{"action":"created","issue":{"url":"https://api.github.com/repos/wazuh/wazuh/issues/3674","repository_url":"https://api.github.com/repos/wazuh/wazuh","labels_url":"https://api.github.com/repos/wazuh/wazuh/issues/3674/labels{/name}","comments_url":"https://api.github.com/repos/wazuh/wazuh/issues/3674/comments","events_url":"https://api.github.com/repos/wazuh/wazuh/issues/3674/events","html_url":"https://github.com/wazuh/wazuh/issues/3674","id":468962313,"node_id":"MDU6SXNzdWU0Njg5NjIzMTM=","number":3674,"title":"Due to Wazuh Duplicated IP,agent install fail","user":{"login":"xufengnian","id":15324125,"node_id":"MDQ6VXNlcjE1MzI0MTI1","avatar_url":"https://avatars1.githubusercontent.com/u/15324125?v=4","gravatar_id":"","url":"https://api.github.com/users/xufengnian","html_url":"https://github.com/xufengnian","followers_url":"https://api.github.com/users/xufengnian/followers","following_url":"https://api.github.com/users/xufengnian/following{/other_user}","gists_url":"https://api.github.com/users/xufengnian/gists{/gist_id}","starred_url":"https://api.github.com/users/xufengnian/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xufengnian/subscriptions","organizations_url":"https://api.github.com/users/xufengnian/orgs","repos_url":"https://api.github.com/users/xufengnian/repos","events_url":"https://api.github.com/users/xufengnian/events{/privacy}","received_events_url":"https://api.github.com/users/xufengnian/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2019-07-17T03:08:05Z","updated_at":"2019-07-17T11:03:10Z","closed_at":null,"author_association":"NONE","body":"|Wazuh version:3.9.2-1\r\n|Component: Wazuh-manager\r\n|Install type:Manager\r\n|Install method:Packages\r\n|Platform|CentOS 7.5\r\n\r\nHello,I installed Wazuh-Manager in my company network ,ip is 192.168.10.31\r\n\r\nAnd I try to install Wazuh-Agent in my  Vmware host ,Vmware use  NAT to join  the  network. My host  AAA's ip is  192.168.248.163 ，agent name is “aaa”. And  my  host  real  ip  is 192.168.25.66.The  kibana  Wazuh app show  the  ip  is  192.168.25.66 not    192.168.248.163. I think Wazuh-Manager just  use  my  connection  ip  not   interface  ip\r\n\r\nSo, When I try  to  install Wazuh-Agent in my  other  Vmware host  like bbb, ip  is  192.168.248.142. The  agent  AAA  just  vanished. I lookup the Manager  log.I find  if I install agent \"bbb\",the \"aaa\" is  Authentication error.SO when I  visit Kibana Wazuh APP, the page show me the agent just only \"bbb\"\r\n\r\n![image](https://user-images.githubusercontent.com/15324125/61343531-a0e2a900-a880-11e9-85a3-847c16f2b401.png)\r\n\r\n![image](https://user-images.githubusercontent.com/15324125/61343603-f1f29d00-a880-11e9-8e55-c7ece3ade7fb.png)\r\n\r\nI visited the Manager host directory \"/var/ossec/queue/agent-info\",there is only bbb-agent file,and filename's ip is my  host real ip.The file content show me the ip is interface\r\n\r\n![image](https://user-images.githubusercontent.com/15324125/61343651-164e7980-a881-11e9-9cf9-21249906e796.png)\r\n\r\nI try to edit the ossec.conf.set the \"force_insert\" to \"no\" and set the \"force_time\" to \"-1\",then I restart the Wazuh-manager\r\n\r\n![image](https://user-images.githubusercontent.com/15324125/61343747-7b09d400-a881-11e9-96ae-1c5083661231.png)\r\n\r\nBut it's useless,when I try to restart aaa agent, the log tell me Server not reply\r\n\r\n![image](https://user-images.githubusercontent.com/15324125/61343845-d340d600-a881-11e9-9a4a-01aee2077781.png)\r\n\r\nI try to reinstall the wazuh-agent in aaa,but also tell me \"ERROR: Duplicated IP: 192.168.25.66 (from manager)\"\r\n\r\n![image](https://user-images.githubusercontent.com/15324125/61343907-fcf9fd00-a881-11e9-80e6-0fffdc216fac.png)\r\n\r\nSo I don't know how to solve the question.I think it's normal for some host. These hosts could not connect the manager host directly.To connect the manager host,it will use proxy host like nginx or danted. If Wazuh manager just use agent  connection ip not interface ip,these hosts will not connect to manager ip,because these hosts's connection ip are proxy host's ip. I just want to know what can I do in this situation.thx!\r\n\r\nI hope receive your reply soon~~\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/wazuh/wazuh/issues/comments/512207663","html_url":"https://github.com/wazuh/wazuh/issues/3674#issuecomment-512207663","issue_url":"https://api.github.com/repos/wazuh/wazuh/issues/3674","id":512207663,"node_id":"MDEyOklzc3VlQ29tbWVudDUxMjIwNzY2Mw==","user":{"login":"Zenidd","id":14923294,"node_id":"MDQ6VXNlcjE0OTIzMjk0","avatar_url":"https://avatars3.githubusercontent.com/u/14923294?v=4","gravatar_id":"","url":"https://api.github.com/users/Zenidd","html_url":"https://github.com/Zenidd","followers_url":"https://api.github.com/users/Zenidd/followers","following_url":"https://api.github.com/users/Zenidd/following{/other_user}","gists_url":"https://api.github.com/users/Zenidd/gists{/gist_id}","starred_url":"https://api.github.com/users/Zenidd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Zenidd/subscriptions","organizations_url":"https://api.github.com/users/Zenidd/orgs","repos_url":"https://api.github.com/users/Zenidd/repos","events_url":"https://api.github.com/users/Zenidd/events{/privacy}","received_events_url":"https://api.github.com/users/Zenidd/received_events","type":"User","site_admin":false},"created_at":"2019-07-17T11:03:10Z","updated_at":"2019-07-17T11:03:10Z","author_association":"MEMBER","body":"Hi @xufengnian,\r\n\r\nThis behavior is common on Multiple VMS on one host environments:\r\n\r\n- Inside the VM scenario, each machine has its own IP but from the host side, the have the same IP. You can read more about on this [stackexchange thread](https://unix.stackexchange.com/questions/29999/why-are-my-two-virtual-machines-getting-the-same-ip-address)\r\n\r\n- If from the host's point of view we see the same IP for this VM's, from outside the host we only see the host's IP.\r\n\r\nIn your situation a small change in the `<auth>` configuration block of should solve your problem:\r\n\r\nPlease, change `<use_source_ip>` to \"no\" and let `<force_insert>` and `<force_time>` with their default values. The further example has the needed values.\r\n```\r\n<auth>\r\n    <disabled>no</disabled>\r\n    <port>1515</port>\r\n    <use_source_ip>no</use_source_ip>\r\n    <force_insert>yes</force_insert>\r\n    <force_time>0</force_time>\r\n    <!-- other auth tags -->\r\n```\r\n\r\nPlease, let me know if it helps. Don't hesitate to write to us again if it doesn't work and we'll look for another solution.\r\n\r\nGreetings, Juan Pablo Sáez"}}
{"actor":{"display_login":"Zenidd"}}