Wednesday, November 13, 2019

ArubaOS-Switch QinQ Solution with the 3810M


Problem
I have a single uplink (LAG) from my core to my QinQ provider Cisco switch. If I don't add QinQ to my replacement 8400 ArubaOS-CX cores, how can I service multiple svlans with a single uplink from to customer vlans on an ArubaOS 3810M ?

Solution
Link ports as shown in Topology with patch cable jumpers and configure the QinQ switch as below

Topology


Enable qinq mixed-vlan mode and let switch reboot
Procurve-QinQ(config)# qinq mixedvlan
 tag-type              Configure qinq tag-type
<cr>
This command will reboot the device. Any prior configuration
on this config file will be erased and the device will boot up
with a default configuration for the new qinq mode.
Do you want to continue? [y/n] y

Disable BPDU Throttling
no spanning-tree bpdu-throttle

Disable gvrp on interfaces added to svlans
interface 1-3,10,12,14
   unknown-vlans disable
  


Add ports to svlan’s 150, 151, 152
svlan 150
   tagged 1
   untagged 10

svlan 151
   tagged 2
   untagged 12
  
svlan 152
   tagged 3
   untagged 14

Add the interfaces to the trunk
trunk 47-48 trk1 lacp

Tell interfaces what type of qinq port they are
interface 1-3,10,12,14
   qinq port-type provider-network

interface 9,11,13,trk1
   qinq port-type customer-network

Add Dot1q VLANs and Ports
vlan 50
   tagged 9,Trk1
   no ip address
  
vlan 51
   tagged 11,Trk1
   no ip address
  
vlan 52
   tagged 13,Trk1
   no ip address
  
I can now ping across the svlan from Host to Core and back again

Hosts to Core
Host1(config)# show ip
  -------------------- + ---------- -------------- --------------
  VLAN50               | Manual     10.0.50.254     255.255.255.0

Host1# ping 10.0.50.1
10.0.50.1 is alive, time = 1 ms

Host2(config)# show ip
  -------------------- + ---------- -------------- --------------
  VLAN51               | Manual     10.0.51.254     255.255.255.0

Host2# ping 10.0.51.1
10.0.51.1 is alive, time = 1 ms

Host3(config)# show ip
  -------------------- + ---------- -------------- --------------
  VLAN52               | Manual     10.0.52.254     255.255.255.0

Host3# ping 10.0.52.1
10.0.52.1 is alive, time = 1 ms

Core to Hosts

Core(config)# ping 10.0.50.254 
10.0.50.254 is alive, time = 1 ms

Core(config)# ping 10.0.51.254
10.0.51.254 is alive, time = 1 ms

Core(config)# ping 10.0.52.254
10.0.52.254 is alive, time = 1 ms

Enable the WebUI on a MSR Comware Router



On a functioning router:


Enable service type for local user

CMW5
local-user admin
  service-type web


CMW7
local-user admin class manage
  service-type web


ip http enable
ip https enable


web https-authorization mode manual

Enable WebUI

webui log enable

Restrict access from WAN facing interface (g3/0/0 here)

Verify listener port:
dis ip http
HTTP port: 80
Operation status : Enabled
<-- Bad Practice 😱

dis ip https
HTTPS port: 443
Operation status : Enabled


Create ACL and Apply to the inbound interface
acl advanced name BLOCK-REMOTE
  rule 9 deny tcp destination-port eq 443 logging
  rule 10 deny tcp destination-port eq 80 logging
  ! Poke a hole at your own peril

  rule 12 permit tcp source <ip-of-peril> 0 destination-port eq 443
  rule 13 permit tcp source <ip-of-peril> 0 destination-port eq 80

interface GigabitEthernet3/0/0
  packet-filter name BLOCK-REMOTE inbound


Disable <ip-of-peril> from Attack Defenses (if enabled - optional)
acl basic name WAN
  rule 0 permit source <ip-of-peril> 0

interface GigabitEthernet3/0/0
  attack-defense apply policy Defense-Attack-Policy

attack-defense policy Defense-Attack-Policy
  exempt acl name WAN
  http-flood action logging drop
  http-flood threshold 100

Saturday, April 22, 2017

ArubaOS-Switch ArubaOS-CX Comware Cisco CLI Reference Guides

ArubaOS-Switch and Comware and Cisco IOS CLI Reference Guide (Feb 2017)


ArubaOS-CX and ArubaOS-Switch and Cisco IOS CLI Reference Guide (Jan 2019)

 



Background
Huawei is similar to Comware.  Actually, Huawei designed Comware for 3Com via a joint venture (H3C) back in the early 2000s.  3Com bought out H3C in 2007, and HP bought 3Com in 2010 (and by extension H3C). 

After HP's purchase of Aruba, Aruba enveloped their existing wired Procurve product sets, for marketing purposes, under the umbrella of "Campus" products.  "Campus" switching products also include some lower end Comware devices. Some ArubaOS Switches (5400R, 3810M) can be positioned in small data centers s well. ArubaOS-CX is Arubas/HPE's latest Datacenter platform (8400 / 8320 / 8325 / 6300 / 6400).

ArubaOS-Switch CLI is basically the firmware continuation of the now deprecated ProVision os operating the ProCurve switching products.

ArubaOS-CX is an Aruba internally developed, ground up, networking os powering Aruba's 8400/8320/8325/6300/6400/<future> series campus core and aggregation switch platforms. It was designed to migrate with the demands of the mobile, cloud and IoT era. Its key features are in its micro-services style modular architecture, REST APIs, Python scripting capabilities, Aruba Network Analytics Engine and Aruba Virtual Switching Extension (VSX).
 
 

Key Words
Hewlett Packard Enterprise Hewlett Packard HP HPE HPI 3Com H3C Huawei Procurve Provision ArubaOS ArubaOS-Switch ArubaOS-CX Aruba Cisco

Thursday, June 30, 2016

How To Mirror VLAN Traffic to a Monitor Port



Cisco
You can mirror and monitor all traffic from a vlan with 2 statements:

monitor session 1 source vlan 17 - 21, 61 - 62, 68, 79 - 83, 90 - 91
monitor session 1 destination interface Gix/y/z



Comware 7


If you are NOT in IRF Mode - Do the following commands to do the same as above:


mirroring-group 1 local
mirroring-group 1 mirroring-vlan 17 to 21 61 to 62 68 79 to 83 85 90 91 both

interface Ten-GigabitEthernet 1/2/0/24
 mirroring-group 1 monitor-port


If you ARE in IRF Mode - You don’t have this ability natively.  However, you can accomplish the same goal with qos vlan policies.  For the above Cisco syntax, you will need a traffic classifier, a traffic behavior modifier, a qos policy, and multiple binding statements.



traffic classifier MATCH_ALL
 if-match any

traffic behavior MIRROR_DEST
 mirror-to interface Ten-GigabitEthernet1/2/0/24

qos policy MIRROR
 classifier MATCH_ALL behavior MIRROR_DEST

qos vlan-policy MIRROR vlan 17 18 19 20 21 61 62 68 inbound
qos vlan-policy MIRROR vlan 79 80 81 82 83 85 90 91 inbound
qos vlan-policy MIRROR vlan 17 18 19 20 21 61 62 68 outbound
qos vlan-policy MIRROR vlan 79 80 81 82 83 85 90 91 outbound



Depending on platform you may need to create an ACL for the classifier:


acl number 3000
 rule 0 permit ip

traffic classifier MATCH_ALL
 if-match acl 3000





Search Duke

About the Author

My photo
Central Florida, United States