In order for all components to work properly afterwards, changing the admin IP address of an AlienVault USM Appliance Sensor must be done through the web UI. The option is available under Configuration > Deployment > AlienVault Center > System Details > Network Configuration.
Warning: If done through CLI on the USM Appliance Sensor directly, the actual admin IP of the sensor will be changed, however those changes will not be reflected on the USM Appliance Server that the sensor is connected to, resulting in loss of connectivity to it. (The AlienVault API on the server will not be updated and will not be able to access the sensor.)
Once done, the change of the IP address will affect all IP-related functionality of the USM Appliance Sensor. That includes but not limited to:
- Events not sent to the USM Appliance Server, if any, will be lost.
- The log collection ability of the USM Appliance Sensor. All devices that have been configured to forward logs to it (for example, through Syslog, HIDS, Snare), will have to be reconfigured manually.
- HIDS and Snare agents, if using, need to be reconfigured to reflect the IP change or they will have to be redeployed through the web UI.
Other functionality such as VPN connectivity, NetFlow graphs, vulnerability scanning should not be affected.