services:networking
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
services:networking [2026/05/07 15:01] djgalloway |
services:networking [2026/08/11 19:51] (current) djgalloway [Firewall Rules] |
||
|---|---|---|---|
| Line 3: | Line 3: | ||
| ===== Networks ===== | ===== Networks ===== | ||
| - | ^ Name ^ Purpose ^ Size/CIDR ^ VLAN ID ^ Domain ^ MTU ^ | + | ^ Name ^ Purpose ^ Size/CIDR ^ VLAN ID ^ Domain ^ MTU ^ |
| - | | Sepia Front Copy | Mirrors existing upstream Ceph lab | 172.21.0.0/20 | 100 | front.sepia.ceph.com | 1500 | | + | | Sepia Front Copy | Created to make lab migration easy | 172.21.0.0/20 | 100 | front.sepia.ceph.com | 1500 | |
| - | | Sepia IPMI Copy | Mirrors existing upstream Ceph lab | 172.21.32.0/20 | 102 | ipmi.sepia.ceph.com | 1500 | | + | | Sepia IPMI Copy | Created to make lab migration easy | 172.21.32.0/20 | 102 | ipmi.sepia.ceph.com | 1500 | |
| - | | New Front | Server uplinks | 10.20.192.0/20 | 1338 | front.sepia.ceph.com | 1500 | | + | | New Front | Server uplinks | 10.20.192.0/20 | 1338 | front.sepia.ceph.com | 1500 | |
| - | | New IPMI | New server BMC | 10.20.208.0/20 | 1339 | ipmi.sepia.ceph.com | 1500 | | + | | New IPMI | New server BMC | 10.20.208.0/20 | 1339 | ipmi.sepia.ceph.com | 1500 | |
| - | | VPN Clients | VPN Clients | 172.16.48.1/24 | 1340 | vpn.sepia.ceph.com | 1500 | | + | | VPN Clients | VPN Clients | 172.16.48.1/24 | 1340 | vpn.sepia.ceph.com | 1500 | |
| - | | LRC | Ceph Cluster Backend Storage Traffic | 172.16.50.1/23 | 1341 | lrc.sepia.ceph.com | 9000 | | + | | LRC | Ceph Cluster Backend Storage Traffic | 172.16.50.1/23 | 1341 | lrc.sepia.ceph.com | 9000 | |
| - | | Openshift Cluster | Openshift Node IPs (master, workers, VIPs) | 172.16.53.1/25 | 1342 | os.sepia.ceph.com | 1500 | | + | | Openshift Cluster | Openshift Node IPs (master, workers, VIPs) | 172.16.53.1/25 | 1342 | os.sepia.ceph.com | 1500 | |
| - | | Openshift Provision | Openshift Provisioning/PXE | 172.16.55.1/26 | 1343 | pxe.os.sepia.ceph.com | 1500 | | + | | Openshift Provision | Openshift Provisioning/PXE | 172.16.55.1/26 | 1343 | pxe.os.sepia.ceph.com | 1500 | |
| - | | Openshift Clients | Openshift VM Clients | 172.16.56.1/23 | 1344 | client.os.sepia.ceph.com | 1500 | | + | | Openshift Clients | Openshift VM Clients | 172.16.56.1/23 | 1344 | client.os.sepia.ceph.com | 1500 | |
| - | | ODF Public | ODF Client-facing (Ceph Public) | 172.16.59.1/25 | 1345 | pub.odf.sepia.ceph.com | 1500 | | + | | ODF Public | ODF Client-facing (Ceph Public) | 172.16.59.1/25 | 1345 | pub.odf.sepia.ceph.com | 1500 | |
| - | | ODF Storage | ODF Cluster Traffic | 172.16.60.1/25 | 1346 | back.odf.sepia.ceph.com | 9000 | | + | | ODF Storage | ODF Cluster Traffic | 172.16.60.1/25 | 1346 | back.odf.sepia.ceph.com | 9000 | |
| - | | Public | Internet | 192.86.31.0/24 | 200 | | | | + | | Public | Internet | 192.86.31.0/24 | 200 | | | |
| - | | vlan104 | | 172.21.64.0/24 | 104 | vlan104.sepia.ceph.com | | | + | | vlan104 | Officinalis | 172.21.64.0/24 | 104 | vlan104.sepia.ceph.com | | |
| - | | vlan105 | | 172.21.65.0/24 | 105 | vlan105.sepia.ceph.com | | | + | | vlan105 | Officinalis | 172.21.65.0/24 | 105 | vlan105.sepia.ceph.com | | |
| - | | vlan106 | | 172.21.66.0/24 | 106 | vlan106.sepia.ceph.com | | | + | | vlan106 | Officinalis | 172.21.66.0/24 | 106 | vlan106.sepia.ceph.com | | |
| - | | vlan107 | | 172.21.67.0/24 | 107 | vlan107.sepia.ceph.com | | | + | | vlan107 | Officinalis | 172.21.67.0/24 | 107 | vlan107.sepia.ceph.com | | |
| - | In January 2020, 4 new small subnets were created for the [[hardware:officinalis]] nodes to each have an IP on different subnets. NIC1 is on VLAN104, NIC2 on VLAN105, etc. At present, the only switch configured to use these subnets is the QFX5200 purchased specifically for the Officinalis nodes but other switches could be configured if desired. | + | The first IP of each is the gateway and the first 5 IPs should not be used (.0 through .4) |
| ==== Officinalis ==== | ==== Officinalis ==== | ||
