1090993 - External SCL3 ZLB cluster neet access to webops1.private.{scl3,phx1}.mozilla.com

Status: RESOLVED FIXED

(Infrastructure & Operations Graveyard :: NetOps: DC ACL Request, task)

Description

[Philippe M. Chiasson (:gozer)]

This already works in PHX1, but not in SCL3. The local flows should be:

zlb1.ops.scl3.mozilla.com => webops1.private.scl3.mozilla.com tcp/80
zlb3.ops.scl3.mozilla.com => webops1.private.scl3.mozilla.com tcp/80
zlb5.ops.scl3.mozilla.com => webops1.private.scl3.mozilla.com tcp/80
zlb6.ops.scl3.mozilla.com => webops1.private.scl3.mozilla.com tcp/80

And ideally, but not necessary, allowing cross-DC access too would be appreciated.

zlb1.ops.scl3.mozilla.com => webops1.private.phx1.mozilla.com tcp/80
zlb3.ops.scl3.mozilla.com => webops1.private.phx1.mozilla.com tcp/80
zlb5.ops.scl3.mozilla.com => webops1.private.phx1.mozilla.com tcp/80
zlb6.ops.scl3.mozilla.com => webops1.private.phx1.mozilla.com tcp/80

Thanks!

Comment 1

[James Barnell [:jbarnell]]

Part 1: 

[e-mail]# show | compare 
[edit security policies from-zone ops to-zone private]
      policy netops--sflow { ... }
+     policy zlb-to-webops-private {
+         match {
+             source-address [ zlb1 zlb3 zlb5 zlb6 ];
+             destination-address webops1.private.scl3;
+             application junos-http;
+         }
+         then {
+             permit;
+         }
+     }

Comment 2

[James Barnell [:jbarnell]]

Part 2: 

[e-mail]# show | compare 
[edit security policies from-zone dc to-zone private]
      policy cifclient1--https { ... }
+     policy scl3-zlb-to-webops {
+         match {
+             source-address [ zlb1.ops.scl3 zlb3.ops.scl3 zlb5.ops.scl3 zlb6.ops.scl3 ];
+             destination-address webops1.private.phx1;
+             application junos-http;
+         }
+         then {
+             permit;
+         }
+     }

Please test and verify.

Comment 3

[James Barnell [:jbarnell]]

Closing please reopen if there are problems.