706968 - Make 10.8.75.59 accessible via MPT VPN for :bc

Status: RESOLVED FIXED

(Infrastructure & Operations Graveyard :: NetOps: DC ACL Request, task)

Description

[Dan Parsons [:lerxst]]

Please make 10.8.75.59 accessible via MPT VPN for :bc, just like how he can access 10.8.75.18 now. (Both IPs are vCenter Server machines).

Comment 1

[Derek Moore [:dmoore]]

Access granted as requested:

[edit security zones security-zone internal address-book]
       address bedrockadm { ... }
+      address vc1.private 10.8.75.59/32;

[edit security policies from-zone edge to-zone internal policy permit-mpt-vpn match]
-      destination-address [ wv-adm01 ip-ops02 qp-vmware01 sp-admin01 ip-ganglia01 as-mgr1 qp-vmware02 addonsadm as-logger1 ];
+      destination-address [ wv-adm01 ip-ops02 qp-vmware01 sp-admin01 ip-ganglia01 as-mgr1 qp-vmware02 addonsadm as-logger1 vc1.private ];

Comment 2

[Dan Parsons [:lerxst]]

Need more IPs. Here's the full list:

10.8.75.59 (use same tcp ports as what's used for 10.8.75.18 now)

For these IPs, use the same tcp ports as what's used for 10.8.75.26
10.8.75.52
10.8.75.53
10.8.75.54
10.8.75.55
10.8.75.56
10.8.75.57

Comment 3

[Derek Moore [:dmoore]]

Added:


[edit security zones security-zone internal address-book]
       address vc1.private { ... }
+      address esx1.private 10.8.75.52/32;
+      address esx2.private 10.8.75.53/32;
+      address esx3.private 10.8.75.54/32;
+      address esx4.private 10.8.75.55/32;
+      address esx5.private 10.8.75.56/32;
+      address esx6.private 10.8.75.57/32;
[edit security zones security-zone internal address-book]
       address-set wp-monXX.phx.weave { ... }
+      address-set esx {
+          address esx1;
+          address esx2;
+          address esx3;
+          address esx4;
+          address esx5;
+          address esx6;
+      }
[edit security policies from-zone edge to-zone internal policy permit-mpt-vpn match]
-      destination-address [ wv-adm01 ip-ops02 qp-vmware01 sp-admin01 ip-ganglia01 as-mgr1 qp-vmware02 addonsadm as-logger1 vc1.private ];
+      destination-address [ wv-adm01 ip-ops02 qp-vmware01 sp-admin01 ip-ganglia01 as-mgr1 qp-vmware02 addonsadm as-logger1 vc1.private esx ];