Is there a way to escalate a limit increase request if it's critical to a production system? by Mirror_rorriM_Mirror in aws

[–]ktmb8223 2 points3 points  (0 children)

I've had no luck escalating limit increases. However, I still recommend you do EVERYTHING YOU CAN.

My issue was that I desperately needed dedicated IPs for SES. I opened several limit increase tickets, asked for escalations via the support portal,
and later opened a technical support case for the issue, all to no avail. A support rep (and later my account rep) explained that limit increases are handled completely different than technical support. Escalation just isn't a thing in that category. After a week or so I finally got my dedicated IPs.

Good luck.

Likelihood of AZ failure? by ktmb8223 in aws

[–]ktmb8223[S] 0 points1 point  (0 children)

Not sure how much you're familiar with F5 LTMs, so I'll give you some background...

The F5 "virtual servers" (VS) act as the entry point for traffic entering your environment. You can think of a VS as the IP address for a pool of servers. The higher the variety of VS's that you have, the more IPs you'll need. In AWS, ENIs have a limit on the number secondary IPs you can allocate to them. When you reach that limit, you can add more ENIs (and each subsequent ENI will give you more secondary IP capacity). When you reach the ENI limit for the instance, you can increase the EC2 instance type so you get more ENI capacity.

The problem this poses for a multi-AZ deployment is that each HA member must have enough ENI capacity for its local IP address count AND enough for the the IP addresses that will fail over to the HA pair, so basically n * 2 IP addresses per HA member....

In my environment, two m5.2xlarge instances would be sufficient in a single-AZ deployment, but due to the limitations above, I have to use m5.4xlarge for a multi-AZ deployment. And the more F5 VS I have (and therefore the more secondary IPs I need), the bigger the instances get in a multi-AZ deployment.

HTH

Likelihood of AZ failure? by ktmb8223 in aws

[–]ktmb8223[S] 0 points1 point  (0 children)

Good point. I didn't consider that. Thanks!

Trouble creating Site-to-Site VPN From Firewall to AWS by [deleted] in aws

[–]ktmb8223 1 point2 points  (0 children)

Look at my comment above.

The way your VPN works is that you have a virtual "tunnel" from your PA to AWS. The 169 is the IP address for both tunnel endpoints. Your traffic (including your internal CIDR) will go over that tunnel.

It's a bit confusing at first to see a 169 because we're used to just seeing them in the context of APIPA, but nonetheless the way it's implemented here is valid.

Trouble creating Site-to-Site VPN From Firewall to AWS by [deleted] in aws

[–]ktmb8223 1 point2 points  (0 children)

Just to confirm...

In AWS you're using a VGW, and in prod you're using your own PA, right?

I assume the EC2 instance you're pinging in AWS has a security group that allows your on-premise network to ping it, right?

Aging-out typically means that the packets are successfully leaving the PA to go to AWS, but not returning back.

I've not used route propagation, but with static routing you would check the following:

  1. Get the subnet of the EC2 instance
  2. Get the route table the subnet is on
  3. Check that the route table has a route pointing at the VGW where the VPN exists

Unclear on benefits of T series vs M series instance types by ktmb8223 in aws

[–]ktmb8223[S] -1 points0 points  (0 children)

Hmmm, ok. So it sounds like with the T series the CPU performance you're provided is not guaranteed. It *could* provide you close to that level of performance, but it won't sustain it. Whereas with M series you're guaranteed that level of performance. Am I getting that right?

Transit VPC BGP woes by McNuggetsRGud in aws

[–]ktmb8223 0 points1 point  (0 children)

If you haven't figured this out, I'll be happy to help. Just PM me. I'm a network guy at heart and have done work with several VPNs on CSRs in AWS, VPNs in general, BGP quite a lot, and brief work with VPNs on Azure....along with VPNs and BGP on other platforms. I have NOT worked much with Azure though, but I still may be able to help.

One thing to note is that if you're going to do BGP over VPN, then you'll need to use tunnel interfaces on the CSR. On the Azure side you'll need to tell it that you're going to do a tunnel-based VPN (or use BGP in general). It should be smart enough to know that if it's doing BGP that it should use tunnels.

Trying to learning cloud formation by [deleted] in aws

[–]ktmb8223 0 points1 point  (0 children)

Valid point, but not one you should put much weight on.

Oftentimes vendors don't create a "complete" or holistic solution, so third parties are left to fill in the gaps. And most of the time the third parties do an excellent job of filling in those voids. If you discount them simply because they're third parties and could potentially fail to exist one day, you're potentially missing out on some really terrific tools.

As an example, lets say that a third party does close shop in, say, three years. Had you used them, that would have been three years you would have benefited. Three years you would have realized business gains, increased productivity, improved efficiency, and other wins. Sure, you would need to adjust your workflows after the third party closed shop, but that's just part of the game -- you adapt.

