search

f5devcentral / f5-azure-saca

Secure Azure Computing Architecture for DoD (SACA) - Notional Secure Cloud Computing Architecture (SCCA) Deployment
MIT License
26 stars 39 forks source link

Virtual Server illegally shares destination address #106

Closed svbfromnl closed 4 years ago

svbfromnl commented 4 years ago

I deployed the 3-NIC 1 Tier script in my personal Azure (commercial) space. After deployment, I created a Shared Address List with both backend pool ips from the ext-alb loadBalancerBackEnd configuration. (192.168.2.10 and 192.168.2.11)

I created the vs, selected the Shared Address List, and set Service Port (80). When clicking create, it fails like this:

01b90011:3: Virtual Server /Common/alb-test's Traffic Matching Criteria /Common/alb-test_VS_TMC_OBJ illegally shares destination address, source address, service port, and ip-protocol with Virtual Server /mgmt/mgmt_http/mgmt_http destination address, source address, service port.

What am I missing here?

Mikej81 commented 4 years ago

You cannot use the same combination for a new configuration as what is created by the original AS3. The originals are provided as baseline examples, you will need to tweak to your own environment either before the AS3 is posted or manually configure afterwards to your needs.

svbfromnl commented 4 years ago

But using what's provided in the template is exactly what I'm trying to do. I want to setup a virtual server that uses the two back-end ip addresses as configured in the ALB. When I try to follow the directions given in the README.md, it fails.

Mikej81 commented 4 years ago

You cannot use the anything that conflicts with the applied AS3. You would need to path the existing declaration. The default AS3 uses wildcards which are going to cause conflicts with almost everything.

Need more explicit details of what you are attempting to do. Send the AS3 you are using to create the additional app services. If you are creating them manually, what does that configuration look like, exactly?

svbfromnl commented 4 years ago

I'm not using scripts yet. Just trying to setup a bare VS on the HA pair that fits with what the template deploys. Once I have the basics down I will write a script to automate the VS and pool setup.

The ext-alb has a loadBalancerBackEnd configuration with two ip addresses. Can I those be used for a vs too, or are they exclusive for the rdp/ssh traffic?

Mikej81 commented 4 years ago

@svbfromnl I assume you got everything up and running so I am closing this for now.