Skip to content

Commit 566cf68

Browse files
myhomenwlabmyhomenwlab
committed
Patch for Meraki vMX
* Created a directory for Time Trigger and moved the related files. * Created a requirements.psd1 file to download the required modules. * Added information on the following issue. No parameter defined in the script or function for the input binding 'Timer'.Stack: · Issue Azure#7 · Azure/ha-nva-fo Azure#7 * The Resoruce Group of Meraki vMX is created on a per-instance basis. Therefore, the variable FWRGNAME is divided into FW1RGNAME and FW2RGNAME. * Added Meraki-specific supplementary information to README.
1 parent e600832 commit 566cf68

File tree

4 files changed

+46
-24
lines changed

4 files changed

+46
-24
lines changed

‎function.json renamed to ‎MyTimerTrigger/function.json

File renamed without changes.

‎run.ps1 renamed to ‎MyTimerTrigger/run.ps1

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@
3333
# AZURECLOUD = "AzureCloud" or "AzureUSGovernment"
3434
#
3535
# - Set Firewall VM names and Resource Group in the Azure function app settings
36-
# FW1NAME, FW2NAME, FWMONITOR, FW1FQDN, FW1PORT, FW2FQDN, FW2PORT, FWRGNAME, FWTRIES, FWDELAY, FWUDRTAG must be added
36+
# FW1NAME, FW2NAME, FWMONITOR, FW1FQDN, FW1PORT, FW2FQDN, FW2PORT, FW1RGNAME, FW2RGNAME, FWTRIES, FWDELAY, FWUDRTAG must be added
3737
# FWMONITOR = "VMStatus" or "TCPPort" - If using "TCPPort", then also set FW1FQDN, FW2FQDN, FW1PORT and FW2PORT values
3838
#
3939
# - Set Timer Schedule where positions represent: Seconds - Minutes - Hours - Day - Month - DayofWeek
@@ -50,8 +50,8 @@ Write-Output -InputObject "HA NVA timer trigger function executed at:$(Get-Date)
5050

5151
$VMFW1Name = $env:FW1NAME # Set the Name of the primary NVA firewall
5252
$VMFW2Name = $env:FW2NAME # Set the Name of the secondary NVA firewall
53-
$FW1RGName = $env:FWRGNAME # Set the ResourceGroup that contains FW1
54-
$FW2RGName = $env:FWRGNAME # Set the ResourceGroup that contains FW2
53+
$FW1RGName = $env:FW1RGNAME # Set the ResourceGroup that contains FW1
54+
$FW2RGName = $env:FW2RGNAME # Set the ResourceGroup that contains FW2
5555
$Monitor = $env:FWMONITOR # "VMStatus" or "TCPPort" are valid values
5656

5757
#--------------------------------------------------------------------------

‎README.md

Lines changed: 32 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# Automated failover for network virtual appliances:
2-
## Supporting high availability with user-defined route tables on Microsoft Azure
2+
## Supporting high availability with user-defined route tables on Microsoft Azure (Apply patch for Meraki vMX)
33

44
This guide shows you how to implement high availability for network virtual appliance (NVA) firewalls using custom route tables that direct traffic through
55
an active-passive NVA configuration. These user-defined routes (UDRs) override the Azure default system routes by directing traffic to the active NVA firewall in an active-passive pair. If the active NVA firewall fails for some reason, whether through a planned or unplanned outage, the route can failover to the secondary NVA firewall.
@@ -51,7 +51,10 @@ To set up the Azure resources:
5151

5252
2. Take note of the service principal application ID, key value, and Azure Active Directory tenant ID. You will need these to set up Azure Functions later.
5353

54-
3. [Assign RBAC permissions to the service principal](https://docs.microsoft.com/azure/active-directory/role-based-access-control-configure) for each Azure resource group. For the resource group containing the NVA firewall virtual machines, assign the **Reader** role. For the resource group(s) containing route table resources, assign the **Contributor** role.
54+
3. [Assign RBAC permissions to the service principal](https://docs.microsoft.com/azure/active-directory/role-based-access-control-configure) for Azure **subscription** and **resource group**.
55+
1. For the **subscription** containing the NVA firewall virtual machines, assign the **Reader** role.
56+
Meraki vMX's resource group has limited privileges to change the settings, so we will configure the settings for the higher level subscription.
57+
2. For the **resource group(s)** containing route table resources, assign the **Contributor** role.
5558

5659
4. [Configure the resource tag name and value](https://docs.microsoft.com/azure/azure-resource-manager/resource-group-using-tags#portal) for each route table resource managed by the function app using the following:
5760

@@ -94,23 +97,25 @@ To create, configure, and deploy the function app:
9497

9598
4. Click [Application settings](https://docs.microsoft.com/azure/azure-functions/functions-how-to-use-azure-function-app-settings#settings) and add the following variables and values:
9699

