637484 - ACL updates for launching scl2 sync storage

Status: RESOLVED FIXED

(Infrastructure & Operations Graveyard :: NetOps, task)

Description

[Pete Fritchman [:petef]]

These rules are to enable launching sync storage in scl2. We're hoping to launch on Wednesday afternoon, so ideally I'd like to start final testing tomorrow (Tuesday) with the rules below in place.

For stats and administration:
* wp-adm01.phx.weave.m.c (10.10.0.5) --> db vlans (first 25 VLANs are sufficient) in scl2 (tcp/3306)

For db replication:
* adm1.scl2.svc.m.c (10.14.2.5) -> wp-adm01.phx.weave.m.c (10.10.0.5) (tcp/3306)

For LDAP replication:
* ldap vlan in scl2 -> ldap vlan in phx (10.10.12.0/24) (tcp/389)

reference for SCL2 vlans:
https://intranet.mozilla.org/SysAdmin/index.php/Documentation/Colo_Layer42#Networking

Comment 1

[Derek Moore [:dmoore]]

For the record, the existing routing on wp-adm01 will use the 10.8.75.15 interface to reach the db vlans. I'll build the ACLs using this address.

Comment 2

[Derek Moore [:dmoore]]

This distinction also applies for the db replication rule. If it's important that you use 10.10.0.5 instead of 10.8.75.15, let me know and we'll discuss how to change the routing on wp-adm01.

Comment 3

[Pete Fritchman [:petef]]

Not a problem, we can update any host-based ACLs for phx->scl2 (first rule) and just use the right IP address when initiating connections from scl2->phx adm1 for replication.

Comment 4

[Derek Moore [:dmoore]]

ACLs installed as requested.