четвъртък, януари 25, 2024

EVE-NG on Hyper-V. External networks to EVE-NG nodes

 EVE-NG 


root@eve-ng#brctl show

bridge name     bridge id               STP enabled     interfaces

pnet0           8000.00155df1ea0d       no              eth0

                                                                              vunl0_5_0

pnet1           8000.00155df1ea26       no              eth1

                                                                            vunl0_5_1


pnet0 -> Management(Cloud0) - first ethernet added to EVE-NG VM

pnet1 -> Cloud1 - first ethernet added to EVE-NG VM

and so one 


To allow interaction of VM inside the EVE-NG with external networks (e.g., to make VM inside EVE-NG accessible from other networks and/or other VM installed in Hyper-V):

1. Enable MacAddressSpoofing per interface in Hyper-V

2. Add right ClodX to the LAB (Cloud0 == eth0; Cloud1 == eth1 ...)

3. Attach the EVE-NG Node interface to the CloudX



To setup EVE-NG on Hyper-V:


# Enable nested virtualization:

Set-VMProcessor -VMName <VMName> -ExposeVirtualizationExtensions $true

#create a local variable for easy reference later

$A=Get-VMSystemSwitchExtensionPortFeature -FeatureName "Ethernet Switch Port Security Settings"


# Get adapters assigned to a VM ### dunno why IPAddresses are not listed on all machines (!)

Get-VMNetworkAdapter -VMName 100.EVE-NG

Name            IsManagementOs VMName     SwitchName     MacAddress   Status  IPAddresses

----                  ----------- ------     ----------          ----------           ------                 -------   ----

Network Adapter False          100.EVE-NG     EXT_2          00155DF1EA0D {Ok}   {}

Network Adapter False          100.EVE-NG     Private_10     00155DF1EA26 {Ok}   {}


# Reconfigure EVE-NG vNICs

Add-VMSwitchExtensionPortFeature -ExternalPort -SwitchName EXT_2 -VMSwitchExtensionFeature $A

Add-VMSwitchExtensionPortFeature -ExternalPort -SwitchName Private_10 -VMSwitchExtensionFeature $A

# MAC address spoofing ### Иначе йок трафик (EVE-NG раздава от различен МАС пул, който е незивестен за външните мрежи)

Get-VMNetworkAdapter -VMName 100.EVE-NG | Set-VMNetworkAdapter -MacAddressSpoofing On


### Port mirroring

https://cloudbase.it/hyper-v-promiscuous-mode/

https://docs.tenable.com/nessus-network-monitor/Content/HyperVPromiscuousMode.htm