https://chasersystems.com/assets/js/04ec2ade.935d0f81.js

1"use strict";(globalThis.webpackChunkchaser_web_ui||=[]).push([[3533],{46560(e,i,s){s.r(i),s.d(i,{assets:()=>c,contentTitle:()=>l,default:()=>m,frontMatter:()=>a,metadata:()=>n,toc:()=>d});const n=JSON.parse('{"id":"discriminat/aws/troubleshooting","title":"DiscrimiNAT OTF on AWS Troubleshooting","description":"Troubleshoot DiscrimiNAT OTF deployments on AWS, including IAM, Elastic IPs, CloudWatch logs, instance sizing, routing, and outbound filtering.","source":"@site/docs/discriminat/aws/troubleshooting.md","sourceDirName":"discriminat/aws","slug":"/discriminat/aws/troubleshooting","permalink":"/docs/discriminat/aws/troubleshooting","draft":false,"unlisted":false,"tags":[],"version":"current","sidebarPosition":94,"frontMatter":{"title":"DiscrimiNAT OTF on AWS Troubleshooting","sidebar_label":"Troubleshooting","description":"Troubleshoot DiscrimiNAT OTF deployments on AWS, including IAM, Elastic IPs, CloudWatch logs, instance sizing, routing, and outbound filtering.","sidebar_position":94,"pagination_prev":null,"pagination_next":null},"sidebar":"tutorialSidebar"}');var o=s(74848),t=s(28453);const r=s.p+"assets/medias/fix-discriminat-case-log-group-aws-0e6a2eda8bee234cc5e2f3be3cfb504b.mp4",a={title:"DiscrimiNAT OTF on AWS Troubleshooting",sidebar_label:"Troubleshooting",description:"Troubleshoot DiscrimiNAT OTF deployments on AWS, including IAM, Elastic IPs, CloudWatch logs, instance sizing, routing, and outbound filtering.",sidebar_position:94,pagination_prev:null,pagination_next:null},l="Troubleshooting",c={},d=[{value:"Video for End Users",id:"video-for-end-users",level:3},{value:"Search for <em>warning</em> messages from DiscrimiNAT",id:"search-for-warning-messages-from-discriminat",level:3},{value:"Elastic IPs not attached to DiscrimiNAT VMs",id:"elastic-ips-not-attached-to-discriminat-vms",level:3},{value:"Logs not appearing in CloudWatch",id:"logs-not-appearing-in-cloudwatch",level:3},{value:"Clients&#39; network traffic sometimes allowed, sometimes not.",id:"clients-network-traffic-sometimes-allowed-sometimes-not",level:3},{value:"Resolution",id:"resolution",level:4},{value:"<em>see-thru</em> mode not working",id:"see-thru-mode-not-working",level:3},{value:"Resolution",id:"resolution-1",level:4}];function h(e){const i={a:"a",code:"code",del:"del",em:"em",h1:"h1",h3:"h3",h4:"h4",header:"header",li:"li",ol:"ol",p:"p",strong:"strong",...(0,t.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(i.header,{children:(0,o.jsx)(i.h1,{id:"troubleshooting",children:"Troubleshooting"})}),"\n",(0,o.jsx)(i.h3,{id:"video-for-end-users",children:"Video for End Users"}),"\n",(0,o.jsx)(i.p,{children:"If you are an application developer, a service owner or an end-user of DiscrimiNAT tasked with getting new domain names working, this <5m video is for you and covers the most common issue along with solutions."}),"\n",(0,o.jsx)("iframe",{referrerpolicy:"strict-origin-when-cross-origin",width:"560",height:"315",src:"https://www.youtube.com/embed/ClQkFDe3jVc?si=xtp_Um22_-TEpy9q&rel=0",title:"YouTube video player",frameborder:"0",allow:"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share",allowfullscreen:!0}),"\n",(0,o.jsxs)(i.h3,{id:"search-for-warning-messages-from-discriminat",children:["Search for ",(0,o.jsx)(i.em,{children:"warning"})," messages from DiscrimiNAT"]}),"\n",(0,o.jsxs)(i.p,{children:["The firewall may have tried to warn you about an issue it can foresee. Search for ",(0,o.jsx)(i.code,{children:'{$.outcome = "warning"}'})," in CloudWatch -> Logs -> Log Management -> DiscrimiNAT -> ",(0,o.jsx)(i.strong,{children:"config"})," log stream. You may find a descriptive clue in the resultant log lines from the last few minutes/hours."]}),"\n",(0,o.jsx)(i.h3,{id:"elastic-ips-not-attached-to-discriminat-vms",children:"Elastic IPs not attached to DiscrimiNAT VMs"}),"\n",(0,o.jsxs)(i.p,{children:["If a Public IP is not found attached to a DiscrimiNAT instance, it will look for any allocated but unassociated Elastic IPs that have a tag-key named ",(0,o.jsx)(i.code,{children:"discriminat"})," (set to any value.) One of such Elastic IPs will be attempted to be associated with itself then."]}),"\n",(0,o.jsxs)(i.p,{children:["An EC2 VPC Endpoint is needed in DiscrimiNAT's subnets for this mechanism to work though \u2013 since making the association needs access to the EC2 API. See the ",(0,o.jsx)(i.a,{href:"https://github.com/ChaserSystems/terraform-aws-discriminat-gwlb#deployment-examples",children:"Terraform"})," or ",(0,o.jsx)(i.a,{href:"https://github.com/ChaserSystems/cloudformation-aws-discriminat-gwlb/blob/main/2az_demo.json#L814-L845",children:"CloudFormation"})," examples."]}),"\n",(0,o.jsx)(i.p,{children:"The IAM permissions needed to do this are already a part of our Terraform modules and CloudFormation templates."}),"\n",(0,o.jsx)(i.h3,{id:"logs-not-appearing-in-cloudwatch",children:"Logs not appearing in CloudWatch"}),"\n",(0,o.jsx)(i.p,{children:"It could be one of these three potential issues:"}),"\n",(0,o.jsxs)(i.ol,{children:["\n",(0,o.jsxs)(i.li,{children:["\n",(0,o.jsx)(i.p,{children:"DiscrimiNAT VMs do n

1ot have an Elastic IP associated."}),"\n"]}),"\n",(0,o.jsxs)(i.li,{children:["\n",(0,o.jsxs)(i.p,{children:["There is a ",(0,o.jsx)(i.em,{children:"logs"})," VPC endpoint in the VPC but not in the subnets where DiscrimiNAT is deployed."]}),"\n"]}),"\n",(0,o.jsxs)(i.li,{children:["\n",(0,o.jsxs)(i.p,{children:["From v2.5.0 onwards of DiscrimiNAT, the CloudWatch log group name changed from ",(0,o.jsx)(i.code,{children:"discrimiNAT"})," to ",(0,o.jsx)(i.code,{children:"DiscrimiNAT"}),". ",(0,o.jsx)(i.del,{children:"While we're working on getting the permissions updated on the AWS Marketplace deployment templates,"})," please ensure the IAM Policy for DiscrimiNAT has the right capitalisation for ",(0,o.jsx)(i.code,{children:"DiscrimiNAT"})," log group."]}),"\n"]}),"\n"]}),"\n","\n",(0,o.jsx)("video",{controls:!0,muted:!0,children:(0,o.jsx)("source",{src:r})}),"\n",(0,o.jsx)(i.h3,{id:"clients-network-traffic-sometimes-allowed-sometimes-not",children:"Clients' network traffic sometimes allowed, sometimes not."}),"\n",(0,o.jsx)(i.h4,{id:"resolution",children:"Resolution"}),"\n",(0,o.jsxs)(i.p,{children:["Please upgrade the instance size from ",(0,o.jsx)(i.code,{children:"t3.small"})," to ",(0,o.jsx)(i.code,{children:"c6a.large"})," or ",(0,o.jsx)(i.code,{children:"c6i.large"}),". This is done via the ",(0,o.jsx)(i.code,{children:"instance_size"})," Terraform variable."]}),"\n",(0,o.jsxs)(i.p,{children:["The ",(0,o.jsx)(i.code,{children:"t3.small"})," instance size only suffices for light loads and a few clients. The ",(0,o.jsx)(i.code,{children:"c6"})," series offers the best CPU to egress bandwidth and price ratios for the kind of work involved."]}),"\n",(0,o.jsxs)(i.p,{children:["Use of other instance size classes, such as ",(0,o.jsx)(i.code,{children:"m"})," and ",(0,o.jsx)(i.code,{children:"r"}),", is not recommended because the DiscrimiNAT is not a memory-intensive application, therefore making machines with more memory than needed not a cost-optimal choice."]}),"\n",(0,o.jsxs)(i.h3,{id:"see-thru-mode-not-working",children:[(0,o.jsx)(i.em,{children:"see-thru"})," mode not working"]}),"\n",(0,o.jsxs)(i.p,{children:["If the ",(0,o.jsx)(i.em,{children:"config"})," logs do not show a log line picking up a ",(0,o.jsx)(i.em,{children:"see-thru"})," rule, you may have a problem with the annotation's implied syntax."]}),"\n",(0,o.jsx)(i.h4,{id:"resolution-1",children:"Resolution"}),"\n",(0,o.jsxs)(i.p,{children:["The ",(0,o.jsx)(i.em,{children:"see-thru"})," mode requires a Security Group Outbound Rule (or the ",(0,o.jsx)(i.em,{children:"see_thru"})," ",(0,o.jsx)(i.a,{href:"/docs/discriminat/aws/default-prefs/#see_thru",children:"default preference"}),") to have a valid calendar date. For example, ",(0,o.jsx)(i.code,{children:"discriminat:see-thru:2022-02-29"})," is NOT a valid date (because 2022 was not a leap year) but ",(0,o.jsx)(i.code,{children:"discriminat:see-thru:2022-02-28"})," is."]})]})}function m(e={}){const{wrapper:i}={...(0,t.R)(),...e.components};return i?(0,o.jsx)(i,{...e,children:(0,o.jsx)(h,{...e})}):h(e)}},28453(e,i,s){s.d(i,{R:()=>r,x:()=>a});var n=s(96540);const o={},t=n.createContext(o);function r(e){const i=n.useContext(t);return n.useMemo(function(){return"function"==typeof e?e(i):{...i,...e}},[i,e])}function a(e){let i;return i=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:r(e.components),n.createElement(t.Provider,{value:i},e.children)}}}]);