IBM Support What's New?

Multi-homed Host Protection for Windows Server agent does not report the expected IP address

Technote (troubleshooting)


Problem(Abstract)

You may find that your multi-homed Host Protection for Windows Server agent is not reporting the expected IP address to SiteProtector.

Cause

The agent chooses the first IP in the Windows binding order to use as the reported Agent IP.

Resolving the problem

You can manually set the Agent IP value by adding the following tuning parameter to the sigs.ini file on the agent itself:

agent.ip = ip_address

Example: On a system that has multiple adapters listening on 192.168.1.2 and 172.16.10.100, you could fix the agent.ip value to one or the other by adding either of the following parameters to the sigs.ini file:

agent.ip = 192.168.1.2

or

agent.ip = 172.16.10.100

Notes:

  • There is no method to modify the sigs.ini file from SiteProtector; as such this change must be made manually on each agent.
  • If your sigs.ini file is encrypted, you will need to disable Encrypt configuration files in the Administration policy under Agent Protection, push this policy to the agent, and modify the plain-text policy while the sensor is stopped. Encrypt configuration files can be re-enabled afterward and the changes will be retained in the encrypted version of the file.
  • Currently there is no way to configure the agent to use a DHCP address assigned to a given interface.



Document information

More support for: IBM Security Host Protection
Windows Server

Software version: 2.2.2

Operating system(s): Windows

Reference #: 1614038

Modified date: 2013-02-20