Hpe on vlan51

802.1x Port Authentication on HPE Aruba ArubaOS-Switch

Mon, 01 Jan 2024 00:00:00 +0000

How to configure 802.1x port authentication on HPE Aruba ArubaOS-Switch, with MAC authentication for devices that do not support 802.1x (such as printers), and LLDP-MED bypass for VoIP phones.

This guide covers the switch configuration and the Microsoft NPS (Network Policy Server) setup for automatic EAP-RADIUS authentication of PCs, MAC authentication for printers, and voice VLAN bypass for Avaya handsets.

Prerequisites: Microsoft NPS installed and registered in Active Directory, a PKI in place with client certificates deployed to machines you want to authenticate via 802.1x.

ACL / Access Lists on HPE Aruba ArubaOS-Switch

Mon, 01 Jan 2024 00:00:00 +0000

How to create extended ACLs on HPE Aruba ArubaOS-Switch and apply them to a VLAN interface. This example restricts a guest wireless network from accessing any internal address space while allowing internet access.

Scenario #

Guest network subnet: 192.168.0.0/23. Guests must reach the internet but must not reach any RFC1918 internal ranges.

Create the ACL #

cli

ip access-list extended "GUEST-ACL"
 10 permit ip 192.168.0.0 0.0.1.255 192.168.0.0 0.0.1.255
 20 deny ip 192.168.0.0 0.0.1.255 10.0.0.0 0.255.255.255 log
 30 deny ip 192.168.0.0 0.0.1.255 172.16.0.0 0.15.255.255 log
 40 deny ip 192.168.0.0 0.0.1.255 192.168.0.0 0.0.255.255 log
 50 permit ip 192.168.0.0 0.0.1.255 0.0.0.0 255.255.255.255 log
 exit

Line 10 — permits intra-subnet traffic (required for hosts on the /23 to communicate with each other)
Lines 20, 30, 40 — deny RFC1918 ranges
Line 50 — permit all other destinations (internet)

Apply to the VLAN interface #

cli

vlan 10
 name "Guest Network"
 ip access-group "GUEST-ACL" in
 ip address 192.168.0.1 255.255.254.0
exit

The ACL is applied inbound (in) — it inspects traffic as it arrives from guest clients.

BFD Static Route Tracking on HPE Comware v7

Mon, 01 Jan 2024 00:00:00 +0000

How to use BFD echo mode with static route tracking on HPE Comware v7. When the primary path fails, BFD detects it rapidly and the tracked static route is withdrawn, activating the backup.

BFD echo mode does not require BFD support on the remote peer — packets loop back through the remote device, so this works with any upstream equipment.

Track is a detection module in Comware that reports positive or negative based on interface status, link status, reachability or performance. Here it’s paired with BFD to watch a remote IP, and static route preferences change the routing table when the far end becomes unreachable.

DHCP Server on HPE Aruba ArubaOS-Switch

Mon, 01 Jan 2024 00:00:00 +0000

HPE Aruba ArubaOS-Switch has a built-in DHCP server. This guide covers creating a DHCP pool, enabling it on a VLAN, and adding static reservations for individual devices.

Important: You must disable the DHCP server globally before making any changes to pool configuration.

Create a DHCP pool #

cli

conf t
dhcp-server disable

dhcp-server pool "GUEST-DHCP"
 authoritative
 default-router "192.168.0.1"
 dns-server "8.8.8.8,8.8.4.4"
 domain-name "test.local"
 lease 00:01:00
 network 192.168.0.0 255.255.254.0
 range 192.168.0.21 192.168.1.149
exit

Enable DHCP on the VLAN interface #

cli

vlan 10
 name "Guest Wireless"
 ip address 192.168.0.1 255.255.254.0
 dhcp-server
 exit

conf t
dhcp-server enable

Static DHCP reservations #

Each reservation requires its own named pool. Disable the server first:

Hardening HPE Comware v5 Switches

Mon, 01 Jan 2024 00:00:00 +0000

How to harden HPE Comware v5 switches by restricting remote access to SSH and HTTPS only and using ACLs to limit management connections to specific hosts.

Note: HPE Comware v5 is end-of-sale on most platforms. These commands remain relevant for H3C and older HPE A/E-series switches still in service.

