Comments (4)
I think those values can be removed..copy paste error
from aws-transit-vpc.
Those parameters are not even used anywhere in the CFT for paGroupCft, other than an Output, so they can be removed and/or ignored.
from aws-transit-vpc.
Upon further investigation, it looks like the subnet CIDR and gateway is "pass through" to the Outputs of the CF stack, and those Outputs are used in configuring the firewall. The gateway is used "directly," but the CIDR is broken out and only the bits or "part after the /" is used in configuring the firewall IPs. So if your public CIDR is anything other than a /27 it will probably be configured incorrectly unless you specify the correct CIDR when spinning up the paGroupCft. However, "you" don't spin it up, the automation does. Let me find what does that...
createNewPaGroup in pan_vpn_generic.py. This is called by createNewPaGroupLambda.py, and it only passes the transitVpcDmzAz1SubnetGateway and transitVpcDmzAz2SubnetGateway, not even passing the transitVpcDmzAz1SubnetCidr and transitVpcDmzAz2SubnetCidr that the paGroupCft accepts. Perhaps that is because these values are not stored in the DynamoDB table from which it pulls the TransitVPC config info.
In order to get this to work "properly" the CIDRs specified in the intializeTransitAccount.json CFT need to be saved to the DynamoDB table, and passed by the createNewPaGroupLambda.py handler function to the createNewPAGroup function in pan_vpn_generic.py, and then passed to the paGroupCft when the stack is created. The proper values would then be used by paGroupInitialize, which is called by the handler for checkStackStatusLambda function that is fired when the stack is complete.
There are several fixes that need to be implemented. Let me see if I can get this done today or tomorrow.
from aws-transit-vpc.
This should be fixed by #21 commit afc7bbb, testing now.
from aws-transit-vpc.
Related Issues (20)
- 2x Transit VPCs in the same account? HOT 2
- Stack PaGroup58 already exists HOT 2
- Is it possible to combine the VPC template with autoscaling firewall template sothat autoscaling with ipsec tunnels is supported?
- fectchFromSubscriberQueueLambda fails on empty queue
- transit vpc doesn't create a VPN connections HOT 3
- PA-Groups are exausted even though no VPNs have been configured HOT 4
- Deployment guide modification
- Deployment failed in regions without FIFO queues support HOT 4
- Limit on number of VPC's that Paloalto can connect to?
- CF Stack initializeTransitAccount.json too large HOT 1
- Palo password hash in bootrap.xml
- Cloud Formation Stack updates not updating Transit Dynamo Tables HOT 1
- TransitVPC CF stack parms must include transit account, if transit account also a subscribing account HOT 1
- Must accepting Maketplace EULA or Palo Group creation will time out HOT 2
- Secondary Account VPC Issue HOT 2
- CF JSON to YML? HOT 5
- fetchVpnServerDetails returns with PaGroup exhausted HOT 1
- Specifying Specific ASNs for the Customer Gateway
- Use BYOL HOT 2
- AMI Issues / EULA Issue? HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from aws-transit-vpc.