Documentation forSecurity Event Manager

Configure IPv6 and dual-stack networking in SEM

Starting with SEM 2026.4, the SEM appliance supports dual-stack networking (IPv4 and IPv6 at the same time). Dual stack helps you meet Security Technical Implementation Guide (STIG) requirements for IPv6 support. Dual stack is available on the standard (Debian-based) appliance and on FIPS-enabled (RHEL-based) deployments.

Network modes

SEM supports the following network modes:

  • IPv4 only (default): SEM uses IPv4 only. IPv6 is disabled at the operating system kernel level.

  • Dual stack: SEM listens on both IPv4 and IPv6 addresses. The following services accept connections over both protocols:

    • The SEM web console
    • Syslog (port 514 UDP and TCP, and port 1470 TCP)
    • SEM agent listeners
    • SSH access to the CMC command line

    In dual-stack mode, the appliance console screen in your hypervisor displays both the IPv4 and IPv6 addresses.

Enable dual-stack networking on the standard appliance

On the standard (non-FIPS) appliance, you change the network mode with the netconfig command in the CMC command line. Enabling IPv6 requires a reboot of the SEM VM.

Changing the network configuration ends your SSH session. After the appliance reboots, reconnect using the new network settings. SolarWinds recommends running this procedure from the hypervisor console, or keeping the hypervisor console available in case you cannot reconnect over SSH.

  1. Open the CMC command line.

    See Log in to the SEM CMC command line interface for directions.

  2. At the cmc> prompt, type appliance, and then press Enter.

  3. At the cmc::appliance> prompt, type netconfig, and then press Enter.

  4. At the following prompt, type enable-ipv6, and then press Enter:

    Do you want to enter static IPv4 parameters, or use DHCP? <DHCP/static> (or enter 'enable-ipv6' to enable IPv6 support):

  5. When prompted to confirm, type y, and then press Enter:

    This will enable IPv6 system-wide and configure IPv6 addressing. This requires a reboot to take effect. Continue? <y/N>

  6. At the following prompt, type both, and then press Enter to enable dual stack:

    Configure IPv6 mode: <Both> (enter 'both' to enable dual-stack):

  7. Configure the IPv4 settings. Type dhcp or static. If you select static, enter the IPv4 address, subnet mask, and gateway when prompted.

    SolarWinds recommends static addresses for the SEM VM. If an address obtained by DHCP changes, deployed agents may be disconnected.

  8. Configure the IPv6 settings. At the following prompt, type DHCPv6 or static:

    Do you want to enter static IPv6 parameters, or use DHCPv6? <DHCPv6/static>

    If you select static, enter the IPv6 address, prefix length, and IPv6 gateway when prompted.

  9. Configure DNS:

    • If you use DHCP, answer the prompt Does your DHCP server provide DNS addresses automatically? <Y/n>.

    • If you use static addresses, enter your domain, and then enter one or more DNS servers when you see the prompt Enter at least one DNS server for your network (e.g. 192.168.0.2 or 2001:db8::2) or hit <Enter> to continue. You can enter IPv4 or IPv6 DNS server addresses.

  10. When the configuration is complete, the following message displays and the appliance reboots:

    Network configuration done, please reconnect using the new network settings. Rebooting the appliance to apply the configuration change...

  11. After the reboot, reconnect to the CMC command line and run viewnetconfig at the cmc::appliance> prompt to verify the IPv4 and IPv6 addresses and routes.

Disable IPv6 and return to IPv4 only

  1. At the cmc::appliance> prompt, type netconfig, and then press Enter.

  2. At the following prompt, type disable-ipv6, and then press Enter:

    Configure IPv6 mode: <Both> (or enter 'disable-ipv6' to turn IPv6 back off):

  3. When prompted to confirm that you want to disable IPv6 system-wide and clear any configured IPv6 addressing, type y, and then press Enter.

  4. Complete the remaining prompts. The appliance reboots to apply the change.

Configure IPv6 on FIPS-enabled (RHEL) deployments

On FIPS-enabled SEM deployments on Red Hat Enterprise Linux (RHEL), you do not configure the network mode in the CMC. SEM automatically detects the network mode configured in the operating system during installation. Use the RHEL network tools, such as nmcli or nmtui, to configure IPv4 and IPv6 addressing. See your RHEL documentation for details.

On FIPS-enabled deployments, do not configure the operating system for IPv6 only. Use either IPv4 only or dual stack.

For other differences in the FIPS edition, see Features and limitations of the SEM FIPS edition.

Access SEM over IPv6

In dual-stack mode, you can open the SEM web console using either address:

  • IPv4: https://<IPv4 address>/

  • IPv6: https://[<IPv6 address>]/, for example https://[2001:db8::10]/

Always enclose an IPv6 address in square brackets in a URL.

In Live Events, the Detection IP and Insertion IP fields show the IPv4 or IPv6 address, depending on the protocol the sending device used.

Agents

The SEM Manager accepts agent connections over IPv4 and IPv6 at the same time. The protocol an agent uses depends on how you specify the Manager when you install the agent:

  • If you specify an IPv4 address, the agent connects over IPv4.

  • If you specify an IPv6 address, the agent connects over IPv6.

  • If you specify a host name, the agent uses the address returned by DNS (A or AAAA record).

Certificates

  • In the cmc::manager> menu, exportcertrequest adds all appliance IP addresses (IPv4 and IPv6) to the certificate signing request as IP Subject Alternative Name (SAN) entries. importcert validates IPv6 SAN entries.

  • If you use a CA-signed certificate that identifies the appliance by IP address, connections over IPv6 report a SAN mismatch after you enable dual stack. To fix this, run exportcertrequest to generate a new certificate signing request, have your CA reissue the certificate, and import it with importcert. See Import a self-signed certificate into the SEM Manager.

  • Certificates that identify the appliance by fully qualified domain name (FQDN) do not need to be changed.

  • If SEM connects to your LDAP server by IPv6 address, the LDAP server certificate must include that IPv6 address as a SAN entry. See Configure LDAP for SEM.

SMB shares over IPv6

On the standard (non-FIPS) appliance, you can connect to SMB shares by IPv6 address:

  • In the SEM web console, enter the path as \\[2001:db8::1]\ShareName or \\2001:db8::1\ShareName.

  • In CMC backup and upgrade commands, enter the raw IPv6 address without square brackets.

Other CMC commands that support IPv6

In dual-stack mode, the following also work with IPv6:

  • activate, backupconfig, and import.

  • ntpconfig accepts IPv6 NTP server addresses.

  • viewnetconfig displays IPv6 addresses and routes.

  • The restrict and unrestrict commands in the cmc::service> menu (such as restrictssh and unrestrictssh) accept IPv6 addresses, and SNMP works over IPv6. See Restrict SSH access to the SEM CMC interface.

  • The appliance firewall applies the same rules to IPv6 traffic as to IPv4 traffic.

Troubleshooting

If you cannot connect to SEM after changing the network mode, open the SEM VM console in your hypervisor. The console screen displays the active IPv4 and IPv6 addresses. Verify that you are using the correct address, and that IPv6 URLs are enclosed in square brackets.