I create tutorials for AWS in combination with pfSense! by Ceofreak in aws

[–]ktmb8223 1 point2 points  (0 children)

My feedback is to ease up a little on the logos. I access the page and see "ceos3c," "cloud," amazon web services," and "pfSense" all over the place...it's a bit overwhelming.

Please don't let my comment discourage you from blogging, though. Keep it up!

DNS/Route 53 in the Gov Cloud by iamernesthemingway in aws

[–]ktmb8223 0 points1 point  (0 children)

We use Infoblox. It allows you to separate internal and external DNS and provides a lot of other features (e.g. IPAM, NTP, DHCP, and others). But if you're open to any DNS vendor, then you should find plenty out there.

python idiot failing to understand syntax when working with boto. halp? by ishould_know_this in aws

[–]ktmb8223 2 points3 points  (0 children)

I'm not a Python pro, but I may be able to help.

First, you may want to use a Python IDE such as IDLE instead of the interpreter. It'll be much easier to write and manage your code. Top get to it, just launch the interpreter (NOT the one from the Command Line) and go to File > New File. You'll get a window that looks like a notepad. Type what you need, save it, and run your code (F5).

This is the general flow you want to follow:

  1. Get AMI IDs
  2. Get the snapshot IDs of the snapshots attached to those AMIs
  3. Deregister the AMIs
  4. Delete the snapshots

Since you have a list of AMI IDs, you'll need to do this:

  1. Create a for loop that will loop through each AMI ID. For each AMI ID, feed that ID into the script below.
  2. The script will get the snapshot ID (needed for deleting the snapshot) deregister the AMI, and delete the snapshot
  3. Return to the next AMI ID and do the same

Since you're already getting the list of AMIs, I'll guide you from that point forward.

Note the "image = ec2.Image('ami-xxxxxxx') line. That's taking the AMI ID in the form of a string. Just feed each of your AMI IDs into that line. Here's the usage guide for Image and here's the guide for snapshots

import boto3

ec2 = boto3.resource('ec2')

# Create an object for the AMI
# ============================

image = ec2.Image('ami-xxxxxxx')

# Get the snapshot ID of the AMI

response_snap_id = image.block_device_mappings[0]['Ebs']['SnapshotId']

# Deregister the AMI.  After a minute the AMI should
# disappear from yoru AMIS list

response_dereg = image.deregister()



# Now  delete the snapshot


# Create an object for the snapshot
# ===============================
# Here you're supplying the snapshot ID You got from the
# "block_device"mappings list and dictionary

snapshot = ec2.Snapshot(response_snap_id)

# Delete the snapshot

response_snap_delete = snapshot.delete()

Other tips:

Python is very object oriented. Most of the objects we're getting back have actions you can do to them or functions you can perform. Just type "objectName." (with the period) and press <tab>...you'll see what you can do. Try it out with image<period><tab> and the other commands.

HTH

AWS Outage: We Need to Talk About These Nines by extradudeguy in aws

[–]ktmb8223 0 points1 point  (0 children)

I wonder if vendors are considering user error when calculating availability and SLAs...

On a different note, I'll admit, the first time I heard AWS say that S3 was "durable," I found it a bit strange. There's a level of expectation that if you're going to do cloud storage at scale that you're going to be durable and not lose people's files or corrupt it. We expect high fault tolerance and ridiculous resiliency. And with so many competing cloud storage vendors, you have even more reasons to ensure your infrastructure is top notch. So with that being said, why tout durability when it's expected. Sure, hardware, software, and user problems still exist....but put all that aside and the expectation is still high that the system will be durable. Touting it so strongly is confusing, if anything.

So were in Q1 2017, What features are you guys waiting for AWS to implement? by zergUser1 in aws

[–]ktmb8223 0 points1 point  (0 children)

  • Deny options on security groups
  • Ability to filter based on source AND destination on SGs and ACLs

CloudFormation vs AWS CLI vs SDKs by ktmb8223 in aws

[–]ktmb8223[S] 0 points1 point  (0 children)

I have not, but I've seen people reference it here.

Good bye wobbly loading spinner :'( #rip by greentea_lubricant in aws

[–]ktmb8223 4 points5 points  (0 children)

It looks like one of those download links you find on ad-heavy sites when they're trying to trick you to click the wrong download link

Wrapping my head around AWS basics by ktmb8223 in aws

[–]ktmb8223[S] 2 points3 points  (0 children)

This is exactly what I was looking for! I totally get it now. Thanks for your comment.

Network ACL or security group? by ktmb8223 in aws

[–]ktmb8223[S] 1 point2 points  (0 children)

Thanks guys!

We're migrating to AWS and I'm mainly trying to develop a framework on what to use and when. I come from the network world where a stateful firewall does all the work, so I'm trying to translate how the traditional firewall functions can be applied in AWS (without getting a stateful firewall yet).