1011743 - flow from relengwebadm to celery nodes

Status: RESOLVED FIXED

(Infrastructure & Operations Graveyard :: NetOps: DC ACL Request, task)

Description

[Dustin J. Mitchell [:dustin] (he/him)]

I missed a flow in bug 1011565: relengwebadm needs to be able to use SSH to push changes to celery.

relengwebadm.private.scl3
 ->
  celery{1..8}.srv.releng.scl3:22/tcp

Comment 1

[Dustin J. Mitchell [:dustin] (he/him)]

Note that I just renamed celery8 to celery1.stage.srv.releng.scl3.mozilla.com in inventory, but there's no change to the flow request.  The netblock for these hosts is 10.26.48.192/29.

Comment 2

[Dustin J. Mitchell [:dustin] (he/him)]

Adam, any update here?

Comment 3

[Adam Newman [:adam]]

the requested change has been made:

[e-mail]# run show security policies from-zone dc to-zone srv policy-name celery--ssh detail
node1:
--------------------------------------------------------------------------
Policy: celery--ssh, action-type: permit, State: enabled, Index: 2601, Scope Policy: 0
  Policy Type: Configured
  Sequence number: 15
  From zone: dc, To zone: srv
  Source addresses:
    relengwebadm.private.scl3: 10.22.75.138/32
  Destination addresses:
    celery1.stage: 10.26.48.199/32
    celery7: 10.26.48.198/32
    celery6: 10.26.48.197/32
    celery5: 10.26.48.196/32
    celery4: 10.26.48.195/32
    celery3: 10.26.48.194/32
    celery2: 10.26.48.193/32
    celery1: 10.26.48.192/32
  Application: junos-ssh
    IP protocol: tcp, ALG: 0, Inactivity timeout: 86400
      Source port range: [0-0]
      Destination port range: [22-22]
  Per policy TCP Options: SYN check: No, SEQ check: No