97-
| Variable | Value |
98-
|----------------|-----------------------------------------------------------------------------------------|
99-
| SP\_USERNAME | Application ID of the service principal |
100-
| SP\_PASSWORD | Key value of the service principal |
101-
| TENANTID | Azure Active Directory tenant ID |
102-
| SUBSCRIPTIONID | Azure subscription ID |
103-
| AZURECLOUD | Either *AzureCloud* or *AzureUSGovernment* |
104-
| FW1NAME | Name of the virtual machine hosting the first NVA firewall instance |
105-
| FW2NAME | Name of the virtual machine hosting the second NVA firewall instance |
106-
| FWRGNAME | Name of the resource group containing the NVA firewall virtual machines |
107-
| FWUDRTAG | Resource tag value |
108-
| FWTRIES | *3* (enables three retries for checking firewall health before returning “Down” status) |
109-
| FWDELAY | *2* (enables two seconds between retries) |
110-
| FWMONITOR | Either *VMStatus* or *TCPPort* |
111-
| FWMAILDOMAINMX | DNS domain name containing MX record for sending email alerts |
112-
| FWMAILFROM | Email address to use as “From:” address on email alerts |
113-
| FWMAILTO | Email address to which email alerts should be sent |
100+
| Variable | Value |
101+
|-----------------------------|-----------------------------------------------------------------------------------------|
102+
| FUNCTIONS_EXTENSION_VERSION | ~1 (Deal with [issue](https://github.com/Azure/ha-nva-fo/issues/7)) |
103+
| SP\_USERNAME | Application ID of the service principal |
104+
| SP\_PASSWORD | Key value of the service principal |
105+
| TENANTID | Azure Active Directory tenant ID |
106+
| SUBSCRIPTIONID | Azure subscription ID |
107+
| AZURECLOUD | Either *AzureCloud* or *AzureUSGovernment* |
108+
| FW1NAME | Name of the virtual machine hosting the first NVA firewall instance |
109+
| FW2NAME | Name of the virtual machine hosting the second NVA firewall instance |
110+
| FW1RGNAME | Name of the resource group containing the first NVA firewall virtual machines |
111+
| FW2RGNAME | Name of the resource group containing the second NVA firewall virtual machines |
112+
| FWUDRTAG | Resource tag value |
113+
| FWTRIES | *3* (enables three retries for checking firewall health before returning “Down” status) |
114+
| FWDELAY | *2* (enables two seconds between retries) |
115+
| FWMONITOR | Either *VMStatus* or *TCPPort* |
116+
| FWMAILDOMAINMX | DNS domain name containing MX record for sending email alerts |
117+
| FWMAILFROM | Email address to use as “From:” address on email alerts |
118+
| FWMAILTO | Email address to which email alerts should be sent |
114119

115120
5. If you set FWMONITOR to *TCPPort*, add the following application setting variables and values:
116121

@@ -128,9 +133,11 @@ To create, configure, and deploy the function app:
128133

129134
1. **Choose Source**: External Repository
130135

131-
2. **Repository URL**: <https://github.com/[repo-name]/ha-nva-fo>
136+
2. **Repository URL**: <https://github.com/[repo-name]/ha-nva-fo>
137+
Please change it in the appropriate Repository URL.
132138

133-
3. **Branch**: *master*
139+
3. **Branch**: *patch-meraki-vmx*
140+
Please change it in the appropriate Branch.
134141

135142
4. **Repository Type**: Git
136143

@@ -183,3 +190,7 @@ This solution is basic by design so you can tailor it to your environment. How y
183190
* [Azure Functions documentation](https://docs.microsoft.com/azure/azure-functions/)
184191

185192
* [Azure Virtual Network Appliances](https://azure.microsoft.com/solutions/network-appliances/)
193+
194+
* [vMX Setup Guide for Microsoft Azure](https://documentation.meraki.com/MX/MX_Installation_Guides/vMX_Setup_Guide_for_Microsoft_Azure)
195+
196+
* [Deploying Highly Available vMX in Azure](https://documentation.meraki.com/MX/Other_Topics/Deploying_Highly_Available_vMX_in_Azure)

‎requirements.psd1

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# This file enables modules to be automatically managed by the Functions service.
2+
# See https://aka.ms/functionsmanageddependency for additional information.
3+
#
4+
@{
5+
# For latest supported version, go to 'https://www.powershellgallery.com/packages/Az'.
6+
# To use the Az module in your function app, please uncomment the line below.
7+
'Az.Accounts' = '2.*'
8+
'Az.Network' = '4.*'
9+
'Az.Compute' = '4.*'
10+
'Az.Resources' = '4.*'
11+
}

0 commit comments

Comments
 (0)