000036902 - MAC Address Error After Moving VMWare Virtual Machine in RSA NetWitness Logs & Network

Document created by RSA Customer Support Employee on Nov 2, 2018
Version 1Show Document
  • View in full screen mode

Article Content

Article Number000036902
Applies ToRSA Product Set: NetWitness Logs & Network
RSA Product/Service Type: Security Analytics Server
RSA Version/Condition: 10.6.x, 11.x1
O/S Version: CentOS 6, CentOS 7. VMWare
IssueLicensing Question Due to Virtual MAC Change

You may encounter an error when migrating or moving a VMWare virtual machine between clusters or hosts. 
This can sometimes result in a MAC address change which affects licensing which is associated with the original MAC address of the Security Analytics 10.6 or NetWitness Node 0 host.
ResolutionIf you are unable to change the MAC address back to the initial value you may need to modify the VMX file associated with the virtual machine.

It looks like there is a special range of VMWare MACs in the 00:0c:29 range.

The solution is to edit the .vmx file for the virtual machine and add the following line:

ethernet0.checkMACAddress = "false"

Following is a sample .vmx file for static mac address.  Adding the 4th line will enable you to modify the MAC address through the vSphere client to the original value.  

1 ethernet0.networkName = "LAN"
2 ethernet0.addressType = "static"
3 ethernet0.present = "TRUE"
4 ethernet0.checkMACAddress = "false"
5 ethernet0.address = "00:0C:29:01:2A:B3"

See this VMWare link for additional information:
WorkaroundIf editing the .vmx file is not an option it is possible to resolve the problem through RSA Download Central.

Login to your Download Central account, locate the original license server, unmap all the add-ons assigned, create a new license server, and map all the add-ons to the new license server. Download a new BIN file and apply it to the new license server.