Disable insecure protocols #

cli

undo ip http server enable
undo telnet server enable

Enable SSH and HTTPS #

cli

ip https enable
ssh server enable

Restrict VTY to SSH only #

cli

user-interface vty 0 4
 protocol inbound ssh

Restrict management access with an ACL #

cli

acl number 2050
 rule 5 permit source 1.2.3.4 0
 rule 10 permit source 10.0.0.0 0.255.255.255
 rule 15 permit source 192.168.0.0 0.0.255.255

Apply to HTTPS and SSH:

IPsec VPN Between Cisco ASA and HPE MSR935 (Comware v5)

Mon, 01 Jan 2024 00:00:00 +0000

Full site-to-site IKEv1 IPsec VPN configuration between a Cisco ASA and an HP MSR935 (Comware v5).

IPsec VPN topology — Cisco ASA to HP MSR935

Tested versions: Cisco ASA 9.1(2), HP MSR935 Comware 5.20.106 Release 2513P09

Addressing: ASA WAN 89.89.89.89, MSR WAN 99.99.99.99, ASA LAN 10.0.0.0/24, MSR LAN 192.168.10.0/24

Phase 1 — IKE #

ASA:

cli

crypto ikev1 policy 5
 authentication pre-share
 encryption aes-192
 hash sha
 group 2
 lifetime 3600

group-policy GroupPolicy_99.99.99.99 internal
group-policy GroupPolicy_99.99.99.99 attributes
 vpn-tunnel-protocol ikev1

tunnel-group 99.99.99.99 type ipsec-l2l
tunnel-group 99.99.99.99 general-attributes
 default-group-policy GroupPolicy_99.99.99.99
tunnel-group 99.99.99.99 ipsec-attributes
 ikev1 pre-shared-key YOUR-PSK-HERE

MSR935:

NTP / SNTP on HPE Aruba ArubaOS-Switch

Mon, 01 Jan 2024 00:00:00 +0000

How to configure SNTP time synchronisation on HPE Aruba ArubaOS-Switch.

Configuration #

Syntax varies slightly between firmware versions — use whichever your switch accepts:

Current syntax:

cli

sntp unicast
timesync sntp
sntp server priority 1 1.2.3.4

Older syntax:

cli

sntp unicast
timesync sntp
sntp server 1.2.3.4

Replace 1.2.3.4 with your NTP server IP. Domain controllers are a practical choice as they run Windows Time Service automatically.

NTP Configuration on HPE Comware v5 Switches

Mon, 01 Jan 2024 00:00:00 +0000

How to configure NTP on HPE Comware v5, including BST (British Summer Time) timezone handling for UK deployments.

cli

system-view
clock timezone BST add 01:00:00
clock summer-time BST repeating 02:00:00 2011 March last Sunday 02:00:00 2011 October last Sunday 02:00:00
ntp-service unicast-server 1.2.3.4 priority 1
ntp-service unicast-server 4.5.6.7 priority 2
save f
quit

The clock summer-time command handles automatic DST transitions (clocks forward last Sunday in March, back last Sunday in October).

NTP Configuration on HPE Comware v7 Switches

Mon, 01 Jan 2024 00:00:00 +0000

How to configure NTP on HPE Comware v7 with BST (British Summer Time) handling for UK deployments.

cli

system-view
clock summer-time BST 02:00:00 March last Sunday 02:00:00 October last Sunday 02:00:00
ntp-service unicast-server 1.2.3.4 priority 1
ntp-service unicast-server 4.5.6.7 priority 2
save f
quit

For Comware v5 syntax, see NTP on Comware v5.

Policy Based Routing (PBR) on HPE Aruba ArubaOS-Switch

Mon, 01 Jan 2024 00:00:00 +0000

How to configure Policy Based Routing (PBR) on HPE Aruba ArubaOS-Switch. Applies to the 3800, 5400zl v2, and 8200 series. PBR can only be applied inbound.

Three components: a class to match traffic, a policy to define the action, and a VLAN/port to apply it.

Scenario #

Traffic from 192.168.10.0/24 to 10.0.0.0/24 uses gateway 2.2.2.1. All other traffic uses 1.1.1.1.

PBR topology — local and internet breakout

Class configuration #

cli

class ipv4 "CLASS-192.168-LOCAL-BREAKOUT"
 5 match ip 192.168.10.0 0.0.0.255 10.0.0.0 0.0.0.255
 exit

class ipv4 "CLASS-192.168-INTERNET-BREAKOUT"
 5 match ip 192.168.10.0 0.0.0.255 0.0.0.0 255.255.255.255
 exit

Policy configuration #

cli

policy pbr "POLICY-INTERNET-BREAKOUT"
 5 class ipv4 "CLASS-192.168-LOCAL-BREAKOUT"
 action ip next-hop 2.2.2.1
 exit
 6 class ipv4 "CLASS-192.168-INTERNET-BREAKOUT"
 action ip next-hop 1.1.1.1
 exit
 exit

