1256653 - Broadcast ateam SSID in all offices

Status: RESOLVED FIXED

(Infrastructure & Operations Graveyard :: NetOps: Office Other, task)

Description

[James Barnell [:jbarnell]]

As part of our efforts to support the connected devices team we need to broadcast the ateam ssid in all offices. This should allow for support of the consumer wireless devices they are working on as well as provide appropriate segregation from the production networks.

Comment 1

[Dave Curado :dcurado]

this work has been done in TPE1 previously...  

https://bugzilla.mozilla.org/show_bug.cgi?id=1161398

We should be able to follow those steps to put the 'ateam' ssid in all offices.

Comment 2

[Dave Curado :dcurado]

steps:
 - ensure that 'ateam' is present as a vlan on all office switches (done)
 - ensure that the 'ateam' vlan is trunked to the wap interface range
 - ensure that the 'ateam' vlan is connected/trunked to the firewall in each office (done)
 - configure the wifi controllers

(blatantly stealing this config snippet from Van)

wifi1.ops.tpe1.mozilla.net#
set radio-profile tpe1 service-profile ateam
set service-profile ateam ssid-name ateam
set service-profile ateam proxy-arp enable
set service-profile ateam auth-fallthru last-resort
set service-profile ateam psk-encrypted XXXXXXXXXXXXXXXXXXXXXXXXXXX
set service-profile ateam load-balancing-exempt enable
set service-profile ateam 11n mode-na disable
set service-profile ateam 11n mode-ng disable
set service-profile ateam wpa-ie auth-dot1x disable
set service-profile ateam rsn-ie cipher-ccmp enable
set service-profile ateam rsn-ie auth-psk enable
set service-profile ateam rsn-ie auth-dot1x disable
set vlan-profile corp vlan ateam tag 120
set service-profile ateam rsn-ie enable
set vlan 120 name ateam
set vlan 120 port 2 tag 120
set igmp disable vlan 120

Comment 3

[Dave Curado :dcurado]

Michal` - in lieu of a sec-review flag, can you please take a look at this proposed change and give it your security blessing?

Please note that some offices (TOR1 and TPE1) already have this ssid advertised.

Thank you!

Comment 4

[Michal Purzynski [:michal`] (use NEEDINFO)]

The change looks sane, we already have those devices in a separate Vlan, with firewall policies that allow access from corp -> ateam/QA and do NOT allow connections to be initiated from QA/Ateam -> corp.

So that's not really different from TOR1/TPE1.

Comment 5

[Dave Curado :dcurado]

I have trunked the ateam vlan to the wap interface range in all the offices where it was not already there.
I believe all there to do now is the wifi controller part.

Comment 6

[Dave Curado :dcurado]

Talked to Van, he is going to do the wifi controller part this weekend.

Comment 7

[Dave Curado :dcurado]

Here's the list of switches I modified to include 'ateam' in the wap interface-range...

switch1.df701-1.ops.sfo1.mozilla.net
switch1.df101-1.ops.sfo1.mozilla.net
switch1.df102-1.ops.sfo1.mozilla.net
switch1.df301-1.ops.sfo1.mozilla.net
switch1.ops.pdx1.mozilla.net
switch1.ops.yvr1.mozilla.net
switch1.ops.lon1.mozilla.net
switch1.df101-1.ops.par1.mozilla.net
switch1.df001.ops.par1.mozilla.net
switch1.df102.ops.par1.mozilla.net
switch2.df103.ops.par1.mozilla.net
switch1.r201-1.ops.ber1.mozilla.net
switch1.df101-1.ops.ber2.mozilla.net
switch1.ops.akl1.mozilla.net

Comment 8

[Van Le [:van]]

NA and EU offices should now be broadcasting the ateam SSID. will need someone in the offices to confirm connectivity. APAC currently has network issues so I'll look into configuring the ateam SSID tonight or when the network recovers.

11:11 AM <@nagios-scl3> Sat 11:11:13 PDT [5238] fw1.ops.tpe1.mozilla.net (10.247.0.1) is DOWN :PING CRITICAL - Packet loss = 100%

Comment 9

[Van Le [:van]]

NA and EU offices should now be broadcasting the ateam SSID. will need someone in the offices to confirm connectivity. APAC currently has network issues so I'll look into configuring the ateam SSID tonight or when the network recovers.

11:11 AM <@nagios-scl3> Sat 11:11:13 PDT [5238] fw1.ops.tpe1.mozilla.net (10.247.0.1) is DOWN :PING CRITICAL - Packet loss = 100%

Comment 10

[Van Le [:van]]

>Talked to Van, he is going to do the wifi controller part this weekend. 

configs added to controllers, ateam ssid should be broadcasting to all offices now.