Aruba on vlan51

802.1x Port Authentication on HPE Aruba ArubaOS-Switch

Mon, 01 Jan 2024 00:00:00 +0000

How to configure 802.1x port authentication on HPE Aruba ArubaOS-Switch, with MAC authentication for devices that do not support 802.1x (such as printers), and LLDP-MED bypass for VoIP phones.

This guide covers the switch configuration and the Microsoft NPS (Network Policy Server) setup for automatic EAP-RADIUS authentication of PCs, MAC authentication for printers, and voice VLAN bypass for Avaya handsets.

Prerequisites: Microsoft NPS installed and registered in Active Directory, a PKI in place with client certificates deployed to machines you want to authenticate via 802.1x.

ACL / Access Lists on HPE Aruba ArubaOS-Switch

Mon, 01 Jan 2024 00:00:00 +0000

How to create extended ACLs on HPE Aruba ArubaOS-Switch and apply them to a VLAN interface. This example restricts a guest wireless network from accessing any internal address space while allowing internet access.

Scenario #

Guest network subnet: 192.168.0.0/23. Guests must reach the internet but must not reach any RFC1918 internal ranges.

Create the ACL #

cli

ip access-list extended "GUEST-ACL"
 10 permit ip 192.168.0.0 0.0.1.255 192.168.0.0 0.0.1.255
 20 deny ip 192.168.0.0 0.0.1.255 10.0.0.0 0.255.255.255 log
 30 deny ip 192.168.0.0 0.0.1.255 172.16.0.0 0.15.255.255 log
 40 deny ip 192.168.0.0 0.0.1.255 192.168.0.0 0.0.255.255 log
 50 permit ip 192.168.0.0 0.0.1.255 0.0.0.0 255.255.255.255 log
 exit

Line 10 — permits intra-subnet traffic (required for hosts on the /23 to communicate with each other)
Lines 20, 30, 40 — deny RFC1918 ranges
Line 50 — permit all other destinations (internet)

Apply to the VLAN interface #

cli

vlan 10
 name "Guest Network"
 ip access-group "GUEST-ACL" in
 ip address 192.168.0.1 255.255.254.0
exit

The ACL is applied inbound (in) — it inspects traffic as it arrives from guest clients.

DHCP Server on HPE Aruba ArubaOS-Switch

Mon, 01 Jan 2024 00:00:00 +0000

HPE Aruba ArubaOS-Switch has a built-in DHCP server. This guide covers creating a DHCP pool, enabling it on a VLAN, and adding static reservations for individual devices.

Important: You must disable the DHCP server globally before making any changes to pool configuration.

Create a DHCP pool #

cli

conf t
dhcp-server disable

dhcp-server pool "GUEST-DHCP"
 authoritative
 default-router "192.168.0.1"
 dns-server "8.8.8.8,8.8.4.4"
 domain-name "test.local"
 lease 00:01:00
 network 192.168.0.0 255.255.254.0
 range 192.168.0.21 192.168.1.149
exit

Enable DHCP on the VLAN interface #

cli

vlan 10
 name "Guest Wireless"
 ip address 192.168.0.1 255.255.254.0
 dhcp-server
 exit

conf t
dhcp-server enable

Static DHCP reservations #

Each reservation requires its own named pool. Disable the server first:

NTP / SNTP on HPE Aruba ArubaOS-Switch

Mon, 01 Jan 2024 00:00:00 +0000

How to configure SNTP time synchronisation on HPE Aruba ArubaOS-Switch.

Configuration #

Syntax varies slightly between firmware versions — use whichever your switch accepts:

Current syntax:

cli

sntp unicast
timesync sntp
sntp server priority 1 1.2.3.4

Older syntax:

cli

sntp unicast
timesync sntp
sntp server 1.2.3.4

Replace 1.2.3.4 with your NTP server IP. Domain controllers are a practical choice as they run Windows Time Service automatically.

Policy Based Routing (PBR) on HPE Aruba ArubaOS-Switch

Mon, 01 Jan 2024 00:00:00 +0000

How to configure Policy Based Routing (PBR) on HPE Aruba ArubaOS-Switch. Applies to the 3800, 5400zl v2, and 8200 series. PBR can only be applied inbound.

