IP Configuration and IP Stack Selection

This page describes the integrated IP/interface configuration and IP stack selection capabilities available in eyeInspect v5.11 through the sdconfig utility and the underlying ei-ip command. These features replace the legacy management network interface and secondary network interface configurations and provide a unified mechanism for configuring IPv4/IPv6 networking across eyeInspect components.

IP Stack Support on eyeInspect

Although the underlying Ubuntu operating system supports dual‑stack (IPv4 and IPv6) operation, eyeInspect operates on one IP stack at a time - either IPv4 or IPv6.

Importantly, valid IPv4 configurations do not need to be removed or disabled when enabling IPv6. The OS may remain dual‑stack while the application operates on a single selected stack.

To select the IPv6 stack:

IPv6 routing must be available on the local network.
A reachable IPv6 default gateway must exist.

Note: With fresh installations or upgrades to eyeInspect v5.11 (Command Center v5.11, Passive Sensor v5.11 and Active Sensor v2.4.1), IPv6 is enabled at the kernel level automatically. This guide is applicable to all eyeInspect components.

Enable IPv6 on eyeInspect

From the main sdconfig menu, the new IP configuration and IP stack selection option allows you to do the following:

Change the network configuration to DHCP/Static - IPv4/IPv6 for all the selected network interfaces on the system (replacing the legacy management network interface and secondary network interface configurations)
Change the stack to IPv6 (IPv4 is the default stack). The following changes are applied as part of the IPv6 switch.
- Checks if IPv6 is enabled at the kernel level again (this is a fail-safe mechanism in case the eyeInspect deployer was not able to enable it due to any unforeseen reason)
- Change the firewall settings on the system
- Modify the eyeInspect Component configurations to be able to work with IPv6
- Print information necessary to do any manual changes needed for components to work effectively with IPv6

Step-by-step Guide

Note:

These steps need to be performed once per machine being used. For example, if you are running the Command Center on one machine and the Active and Passive sensors on another machine, you will need to perform the following steps once on each of the two machines.
This guide is applicable to all eyeInspect components: Command Center, Active and Passive sensors.

From the main sdconfig menu, select IP configuration and IP stack selection. Alternatively, run the following commands:
```
sudo sdconfig
Select IP Configuration and IP Stack Selection
Click OK
```
Upon accessing IP configuration and IP stack selection from the main sdconfig menu, the system switches from the sdconfig text-user interface to the system CLI.
The first message displays the current stack selection. None indicates the default (IPv4).
The system then checks if IPv6 is enabled at the kernel level. If the eyeInspect deployers did not enable IPv6 at the kernel level for any reason, this fail-safe mechanism will fix the issue. A reboot may be required if IPv6 was previously disabled at the kernel level and has been enabled by this process.
On systems with:
1. a single network interface, accessing IP configuration and IP stack selection immediately opens the current configuration for that device.
2. multiple network interfaces, accessing IP configuration and IP stack selection opens the device selection menu. Devices are listed in order and can be selected by their index key. Select the required device.
Next, you are asked to choose between DHCP or static addressing for the selected interface.
Upon choosing static addressing, on-screen commands provide information on how to enter the following:
1. IP addresses
2. IPv4 and IPv6 default gateways
3. Nameservers
Next, enter whether you want to enable DHCP for IPv4, IPv6, both or none.
The system then asks whether you want to edit more interface configurations.
1. If necessary, choose yes here to re-edit the information of the network interface.
2. If not, after you confirm that you do not want to edit more interface configurations, the system displays the entered configuration for your review.
You can now choose to apply the displayed configuration, or restore the previous one.
If you proceed with apply, the next option allows you to enable IPv6 on the stack:
1. To remain on IPv4, select n (no change).
2. To switch to IPv6, select 6.
After switching the IP stack, if the network parameters have changed, the current SSH connection will no longer be available. In such cases, re-login using a new SSH session.

Next Steps after changing IP stack

After making the changes to the IP stack, the passive and active sensor configurations might need to be reviewed to ensure that the command center IP address is reachable:

To review the passive sensor configuration, use the nidstool command. Go to the Manage Passive Sensors via nidstool page to learn more.
To review the active sensor configuration, open the /opt/active-sensor/.env and manage-containers.sh files and edit them if necessary.

If you previously had two Command Centers in replication mode and have now changed the IP stack to IPv6, you will need to disable and re-enable replication using the new IPv6 addresses. Refer to the following pages for more information:

Logs

Logs generated for the above steps are written to the /var/log/eyeinspect/ip-configuration.log file.

(Optional) Enable eyeInspect to operate in IPv6 mode only

Note: If you want to operate eyeInspect in IPv6 mode only, follow the recommendations in this section. This is optional.

Upgrade the systems to eyeInspect v5.11 using the eyeInspect upgrade guide.
After IPv6 addressing and routing is enabled, make the switch on the IP stack from IPv4 to IPv6 on the required systems.
Configure the systems to use IPv6 stack following the instructions in the Step-by-step section on this page. Do this for all relevant eyeInspect components in use - Command Center, Passive Sensor and Active Sensor.
Keep IPv4 addressing and routing enabled along with the IPv6 address.
Note: This step is necessary to preserve fall-back network communication until all operations have been verified in IPv6.
If desired, perform a test by disabling IPv4 entirely on a single instance of each eyeInspect component (Command Center, Passive Sensor and Active Sensor), preferably on systems that are physically accessible or equipped with iDRAC or other OOB management capabilities.
Once IPv4 addressing is removed and it is verified that all the components are working as desired on the test systems, apply the same procedure on the remaining systems with similar network configuration. This completes the switch to systems operating purely in IPv6 mode.

Troubleshooting

If you encounter an issue with the message The current configuration for <interface> is invalid. Please execute [sudo] netplan get all to show it and address it, it is likely due to permission issues in the YAML file(s) in the /etc/netplan folder. Fix this by running the following command:
```
sudo chmod 600 /etc/netplan/*.yaml
```
If selecting the IP configuration and IP stack selection option does not open a CLI console to proceed, remove the /run/ei-ip.lock file and try again. To do this, run the following command:
```
sudo rm /run/ei-ip.lock
```