| + | In January 2020, 4 new small subnets were created for the [[hardware:officinalis]] nodes to each have an IP on different subnets. NIC1 is on VLAN104, NIC2 on VLAN105, etc. At present, the only switch configured to use these subnets is the QFX5200 purchased specifically for the Officinalis nodes but other switches could be configured if desired. | ||
| [[services:DNS]] and [[services:DHCP]] were configured to manage these VLANs in https://github.com/ceph/ceph-sepia-secrets/pull/463. | [[services:DNS]] and [[services:DHCP]] were configured to manage these VLANs in https://github.com/ceph/ceph-sepia-secrets/pull/463. | ||
| - | | ^ vlan104.sepia.ceph.com ^ vlan105.sepia.ceph.com ^ vlan106.sepia.ceph.com ^ vlan107.sepia.ceph.com ^ | + | ===== Firewall Rules ===== |
| - | ^ Available IP Range | 172.21.64.1 - 172.21.64.250 | 172.21.65.1 - 172.21.65.250 | 172.21.66.1 - 172.21.66.250 | 172.21.67.1 - 172.21.67.250 | | + | |
| - | ^ Gateway | 172.21.64.254 | 172.21.65.254 | 172.21.66.254 | 172.21.67.254 | | + | IBM OneIT manages the Juniper SRX in front of the lab. |
| - | ^ VLAN ID | 104 | 105 | 106 | 107 | | + | |
| + | ^ Application Name ^ Inbound/Outbound ^ Destination IP or Subnet/CIDR ^ Port Number ^ Protocol ^ | ||
| + | | OpenVPN | Inbound | 192.86.31.5 | udp-1194 \\ udp-51820 | UDP | | ||
| + | | OpenVPN | Inbound | 192.86.31.12 | 1194 | UDP | | ||
| + | | nginx / file share (e.g., https://filedump.ceph.com/) | Inbound | 192.86.31.5 | 443 | TCP | | ||
| + | | GitWeb | Inbound | 192.86.31.5 | 443 | TCP | | ||
| + | | githelper (https://github.com/ceph/githelper) | Inbound | 192.86.31.5 | 443 | TCP | | ||
| + | | Etherpad (pad.ceph.com) | Inbound | 192.86.31.5 | 443 | TCP | | ||
| + | | Pulpito (https://github.com/ceph/pulpito) | Inbound | 192.86.31.5 | 443 | TCP | | ||
| + | | qa-proxy.ceph.com | Inbound | 192.86.31.5 | 443 | TCP | | ||
| + | | quay.ceph.io | Inbound | 192.86.31.5 | 443 | TCP | | ||
| + | | sentry.ceph.com | Inbound | 192.86.31.5 | 443 | TCP | | ||
| + | | teuthology-api.ceph.com | Inbound | 192.86.31.5 | 443 | TCP | | ||
| + | | Dokuwiki (wiki.sepia.ceph.com) | Inbound | 192.86.31.5 | 443 | TCP | | ||
| + | | Postorius & Hyperkitty | Inbound | 192.86.31.12 | 443 | TCP | | ||
| + | | Postfix (Ceph project mailing lists) | Inbound | 192.86.31.12 | 25 | TCP | | ||
| + | | telemetry.ceph.com (apache2) | Inbound | 192.86.31.13 | 443 | TCP | | ||
| + | | telemetry-public.ceph.com (nginx serving grafana) | Inbound | 192.86.31.14 | 443 | | | ||
| + | | chacra.ceph.com (nginx) | Inbound | 192.86.31.15 | 443 | TCP | | ||
| + | | INBOUND OKAY TO BLOCK: 20,21,23,830,3389,58xx,59xx,53,69,111,389,NFS,Management,DB,ExplicitlyDenied | Inbound | 192.86.31.5-254 | | | | ||
| + | | Outbound web traffic | Outbound | 0.0.0.0/0 | 443 | | | ||
| + | | Jenkins agent SSH to Jenkins controller | Outbound | 158.69.68.47 | 2222 | | | ||
| + | | Jenkins agent SSH to Jenkins controller | Outbound | 158.69.65.239 | 2222 | | | ||
| + | | rsync unsigned packages from chacra.ceph.com | Outbound | 192.86.31.15 | 2222 | | | ||
| + | | rsync signed packages to download.ceph.com | Outbound | 158.69.68.124 | 22 | | | ||
| + | | OUTBOUND OKAY TO BLOCK: 20,21,23,830,3389,58xx,59xx,69,111,389,NFS,Management,DB,ExplicitlyDenied | Outbound | 0.0.0.0/0 | | | | ||
| + | | All non-blocklisted ports | Outbound | 0.0.0.0/0 | All | All | | ||
| + | | All, unrestricted | Outbound | 0.0.0.0/0 | All | All | | ||
| + | |||
| + | Firewall rules can be updated by following https://w3.ibm.com/w3publisher/oneit/nw-support/next-generation-datacenter/firewall-rules. | ||
| + | |||
| + | IES keeps [[https://ibm.box.com/s/in756ga4nfv79swvhj0btwv5bitxc95s|this spreadsheet]] up to date and should be considered the source of truth over this wiki article. | ||
| ===== Hardware ===== | ===== Hardware ===== | ||
services/networking.1778166075.txt.gz · Last modified: 2026/05/07 15:01 by djgalloway
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
