Change 541362 had a related patch set uploaded (by Jgreen; owner: Jgreen):
[operations/dns@master] add frban1001 and frnetmon1001

https://gerrit.wikimedia.org/r/541362

Change 541362 merged by Jgreen:
[operations/dns@master] add frban1001 and frnetmon1001

https://gerrit.wikimedia.org/r/541362

@Cmjohnson this hasn't moved since November, does it just need network port setup?

eth0 c1a port 6
eth1 c1b port 6

@Cmjohnson @Jclark-ctr could someone do the final bits on this task so we can finish the deploy? This host arrived nearly 6 months ago!

configured bios set password @Jgreen

So I'm not familiar with the frack vlans and bonding setup for interfaces. However, if someone can point out a server this should duplicate in vlan/network settings, I can attempt to duplicate it for this system.

There are a number of vlans on the fsaw: frack-DMZ1-c-eqiad, frack-administration1-c-eqiad, frack-bastion1-c-eqiad (doubt this one), frack-fundraising1-c-eqiad, frack-listenerdmz1-c-eqiad, frack-management1-c-eqiad, frack-payments1-c-eqiad

I've gone ahead and labeled port 6 for this server, so its clearly defined on the switch. However, I did not remove it from the disabled group, as there is no vlan to put it in until I know which one.

Ok, updated the switch (Thanks Arzhel) and put things into the admin vlan to match dns that was already setup.

This should be good to from the network side.

I'm not able to access the management IP, can you check it out?

jgreen@frbast1001:~$ dig frnetmon1001.mgmt.frack.eqiad.wmnet

; <<>> DiG 9.10.3-P4-Debian <<>> frnetmon1001.mgmt.frack.eqiad.wmnet
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34842
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;frnetmon1001.mgmt.frack.eqiad.wmnet. IN A

;; ANSWER SECTION:
frnetmon1001.mgmt.frack.eqiad.wmnet. 3600 IN A 10.64.40.207

;; Query time: 0 msec
;; SERVER: 10.3.0.1#53(10.3.0.1)
;; WHEN: Mon Mar 02 21:35:16 UTC 2020
;; MSG SIZE rcvd: 80

jgreen@frbast1001:~$ ping 10.64.40.207
PING 10.64.40.207 (10.64.40.207) 56(84) bytes of data.
^C

• 10.64.40.207 ping statistics ---

2 packets transmitted, 0 received, 100% packet loss, time 1000ms

Management interface network config had some issues, fixed now.

• enabled console redirection after boot

Updates to iptables rulesets completed. frnetmon1001 added to configs where bismuth is present.

Migrated nessus code, config and reports from bismuth to frnetmon1001 using the instructions here: https://community.tenable.com/s/article/Migrating-Nessus-to-new-Server-Linux

Only change is that the setting of the proxy bits couldn't be done 'secure' until the server was registered so I ran them without the --secure flag for now.

Running a test internal PCI scan and credentialed audit scan to verify functionality.

Internal PCI scan and credentialed audit scan run as expected.

Need to add to icinga once T247855 refactor is done.

Nessus package removed from bismuth and /opt/nessus removed. the tar.gz backup that was used during the transfer is still present on the host, just in case.

Change 582912 had a related patch set uploaded (by Dwisehaupt; owner: Dwisehaupt):
[operations/puppet@production] Add frnetmon1001 as a host to check

https://gerrit.wikimedia.org/r/582912

Change 582912 merged by Jgreen:
[operations/puppet@production] Add frnetmon1001 as a host to check

https://gerrit.wikimedia.org/r/582912

Monitoring enabled. Just need to update netbox and we can close this out.