755166 - Community VLAN20 should be able to reach Labs VLAN21

Status: VERIFIED WORKSFORME

(Infrastructure & Operations Graveyard :: NetOps: DC ACL Request, task)

Description

[Philippe M. Chiasson (:gozer)]

Both these VLANs are somewhat public VLANS, at least VLAN22 in labs is meant to be treated as DMZ/Public facing.

It looks like hosts in the comunity network (VLAN20) currently can't reach anything in there. For instance, https://heatmap.mozillalabs.com/.

VLAN20 should have the same access privileges into VLAN22 as the rest of the internet.

Comment 1

[Philippe M. Chiasson (:gozer)]

Labs public VLAN is 21, not 22, corrected.

Comment 2

[Ravi Pina [:ravi]]

Noted.

I've created a global policy, public-labs, for inbound flows to labs that covers the community zone and internet.

Comment 3

[Philippe M. Chiasson (:gozer)]

Doesn't seem to work. I've tried from

sb-win32-tobx (63.245.223.20)(community vlan) to telnet to
63.245.223.165(labs public vlan) port 80, and it just times out. ICMP doesn't work either.

Comment 4

[Philipp Kewisch [:Fallen][📱📆]]

Ravi, any updates on this? This blocks getting a new Lightning beta build out of the door.

Comment 5

[Ravi Pina [:ravi]]

(In reply to Philippe M. Chiasson (:gozer) from comment #0)
[...]
> VLAN20 should have the same access privileges into VLAN22 as the rest of the
> internet.

The request was completed as requested.  I'm able to connect from jump1.  Make sure your netmask is a /25 (255.255.255.128).

[[e-mail]3 ~]# nc -vz 63.245.223.165 80
Connection to 63.245.223.165 80 port [tcp/http] succeeded!

[e-mail]3# show security policies from-zone untrust to-zone labs 
apply-groups [ public-labs global-policies global-deny ];
apply-groups-except global-policies;

{primary:node0}[edit]
[e-mail]3# show security policies from-zone community to-zone labs  
apply-groups [ public-labs global-policies global-deny ];
apply-groups-except global-policies;

Comment 6

[Philipp Kewisch [:Fallen][📱📆]]

Port 80 works for me too, but port 22 gives me Connection timed out. I don't know if the master just doesn't have ssh running or if its a policy issue.

Comment 7

[Ravi Pina [:ravi]]

Because ssh was never, to my knowledge, asked for.

Here are the policies and their respective bugs.

from-zone <*> to-zone labs {
    /* 739761,748018,755166 */
    policy smtp {

    /* 739761,748018,755166 */
    policy http {

    /* 739761,748018,755166 */
    policy https {

    /* 739761,748018,755166 */
    policy ping {

Comment 8

[Philipp Kewisch [:Fallen][📱📆]]

Ok, sorry, I wasn't aware. I'll check with gozer for more bugs, as I will need to ssh from jump1 to the master for admin work.

Comment 9

[Philippe M. Chiasson (:gozer)]

(In reply to Philipp Kewisch [:Fallen] (away until May 28th) from comment #8)
> Ok, sorry, I wasn't aware. I'll check with gozer for more bugs, as I will
> need to ssh from jump1 to the master for admin work.

Don't worry about that, the access path to the master will be different for you.

Comment 10

[Philippe M. Chiasson (:gozer)]

Bingo, it was the win32 box that had the wrong netmask. Fixed now.