Apply to VLAN interface #

cli

vlan 10
 name "192.168.10.0-VLAN"
 ip address 192.168.10.254 255.255.255.0
 service-policy "POLICY-INTERNET-BREAKOUT" in
 exit

Important: locally connected networks #

If other VLANs are on the same switch, PBR will break inter-VLAN routing because it overrides the routing table for matched traffic. Fix this by pointing the local class next-hop at the switch’s own IP:

Policy Based Routing (PBR) on HPE Comware v7

Mon, 01 Jan 2024 00:00:00 +0000

How to configure Policy Based Routing (PBR) on HPE Comware v7. Traffic is matched by ACLs and redirected to an alternative next-hop, overriding the routing table.

Scenario #

The setup is identical to the ArubaOS-Switch PBR guide. The switch (.254) has a default gateway of 2.2.2.1.

PBR topology: local breakout via the default gateway, internet via the firewall at 1.1.1.1

From 192.168.10.0/24: internal traffic (to 10.0.0.0/8 or 192.168.0.0/16) uses the normal routing table, internet traffic is sent to 1.1.1.1.

Policy Based Routing Within a VRF/VPN-Instance on HPE Comware v7

Mon, 01 Jan 2024 00:00:00 +0000

How to configure PBR within a VRF/VPN-Instance on HPE Comware v7. Useful in multi-tenant environments where traffic must be steered within an isolated routing domain.

PBR within a VRF is only supported on Comware v7 — not Comware v5.

Only a few changes are needed compared with PBR outside a VRF: the VPN-Instance has to be referenced in the next-hop and in the ACL rules. A VPN-Instance is Comware’s name for a VRF.

Port Security on HPE Aruba ArubaOS-Switch

Mon, 01 Jan 2024 00:00:00 +0000

Port security is a form of MAC lockdown (layer 2 control). It lets you limit, restrict or fix the MAC addresses allowed on an individual switch port, and decide what the switch does when that rule is broken. This applies to the HPE Aruba 2920, 2930, 3800, 5400 and 8200 series running ArubaOS-Switch.

I wrote this after a reader asked how to set it up. These are the scenarios I use most.

RADIUS Login Authentication on HPE Aruba ArubaOS-Switch

Mon, 01 Jan 2024 00:00:00 +0000

How to configure RADIUS authentication for switch management logins on HPE Aruba ArubaOS-Switch using Microsoft NPS, allowing administrators to log in with Active Directory credentials.

Switch configuration #

cli

radius-server host 192.168.50.80 key reallysecretkey

aaa authentication login privilege-mode
aaa authentication console login radius local
aaa authentication console enable radius local
aaa authentication telnet login radius local
aaa authentication telnet enable radius local
aaa authentication web login radius local
aaa authentication web enable radius local
aaa authentication ssh login radius local
aaa authentication ssh enable radius local

The local fallback ensures you can still log in if the RADIUS server is unreachable. Do not remove it.

RADIUS Login Authentication on HPE Comware v7 Switches

Mon, 01 Jan 2024 00:00:00 +0000

How to configure RADIUS management login on HPE Comware v7 using Microsoft NPS.

This covers the Comware configuration only. For the NPS server setup, see the ArubaOS-Switch RADIUS login guide which covers the NPS side in full.

Configuration #

Create a RADIUS scheme:

cli

radius scheme nps
 primary authentication x.x.x.x
 primary accounting x.x.x.x
 key authentication simple reallysecurekey
 key accounting simple reallysecurekey
 user-name-format without-domain

Apply to the default domain:

Secure Remote Access on HPE Comware v5 Switches

Mon, 01 Jan 2024 00:00:00 +0000

By default, HPE Comware v5 has no remote access authentication configured. This guide covers local user setup, SSH, HTTPS, and console port protection.

Security note: Use 2048-bit RSA minimum. The 1024-bit size shown below is cryptographically weak and should not be used on switches still in active service.

Create a local user #

cli

system-view
 local-user admin
 password simple PASSWORD
 authorization-attribute level 3
 service-type web terminal
 service-type ssh

Use password cipher rather than password simple in production to store a hashed value.

SNMPv3 Configuration on HPE Aruba ArubaOS-Switch with HPE IMC

Mon, 01 Jan 2024 00:00:00 +0000

How to configure SNMPv3 on HPE Aruba ArubaOS-Switch for HPE IMC. The built-in wizard initialises SNMPv3, then you replace the wizard user with a stronger SHA/AES-128 account.