Three components: a class to match traffic, a policy to define the action, and a VLAN/port to apply it.

Scenario #

Traffic from 192.168.10.0/24 to 10.0.0.0/24 uses gateway 2.2.2.1. All other traffic uses 1.1.1.1.

PBR topology — local and internet breakout

Class configuration #

cli

class ipv4 "CLASS-192.168-LOCAL-BREAKOUT"
 5 match ip 192.168.10.0 0.0.0.255 10.0.0.0 0.0.0.255
 exit

class ipv4 "CLASS-192.168-INTERNET-BREAKOUT"
 5 match ip 192.168.10.0 0.0.0.255 0.0.0.0 255.255.255.255
 exit

Policy configuration #

cli

policy pbr "POLICY-INTERNET-BREAKOUT"
 5 class ipv4 "CLASS-192.168-LOCAL-BREAKOUT"
 action ip next-hop 2.2.2.1
 exit
 6 class ipv4 "CLASS-192.168-INTERNET-BREAKOUT"
 action ip next-hop 1.1.1.1
 exit
 exit

Apply to VLAN interface #

cli

vlan 10
 name "192.168.10.0-VLAN"
 ip address 192.168.10.254 255.255.255.0
 service-policy "POLICY-INTERNET-BREAKOUT" in
 exit

Important: locally connected networks #

If other VLANs are on the same switch, PBR will break inter-VLAN routing because it overrides the routing table for matched traffic. Fix this by pointing the local class next-hop at the switch’s own IP:

Port Security on HPE Aruba ArubaOS-Switch

Mon, 01 Jan 2024 00:00:00 +0000

Port security is a form of MAC lockdown (layer 2 control). It lets you limit, restrict or fix the MAC addresses allowed on an individual switch port, and decide what the switch does when that rule is broken. This applies to the HPE Aruba 2920, 2930, 3800, 5400 and 8200 series running ArubaOS-Switch.

I wrote this after a reader asked how to set it up. These are the scenarios I use most.

RADIUS Login Authentication on HPE Aruba ArubaOS-Switch

Mon, 01 Jan 2024 00:00:00 +0000

How to configure RADIUS authentication for switch management logins on HPE Aruba ArubaOS-Switch using Microsoft NPS, allowing administrators to log in with Active Directory credentials.

Switch configuration #

cli

radius-server host 192.168.50.80 key reallysecretkey

aaa authentication login privilege-mode
aaa authentication console login radius local
aaa authentication console enable radius local
aaa authentication telnet login radius local
aaa authentication telnet enable radius local
aaa authentication web login radius local
aaa authentication web enable radius local
aaa authentication ssh login radius local
aaa authentication ssh enable radius local

The local fallback ensures you can still log in if the RADIUS server is unreachable. Do not remove it.

SNMPv3 Configuration on HPE Aruba ArubaOS-Switch with HPE IMC

Mon, 01 Jan 2024 00:00:00 +0000

How to configure SNMPv3 on HPE Aruba ArubaOS-Switch for HPE IMC. The built-in wizard initialises SNMPv3, then you replace the wizard user with a stronger SHA/AES-128 account.

Step 1 — Run the SNMPv3 wizard #

Use throwaway passwords — you will delete this user:

cli

Switch(config)# snmpv3 enable

At the prompts: accept defaults, answer n to creating a SHA user, answer y to restricting SNMPv1/v2c to read-only.

Static ARP for Microsoft NLB Multicast on HPE Aruba ArubaOS-Switch

Mon, 01 Jan 2024 00:00:00 +0000

Microsoft NLB in multicast mode causes switches to flood traffic to all ports because the multicast MAC address is never seen as a source — the switch cannot learn which port the cluster is on and treats it as an unknown destination.

HPE Aruba ArubaOS-Switch does not have a direct static MAC/ARP entry feature like Cisco, but ip arp-mcast-replies combined with IGMP resolves the flooding.

HPE Aruba solution #

cli

ip arp-mcast-replies

Enable IGMP on the NLB client VLAN, and ensure NLB is set to multicast cluster operation mode: