Comments (7)
narayan-iyengar
commented on July 25, 2024
You'll have to deploy the initialize subscriber account by template in the spoke account. And then tag the spoke vpc.
…--
Thanks,
/narayan
________________________________
From: jcleve <[email protected]>
Sent: Wednesday, April 4, 2018 2:44:52 PM
To: PaloAltoNetworks/aws-transit-vpc
Cc: Subscribed
Subject: [PaloAltoNetworks/aws-transit-vpc] Stacks deployed, but nothing seems to happen. Please advise. (#11)
Hello,
I have an existing transit VPC with existing VPC peers that I would like to deploy this solution to. I've worked though the deployment guide and nothing appears to happen after deploying the initializeSubscriberAccount template in the transit account, and then InitializeSubscriberAccount in the peered vpc spoke account (LaunchSubscriberVPC parameter = No), and then tagging the spoke vpc with "subscribingVpc" : "yes". Can you please offer some thoughts on what the problem might be, or some troubleshooting tips?
Thanks.
John
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_PaloAltoNetworks_aws-2Dtransit-2Dvpc_issues_11&d=DwMCaQ&c=V9IgWpI5PvzTw83UyHGVSoW3Uc1MFWe5J8PTfkrzVSo&r=yaPPNRHFJOEqZ9-bfG64oiDWvBigyIWTnqkw0GQeLyU&m=3a4PovfqJuhS2VINltQPCdQNiGU7P0aeVCrH4es1Tk0&s=d_14CGcObJbsmgHCADaTG5gNGDXofUFRXRF_h4cBDDQ&e=>, or mute the thread<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_ARFcabd9ApjXHZoB8O-5FkZw84YnwIGKFmks5tlT7UgaJpZM4THjDA&d=DwMCaQ&c=V9IgWpI5PvzTw83UyHGVSoW3Uc1MFWe5J8PTfkrzVSo&r=yaPPNRHFJOEqZ9-bfG64oiDWvBigyIWTnqkw0GQeLyU&m=3a4PovfqJuhS2VINltQPCdQNiGU7P0aeVCrH4es1Tk0&s=-79TUne_v9pF-T4cytgvAZb9pWt-KNRJS8T2kDLr3IM&e=>.
from aws-transit-vpc.
jcleve
commented on July 25, 2024
Hi narayan,
I did deploy the initializeSubscriberAccount template in the spoke account and then tag it per the deployment guide. Nothing happens. Please advise.
from aws-transit-vpc.
jcleve
commented on July 25, 2024
ok, if I let the stacks create the transit vpc and subscriber vpc (as opposed to trying to use my existing) the PAgroup stack launches, but no VPNs are ever established. Any thoughts?
from aws-transit-vpc.
narayan-iyengar
commented on July 25, 2024
sorry for the delayed response.
Tagging the VPC should have worked. After you take the VPC, do you see firewalls being spun up in the transit vpc (paGroup gets launched)? If so and the tunnels are not up, chances are your firewall was not properly bootstrapped.
If the paGroup is not launched, make sure the account numbers are correct when launching the Initializer CFTs.
If VPNs are not established, it is possible that the bootstrapping of the firewall was not successful. Can you log into the firewall with the user and pass mentioned in the doc? BTW that is the user and pass you need to enter when launching the transit cft (unless you update the bootstrap.xml with your own user and pass)
Bootstrapping could fail if you enter the incorrect user/pass or your files are corrupted.
Or the S3 bucket layout is incorrect (make sure you remove and dummy files in the buckets)
from aws-transit-vpc.
jcleve
commented on July 25, 2024
I am able to log into each firewall's web interface, so presumably, bootstrapping was successful, but still no VPN tunnels have been created. What dummy files need to be removed from which bucket(s)?
from aws-transit-vpc.
narayan-iyengar
commented on July 25, 2024
If bootstrapping is successful that means you can login in using the username and pass listed in the guide.
