
| Syntax | ids configure vi node <ip> :delete |
| Description | Delete a node from the environment |
| Parameters | ip: The IP of the node to delete |
| Where | CLI |
| To apply | It is applied automatically |
Define a cluster
| Product | Guardian |
| Syntax | conf.user configure vi cluster <ip> <name> |
| Description | This command permits to define an High Availability cluster of observed nodes. In particular, this permits to: accelerate the learning phase by joining the learning data of two sibling nodes, and to group nodes by cluster in the graph. |
| Parameters |
|
| Where | CLI |
| To apply | It is applied automatically |