search

f5devcentral / f5-azure-saca

Secure Azure Computing Architecture for DoD (SACA) - Notional Secure Cloud Computing Architecture (SCCA) Deployment
MIT License
26 stars 40 forks source link

High percentage failure rate when doing bigiq deployment #100

Closed Phydeauxman closed 4 years ago

Phydeauxman commented 4 years ago

When performing a deployment into Azure Commercial using the bigiq template, a high percentage of the time the deployment fails because the Custom Script Extension for the first, or second, or both F5s fails to complete.

The BIG-IQ instance being used to acquire licenses is hosted in Azure Government. Traffic coming from Commercial destined for Government must traverse the Internet.

The Custom Script Extension used for the bigiq deployment seem to be identical to the one used for the byol deployment. A majority of the files used by Custom Script Extension are hosted in Github. Should investigate hosting these files in Azure somewhere to reduce the latency caused by having to pull the files in from over the Internet. Given that we have a high success rate when performing a byol deployment, appears unlikely that the location of the files used by the Custom Script Extension is causing the bigiq failures.

Not sure where .tmpl files do or where they are hosted because they are sitting behind a CDN

Mikej81 commented 4 years ago

Do the deployments fail for PAYG and BYOL templates as well? Most customers arent using BIG-IQ templates unless.

Phydeauxman commented 4 years ago

@Mikej81 we are unable to test PAYG with the subs we have (not allowed) and we do not have keys to test the BYOL deployment. We tried taking some keys from the BIG-IQ server and using them with a BYOL deployment and even though the deployment completed successfully, the F5s were not operational.

Mikej81 commented 4 years ago

Shoot me an email and I can cut some BYOL licenses. I added a lot of DependsOn per Kyle to slow things down, and there have been issues after we switched to 'standard' SKUS with routing from the BIG-IPs to internet to download the file dependencies. Open to not having to do that without creating custom vhd in storage accounts.

Mikej81 commented 4 years ago

@Phydeauxman closing this one out.