Cant get SO to respond to TCP health checks from LB

[rsjr81]

Hello,

I am trying to standup a stand alone SO in an environment that requires network VTAPs send traffic to a Load Balancer and the LB requires the backends to pass a Health Check before sending the traffic. I have tried to configure the Health Check to be TCP/22 but the SO still will not respond on it "Monitoring" interface, Health Check will work for a generic CentOS system. I dont understand this since I set the SO to respond to SSH on this interface and I have tested ssh into the SO from this vNIC. So does anyone know how I could either add HTTP/HTTPS to respond to the Monitoring interface and not just the Management interface or items to check to find out why the TCP/22 service doesnt answer the LB.

Any help would be appreciated.
Thanks.

[InfosecGoon]

The monitoring interface is in promiscuous mode -- it doesn't have an IP address, so there's no way to run a service check against it.

[rsjr81]

I have been able to add a static IP on the Monitor interface and I was able to get my NLB Health check to pass and still add Promiscuous to the interface. When I run 'sudo tcpdump -i ens5 -s 1500 -vv port not 22' I see the traffic I am looking for in my console but does that mean SO is ingesting it? Also when looking at ifconfig I see a lot of packets RX for ens5 but 0 for bond0, should bond0 be matching the Monitoring interface?

[InfosecGoon]

All of the physical network interfaces that you're using for monitoring should be part of bond0 -- do they show up in "nmcli con"?

[InfosecGoon]

Just to be clear, is this a deployment in a cloud environment?

[rsjr81]

Yes this deployment is in the Oracle OCI Cloud Environment. When I run nmcli I see ens5 (Monitor), ens3 (Management), bond0 green and in the list. When I run nmcli device the 3 interfaces show connected.

[InfosecGoon]

Okay, my apologies -- I was thinking this was an on-prem deployment, in which case the monitoring interface would be IP-less by default and part of the bond0. I'm afraid I don't know anything about the networking capabilities of Oracle Cloud, does it support traffic mirroring via encapsulated tunnels like AWS?