IP Conflict with docker/bridge after upgrade to 6.4.2.0

Question

Hi, 
 We just upgraded an Advanced Authentication Appliance to 6.4.2 and found that it loads with three internal IP addresses: 
 docker0 : 172.17.0.1 
 br-48f207: 172.18.0.1 
 br-ae93ab : 172.19.0.1 (this was not with the previous version) 
 
 The last one, 172.19.0.1, conflicts with another services and we've tried, without success, to follow what is indicated in this TID: https://support.microfocus.com/kb/doc.php?id=7023491 
 
 Any idea how can we change this subnet? 
 Regards

KevinS · Answer

Hello, 
 this is the solution on how to change the IPs of the docker and the bridges ;) 
 IMPORTANT: Please create a snapshot of your machine before running those commands below. AAF-DATA will stay on the machine because only network and container will be removed. 
 
 Modify /etc/docker/daemon.json, "192.168.200.0/22" is desired subnetwork in this example 
 
 sed -i 's/"ipv6"/"default-address-pools":[{"base":"192.168.200.0/22","size":25}],
 "ipv6"/' /etc/docker/daemon.json

Make sure that changes was applied 
 
 cat /etc/docker/daemon.json

Stop AAF/Risk services 
 
 systemctl stop risk-service 
 systemctl stop aauth

Check if every container is stopped
 
 docker ps 
 Sometimes the container "logspout_logspout_1" is still running, stop this container because it is using the "aaf_default" Docker network. If this container is not stopped, then the IP of the bridge will not change.
 
 docker stop logspout_logspout_1

Remove Risk services (only container and network, images & volumes will stay on the machine)
 
 docker-compose -f /opt/risk/docker-compose.risk.yml down

Remove AA services (only container and network, images & volumes will stay on the machine)
 
 docker-compose -p aaf -f /opt/aauth/docker-compose.yml down

Restart docker service 
 
 systemctl daemon-reload 
 systemctl restart docker

Start AAF & Risk
 
 systemctl start aauth risk-service

Check network interfaces settings 
 
 ifconfig

BR 
 Kevin 
 MTRIX GmbH

Luciano Testa · Answer

Hello Jos&eacute; Luis, 
 You are correct, there are three bridge networks in 6.4.2: 
 docker network ls NETWORK ID NAME DRIVER SCOPE a802e2d525a9 aaf_default bridge local 4fc594bd481b bridge bridge local 75e2569ef806 host host local e322f37dfdd5 none null local 06d816b051b3 risk_rba bridge local 
 You can also check this KB article: 
 https://support.microfocus.com/kb/doc.php?id=7025021 
 
 For the default bridge you can specify the value BIP in the daemon.json file. For any other user generated bridge networks you can define a subnet pool to pick from (provided the user does not manually specify the subnet). So your /etc/docker/daemon.json would look like: 
 {
 "bip": "10.200.0.1/24",
 "default-address-pools":[
 {"base":"10.201.0.0/16","size":24},
 {"base":"10.202.0.0/16","size":24}
 ]
} Then according to the previously mentioned article, you have to do: 
 Stop AAF/Risk services 
 
 -- 
 
 systemctl stop risk-service 
 
 systemctl stop aauth

4. Restart docker service 
 
 -- 
 
 systemctl restart docker

5. Startup AAF/Risk services 
 
 docker-compose -f /opt/risk/docker-compose.risk.yml down 
 
 systemctl start aauth

Please take a snapshot or backup before proceeding with these changes, so you can always roll back if there are issues.

Thanks. 
 Regards,

Luciano Testa

Luciano Testa · Answer

Hello Jos&eacute; Luis, 
 Well, let's try the basics, as per the KB article. Delete the bip value, then do this: 
 
 sed -i 's/"ipv6"/"default-address-pools":[{"base":"192.168.0.0/16","size":20}],
 "ipv6"/' /etc/docker/daemon.json 
 
 Or manually this line to the file: "default-address-pools":[{"base":"192.168.0.0/16","size":20}], 
 
 Then save, restart the services and docker and check again. 
 
 Thanks. 
 Regards, 
 
 Luciano Testa

Menu

Advanced Authentication Discussions

IP Conflict with docker/bridge after upgrade to 6.4.2.0

Top Replies

Suggested Answer

Suggested Answer

Resources