Change IP Addresses or FQDNs for Tenable Identity Exposure Nodes

Changing the IP addresses or fully qualified domain names (FQDNs) of machines running the Storage Manager (SM), Security Engine Nodes (SEN), and Directory Listener (DL) is a required task in certain situations, such as disaster recovery testing. Using scripts to modify environment variables with the new IPs or FQDNs and to restart services is the most efficient way to perform this operation which also minimizes downtime.

To change the IP addresses or FQDN for Tenable Identity Exposure nodes:

1. If your Tenable Identity Exposure installation type uses:

   • Default TLS: Generate and replace all self-signed TLS certificates with the new IP addresses or FQDNs.

   • Custom TLS: Generate and replace all custom TLS certificates with the new IP addresses or FQDNs.

   • No TLS: Proceed to the next step.

2. In PowerShell, list all the IP/FQDN-related environment variables with the new IPs or FQDNs, such as in the following example:

Note: The following scripts only show the environment variables that you would need to update in a conventional setup of Tenable Identity Exposure. It excludes any setup using split SENs or multiple DLs.

• Security Engine Node (SEN):

  Copy

  Update environment variables with new IPs or FQDNs for SEN

  # Script to run on the Security Engine Node Server
  $vars = @{
      ERIDANIS_MSSQL_HOST = ""  # Storage Manager Server IP Address
      ALSID_CASSIOPEIA_EVENT_LOGS_DECODER_Service__EventLogsStorage__Host = ""  # Storage Manager Server IP Address
      ALSID_CASSIOPEIA_CYGNI_Service__EventLogsStorage__Host = ""  # Storage Manager Server IP Address
      HEALTHCHECK_MSSQL_HOST = ""  # Storage Manager Server IP Address
  }
  
  # Prompt the user once for the value to set all environment variables to
  $value = Read-Host "Please enter the value for Storage Manager IP Address"
  Write-Output "You have entered: $value"
  
  # Use a temporary hashtable to store updated values
  $tempVars = @{}
  
  # Populate the temporary hashtable with the same value for all keys
  ForEach ($key in $vars.Keys) {
      $tempVars[$key] = $value
  }
  
  # Update the original hashtable with values from the temporary hashtable
  ForEach ($key in $tempVars.Keys) {
      $vars[$key] = $tempVars[$key]
  }
  
  
  # Set environment variables
  ForEach ($var in $vars.GetEnumerator()) {
      [System.Environment]::SetEnvironmentVariable($var.Name, $var.Value, 'Machine')
      Write-Output "Environment variable set: $($var.Name) = $($var.Value)"
  }
  
  # Restart all services
  Get-Service alsid* | Restart-Service
  Get-Service tenable* | Restart-Service

• Directory Listener (DL):

  Copy

  Update environment variables with new IPs or FQDNs for DL

  # To run on the Directory Listener Server
  $vars = @{
      ALSID_CASSIOPEIA_CETI_Service__Broker__Host = ""  # Directory Listener Server IP Address
  }
  
  # Prompt the user once for the value to set all environment variables to
  $value = Read-Host "Please enter the value for Security Engine Node Server IP Address"
  Write-Output "You have entered: $value"
  
  # Use a temporary hashtable to store updated values
  $tempVars = @{}
  
  # Populate the temporary hashtable with the same value for all keys
  ForEach ($key in $vars.Keys) {
      $tempVars[$key] = $value
  }
  
  # Update the original hashtable with values from the temporary hashtable
  ForEach ($key in $tempVars.Keys) {
      $vars[$key] = $tempVars[$key]
  }
  
  # Set environment variables
  ForEach ($var in $vars.GetEnumerator()) {
      [System.Environment]::SetEnvironmentVariable($var.Name, $var.Value, 'Machine')
      Write-Output "Environment variable set: $($var.Name) = $($var.Value)"
  }
  
  # Restart all services
  Get-Service alsid* | Restart-Service
  Get-Service tenable* | Restart-Service