Azure Lab following doc from Leon Adato

First Post - Hi!

Just got my first industry job. I will supposedly be monitoring a large OSPF network on Solar Winds (among other things)

Im trying to build the Lab environment described in this doc:

https://gns3.com/initiatives/a-virtualized-monitoring-lab-with-solarwinds-and-gns3

Current issue (second try at this) is im getting a permission denied on the gns3 folder after rebooting the ubuntu server:

swadmin@GN3-Server:/etc$ cd gns3/

-bash: cd: gns3/: Permission denied

swadmin@GN3-Server:/etc$ lsb_release -a

No LSB modules are available.

Distributor ID: Ubuntu

Description: Ubuntu 18.04.5 LTS

Release: 18.04

Codename: bionic

swadmin@GN3-Server:/etc$

Before I go chmodding willy nilly anyone have know if this behavior is normal? the documentation does not say anything about this

Also, last night I rant into a situation where my PAID azure account (im very new to azure) will only let me spin up 10 vcpu in a particular location (not idea if this in normal behavior). The documentation asks for:

1) Orion polling engine: 8 3.12Ghz CPU, 12Gb RAM, 200Gb disk.
2) Orion database: 8 3.12Ghz CPU, 12Gb RAM, 200Gb disk
3) GNS3 GUI: 4 3.12 Ghz CPU, 8Gb RAM, 60Gb disk
4) GNS3 server: 4 3.12 Ghz CPU, 8Gb RAM, 60Gb disk

Im trying to use Standard D4s v3 (4 vcpus, 16 GiB memory) for the GNS related boxes and the similar D8 for the Solar Winds boxes. Last night was a disaster everything ended up on separate subnets (I hope to not go down some random rabbit hole to fix this). Right now I am starting over with the 2 GNS3 boxes on East US no problem. Any help would be appreciated to set me on the proper path.

Thank You for your time,

Jesse

Find more posts tagged with

lab

Azure

Linux

network monitoring

Accepted answers

jessequijano

answer was proved on another forum. use sudo -i to work as root

jessequijano

Iptables commands also need to be tweaked

sudo iptables -I FORWARD -o virbr0 -p icmp --icmp-type echo-request -j ACCEPT

sudo iptables -I FORWARD -o virbr0 -p udp --dport 161 -j ACCEPT

sudo iptables -t nat -I POSTROUTING -s 192.168.122.0/24 -p udp --dport 162 -j ACCEPT

sudo iptables -I FORWARD -o virbr0 -p tcp --dport 22 -j ACCEPT

sudo iptables -I FORWARD -o virbr0 -p tcp --dport 23 -j ACCEPT

sudo iptables -t nat -I POSTROUTING -s 192.168.122.0/24 -p udp --dport 2055 -j ACCEPT

sudo iptables-save

Worked for me on the version defined in the original post

jessequijano

The issue about going over cpu count on azure is easy just use the interface to ask for more were approved in less than 3minutes. also the D8 i ended up using to load the windows servers had another limit i had to ask for more availability. was able to gat all 4 vms on same subnet same resource group same location everything reachable to each other via private ip

All comments

jessequijano

answer was proved on another forum. use sudo -i to work as root

jessequijano

Iptables commands also need to be tweaked

sudo iptables -I FORWARD -o virbr0 -p icmp --icmp-type echo-request -j ACCEPT

sudo iptables -I FORWARD -o virbr0 -p udp --dport 161 -j ACCEPT

sudo iptables -t nat -I POSTROUTING -s 192.168.122.0/24 -p udp --dport 162 -j ACCEPT

sudo iptables -I FORWARD -o virbr0 -p tcp --dport 22 -j ACCEPT

sudo iptables -I FORWARD -o virbr0 -p tcp --dport 23 -j ACCEPT

sudo iptables -t nat -I POSTROUTING -s 192.168.122.0/24 -p udp --dport 2055 -j ACCEPT

sudo iptables-save

Worked for me on the version defined in the original post

jessequijano

adatole

Thank you for digging into this. I'll likely take another run at this and see if sudo is needed and I forgot to document it, or there are differences in systems or something.

jessequijano

excellent. right now im banging against authenticating from 2019 datacenter to 2019 datacenter running sql 2019 std (haven't touched a sql box in like 10 years and that was minor).