Step 1 — Run the SNMPv3 wizard #

Use throwaway passwords — you will delete this user:

cli

Switch(config)# snmpv3 enable

At the prompts: accept defaults, answer n to creating a SHA user, answer y to restricting SNMPv1/v2c to read-only.

Static ARP for Microsoft NLB Multicast on HPE Aruba ArubaOS-Switch

Mon, 01 Jan 2024 00:00:00 +0000

Microsoft NLB in multicast mode causes switches to flood traffic to all ports because the multicast MAC address is never seen as a source — the switch cannot learn which port the cluster is on and treats it as an unknown destination.

HPE Aruba ArubaOS-Switch does not have a direct static MAC/ARP entry feature like Cisco, but ip arp-mcast-replies combined with IGMP resolves the flooding.

HPE Aruba solution #

cli

ip arp-mcast-replies

Enable IGMP on the NLB client VLAN, and ensure NLB is set to multicast cluster operation mode:

VRF / VPN-Instance Inter-VLAN Routing on HPE Comware v7

Mon, 01 Jan 2024 00:00:00 +0000

How to route between VLANs that sit in different VPN-Instances (VRFs) on an HPE Comware switch.

A customer running VPN-Instances on HPE Comware 5500-HI switches needed the switch to act as the default gateway and route between two VPN-Instances. A VPN-Instance splits the routing table, the same as a VRF on Cisco, so this isn’t enabled by default. You can’t do it with static routing: it needs MP-BGP to leak routes between the instances using route targets.

Adding Devices to HPE IMC with Access Parameter Templates

Wed, 01 Jun 2016 00:00:00 +0000

Adding a device to IMC is straightforward once you get the hang of it, but a little preparation makes sure devices go in properly and stay manageable.

1. Set up access parameter templates first #

IMC’s first screen prompts you to add a device. Before you do, create templates for SNMP and SSH access. You can then apply the same credentials to groups of devices instead of typing them in every time.

Fixing "Device Denied SNMP Access" Traps in HPE IMC

Wed, 01 Jun 2016 00:00:00 +0000

IMC needs correct SNMP credentials to read the MIBs on each device. When they’re wrong, you’ll see traps like these:

cli

Trap Name: Device Denied SNMP Access
Severity: Major
Trap Time: 2016-05-30 19:41:43
Description: Device "My Network Switch" denied access.

cli

iMC: 10.0.10.10
Trap of Source: MYSWITCH (10.0.10.254)
Location: Home
Contact: "Network Admins"
Trap Name: Authentication Failure
Severity: Warn
Trap Time: 2016-05-31 07:15:23
Description: Device receives an SNMP message with an erroneous community string

These are almost always the device (switch, firewall and so on) refusing IMC’s requests. Check the device’s own logs and you’ll usually find the failures line up with IMC’s polling times.

HPE IMC Installation and Upgrade Errors (and Fixes)

Wed, 01 Jun 2016 00:00:00 +0000

This isn’t a step-by-step install guide. It’s a collection of problems I’ve hit while installing and upgrading IMC, and how I got past them.

Installing: .NET 3.5 “source files could not be found” #

On Windows Server 2012, IMC’s installer needs the .NET Framework 3.5 feature, which can fail to install because the source files can’t be found.

Mount the Windows Server ISO (here as D:) and run this from an elevated command prompt, changing the drive letter if needed:

Monitoring Hyper-V Hosts in HPE IMC with VRM (without SCVMM)

Wed, 01 Jun 2016 00:00:00 +0000

How to add a Hyper-V host to IMC and monitor it with VRM (Virtual Resource Manager), without System Center Virtual Machine Manager (VMM). Written against IMC 7.1.

Make sure the VRM component is deployed, using the Intelligent Deployment Monitoring Agent (IDM).
Install the LLDP agent on the Hyper-V server.
Install the VRM agent on the Hyper-V server.
Point the VRM agent at the IMC server address on port 8800. The agent’s settings label this field “IMG”.
Configure WMI credentials for the host in IMC.

You don’t need to add PowerShell parameters unless you’re using VMM.

Tuning Link Up/Down Flap Alarms in HPE IMC

Thu, 01 Jan 2015 00:00:00 +0000

IMC raises this alarm when a port flaps:

cli

iMC alarm system found event (Link UP) and event (Link DOWN) had 3 intermittent failures from <date/time> to <date/time>

Investigate before tuning #

Don’t dismiss link flaps. Find the device and port in the alarm, log into the switch, and check the log (newest first on ArubaOS-Switch):

cli

show logging -r

Look for errors like this one, which point to a real physical problem you need to fix: