Source
r/aws•
ExplodingJesus

EC2\VPC vip reservation

Hello all,

I'm relatively new to AWS and have a VPC set up. I'm setting up adfs and web application proxies. With our on prem installation we just use windows nlb for load balancing between farm members. It's quite fast and easy to configure.

I thought in AWS I'd be able to reserve an address from the dhcp pool used by my vpc and do the same thing with nlb. But I can't find anything in there for that. And my googling has yielded nothing but people asking for the same thing and finding nothing.

I did take a stab at setting up an app elastic load balancer. But after more hours than I'd like to admit trying to set up a simple https handoff all I'm getting are tls negotiation errors manifesting as a http 502 bad gateway. I used a host file override on one of my adfs farm members and verified that the service is indeed returning a 200. But the elb doesn't seem to agree and I can't find logs or anything helpful to aid in resolving that issue. Sec groups between the elb and adfs servers is wide open for now to ensure I'm not blocking something accidentally. I'm to the point where I have wireshark installed trying to find something, anything, to look at.

So, I'm back to really wishing I could just reserve an ip for a vip. I'm pretty sure I'd be done by now.

Am I crazy for wanting this simple thing? Again, I'm new to AWS and certainly open to any advice along those lines. But being able to reserve an ip for a service without attaching it to anything would be pretty great.

I'm open to any thoughts or pointers folks might have. Apologies if that's a bit scattered as I've fried myself a bit staring at this all day. Let me know if there is other info that would help clarify.

Posted Mar 23, 2017, 6:25 PM UTC

314
Flakmaster92•

Wait, I'm confused.

Are you trying to reserve a private IP or a public IP? You can reserve a public IP by allocating an Elastic IP.

Private you can't "reserve" but once an IP address is allocated to an instance, it's stuck to that instance for the lifetime of the instance. As long as you don't terminate the instance, it'll have the same private IP between stop starts

3
ExplodingJesusOP•

Sorry, I can see how I wasn't clear on that point.

The first load balancer (be it nlb or elb) will be internal, and will have a private address. I'll deal with the second, for the waps, when I can get the internal one working.

Private you can't "reserve" but once an IP address is allocated to an instance, it's stuck to that instance for the lifetime of the instance. As long as you don't terminate the instance, it'll have the same private IP between stop starts

Understood, but I don't want to assign the ip to an instance. It's a vip for a service. I want to be able to reserve it so I can use it as the nlb ip, which of course is not instance specific, without fear of a newly created instance trying to claim it. The entire problem is that I don't have a "thing", be it an instance or a network interface or whatever, to claim it and take it out of the pool. Normally I'd just go pick an ip either outside of dhcp, or create a reservation in dhcp for something like this.

All that said, I did wonder if I created a new network interface but then didn't assign it to an instance (so it sits idle and unused) if that might act as a psuedo reservation.

1
Quinnypig•

Why wouldn't you reference the load balancer via DNS?

2
ExplodingJesusOP•

As elsewhere in this thread:

So even if the elb was working, I'd have to create a cname for my service that points at the elb internal dns name. I've read that it simply doesn't work and you have to have an A record, although I've not got far enough to test it personally.

So, I intend to. But I'd have to have a lb working to point at.

1
Quinnypig•

I'm doing exactly what you describe. I assure you, it works! What's broken with the ELB?

2
networkguru•

You can create ENIs with a private IP of your choice. You can then move it around as needed.

1
DMatty•

Public IPs can be "reserved" if you use an Elastic IP. This is good if you need to whitelist a publically routable service (such as NAT or any other service endpoint). They cannot be assigned to ELBs.

Private IPs can be assigned through additional Elastic Network Interfaces though as mentioned, they aren't 'firm'. If you're standing up an environment in AWS, the mentality should be, IPs and services should architectually be considered transient/volitile. In cases such as ADFS or other such services, you can script this through various means.

When using the ELB, you can perform SSL offloading so you don't have to worry about it internally. You won't get any 5XX errors unless the health check fails (and instance taken out of service), or there's some form of server-side error. There are ELB access logs that can be enabled which are pushed through to S3.

3
ExplodingJesusOP•

If you're standing up an environment in AWS, the mentality should be, IPs and services should architectually be considered transient/volitile. In cases such as ADFS or other such services, you can script this through various means.

I guess I'm a bit hung up on this part. When you install adfs you have to provide a service name that gets bound to the local http listeners. ADFS 3.0 uses schannel instead of iis and changing those bindings isn't a great idea from what I've seen. So... I need a vip to assign the service name to even get it installed. Normally you'd create the vip and create an entry in dns that points to it. That entry would be the service name.

So even if the elb was working, I'd have to create a cname for my service that points at the elb internal dns name. I've read that it simply doesn't work and you have to have an A record, although I've not got far enough to test it personally. But I think that adfs http listener doesn't like requests for anything other then that service name (which should be the a record for the vip).

1
DMatty•

Have you looked at the AWS quickstart: http://docs.aws.amazon.com/quickstart/latest/wap-adfs/design.html ?

Not sure if it has anything to help you with, but it might.

You could try using ENI-configured private IPs, or as a last resort (though not recommended), you could attach EIPs to the ADFS instances.

2
ExplodingJesusOP•

I did look at the quick start. But at the (probably out of date) estimate of $5.50 per hour and 8760 hours in a year that comes to $48,180 per year to operate.

The quick start is geared for larger envs (1-15k). I only need to serve a couple hundred. For smaller envs they recommend running adfs on the domain controllers. That didn't sit well with me, so my thinking was that I could just set it up myself on t2.smalls for the 2 cents a hour or whatever it is. And even with 2 adfs servers and 2 waps plus the elb (which I wouldn't need if nlb was an option) I'll still be looking at some significant savings.

1
DMatty•

Well, ya... Modify the template as you see fit - they provide it to you for that purpose. :)

They do note that they're using pretty beefy C-series instances and this also includes an AMI with Windows Server licenses. Definitely start with T-series until you're steady state.

2
huhwhatwhere1983•

You can "reserve" private ip's buy using an eni and assigning an ip address or as others have said use EIP for public ip

1