I added a new discrete user just for this to the db in the SQL Server Management Studio by using my local user to access. I can confirm works by disconnecting with local login and logging in using the specific SQL login

I gave that user every possible permission I could find under the security/login.

The error is a 40 and I have done every tutorial I can find to resolve (most say the same things)

private and public firewall OFF both sides (Orion-Engine and Orion-DB Vms)

SQL Server Browser is Running. I set it to AUTO and it is currently RUNNING as a local service. I am also AUTO RUNNING the SQL Server Agent by default as NT Service\SQLSERVERAGENT and my SQL Server Process is AUTO RUNNING by default as NT Service\MSSQLSERVE

Allow Remote Connections set with max connection of 0 (unlimited)

I have verified IP connectivity on the private network between the machines but a port check

example for anyone following along:

Test-NetConnection -ComputerName your.target.ip.address -Port yourtargetportnumber
Test-NetConnection -ComputerName your.target.ip.address -Port yourtargetportnumber

Still no luck. Its only a matter of time but if you have any thoughts on this id appreciate them.

Thanks for the Guide. It has been a great practical experience for me working in Azure. Once I finish this lab I plan to use the environment to complete a Udemy course Im working in preperation for SCP Exam.

As you article points out I can do this in the cloud now. no more bulk lab racks in my house. Ill try this in AWs at some point but so far Azure has been an absolute beast for this kind of one off labbing

jessequijano

SO....

no success deploying solution on 2019 vms with separate sql database server (I got pcaps from Network Watcher ahem Wireshark in the cloud what! what! but no idea how to troubleshoot sql login errors only chase so many rabbits at once)

need to move on to the actual learning to work with Orion for my job so got to put a pin in this for a second. in the mean time figured I would attempt the pre-canned azure version and walked face first into learning about SSO and AD on Azure. im going to kill this wascally wabbit one way or another but Im a bit turned around at this point. What I am seeing in this related tutorial...

https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/solarwinds-orion-tutorial#configure-azure-ad-sso

seems to suggest I need a Solar Winds account with SSO enabled.

from the doc:

In the Sign-on URL text box, type a URL using the following pattern:https://<ORION-HOSTNAME-OR-EXTERNAL-URL>/Orion/Login.aspx

Note

These values are not real. Update these values with the actual Identifier, Reply URL and Sign-on URL. Contact SolarWinds Orion Client support team to get these values. You can also refer to the patterns shown in the Basic SAML Configuration section in the Azure portal.

Also this whole marketplace option feels like I have gone down the wrong path. It didn't spin up some preconfigured VM it launched some enterprise application within my azure tenet. Im going to double back and see if I didn't miss another option

jessequijano

yup. don't go to Azure Marketplace that isn't what your want. go to your portal and "create resource". Search "solarwinds". there is currently 15 images one for each module. cose npm. create. needs to go in a new resource group. so you want to do this before spinning and installing gns3 boxes and requesting vcpu limit upgrades. In my case I get to learn about moving resources in Azure which apparently can break things, awesome... Happy Saturday! anyone else have kids shouting in their ear while they study/work at home? it is like patience testing on top of patience testing innit?

jessequijano

also the image of ios i got from the udemy lab doesnt support crypto and im too lazy to go down another hole so im going to establish my “beach head” in mikrotik which i can get freely for gns3. its easy to work with. i have ping connectivity from my virtual mikrotik to the sw server, the gns3 server, and the gns-gui. cant ping it from outside gns3 yet… this is getting a little costly to mess with however it is well well within the limits of the $200 free credit for new azure accounts (at time of this writing) and I have built up and destroyed the environment more time then I care to admit at this point so thats more on me then in azures cost effectiveness.