Then no need to remove any dummy files.
You will need to dig into the cloud watch logs to see what is causing any errors.
Does your existing vpc have a vgw?
…--
Thanks,
/narayan
________________________________
From: jcleve <[email protected]>
Sent: Tuesday, April 17, 2018 6:50:06 AM
To: PaloAltoNetworks/aws-transit-vpc
Cc: Narayan Iyengar; Comment
Subject: Re: [PaloAltoNetworks/aws-transit-vpc] Stacks deployed, but nothing seems to happen. Please advise. (#11)
I am able to log into each firewall's web interface, so presumably, bootstrapping was successful, but still no VPN tunnels have been created. What dummy files need to be removed from which bucket(s)?
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_PaloAltoNetworks_aws-2Dtransit-2Dvpc_issues_11-23issuecomment-2D381999440&d=DwMFaQ&c=V9IgWpI5PvzTw83UyHGVSoW3Uc1MFWe5J8PTfkrzVSo&r=yaPPNRHFJOEqZ9-bfG64oiDWvBigyIWTnqkw0GQeLyU&m=bfB0_cGhwBkic_WKUQpJ8_3tG189UtoLrliSrGNAPfg&s=uzw5b2ZMKCv8WoS1P8I3YsWPs8zEcCOS_aWavVdS_-g&e=>, or mute the thread<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_ARFcaV8IqGecazxzQzLEwP-2DxTwx9Y5d8ks5tpfMOgaJpZM4THjDA&d=DwMFaQ&c=V9IgWpI5PvzTw83UyHGVSoW3Uc1MFWe5J8PTfkrzVSo&r=yaPPNRHFJOEqZ9-bfG64oiDWvBigyIWTnqkw0GQeLyU&m=bfB0_cGhwBkic_WKUQpJ8_3tG189UtoLrliSrGNAPfg&s=yvh4NdK3XYXHLZ-5I8P1xhDZc0z41rT0S6FMVqn0DTQ&e=>.
from aws-transit-vpc.
freimer
commented on July 25, 2024
There is a general problem with passing the CIDR for the DMZ through to the code that is used to configure the firewall. See #7 . Generally what this means is that the subnet mask for the outside interface is always configured as /27 regardless of what is specified as a parameter for the intializeTransitAccount.json stack. If you use a subnet that is larger (less bits), the firewall may get an IP that can't reach its own default gateway, resulting in no VPN connectivity. Check your eth1 object in the firewall to make sure it has the right mask. I've had it establish VPNs to one firewall but not the other precisely because of this. I'm working on a fix for this.
If not that, do you actually have VPN configuration show up in AWS in the subscriber account?
from aws-transit-vpc.
Related Issues (20)
- 2x Transit VPCs in the same account? HOT 2
- Stack PaGroup58 already exists HOT 2
- Is it possible to combine the VPC template with autoscaling firewall template sothat autoscaling with ipsec tunnels is supported?
- fectchFromSubscriberQueueLambda fails on empty queue
- transit vpc doesn't create a VPN connections HOT 3
- PA-Groups are exausted even though no VPNs have been configured HOT 4
- Deployment guide modification
- Deployment failed in regions without FIFO queues support HOT 4
- Limit on number of VPC's that Paloalto can connect to?
- CF Stack initializeTransitAccount.json too large HOT 1
- Palo password hash in bootrap.xml
- Cloud Formation Stack updates not updating Transit Dynamo Tables HOT 1
- TransitVPC CF stack parms must include transit account, if transit account also a subscribing account HOT 1
- Must accepting Maketplace EULA or Palo Group creation will time out HOT 2
- Secondary Account VPC Issue HOT 2
- CF JSON to YML? HOT 5
- fetchVpnServerDetails returns with PaGroup exhausted HOT 1
- Specifying Specific ASNs for the Customer Gateway
- Use BYOL HOT 2
- AMI Issues / EULA Issue? HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from aws-transit-vpc.