ProCurve networking by HP

ProCurve Manager Plus – Configurable Integration Platform

vaningend — Thu, 10 Jul 2008 12:53:00 GMT

Almost every network consists of components from multiple vendors. Network Administrators want to have a ‘single pain of glass' view on their network. This means that the element manager used by the network administrator's use a management tool that is able to integrate these components. The element manager within a ProCurve network infrastructure is ProCurve Manager Plus, further named PCM+. PCM+ is a secure, advanced Windows-based network management tool that allows administrators to configure, update, monitor, and troubleshoot ProCurve devices centrally with easy-to-use screens. For more information on PCM+ see , http'. One great feature within PCM+, I want to highlight is Configurable Integration Platform, further named CIP. With CIP you can customize PCM+ to provide you:

Define additional network devices (not automatically discovered by PCM) so that you can display and monitor the device in PCM;
Receive SNMP traps from the user-defined devices and display related events in PCM+ GUI;
Launch the user interface for other web-based applications from the PCM+ GUI;
Customize PCM+ toolbars and menus to add links to additional management tools;

With this feature you have the power to integrate these different network components in your network element manager. You also have the ability to integrate third party applications. If you like putty as telnet or ssh client you can integrate this within PCM+. Customize the toolbars with the applications you want to use.

There is a lot of information about CIP within the PCM+ administrators guide, you can download this at ‘ ‘.

I have a couple examples on how to integrate a third party application, switches and events. If you want to try these please send me an email.

My message is play around with CIP and find out the real power for you.

Hewlett Packard, HP, ProCurve, Network, Networking, Tools, Tips, PCM+, PCM+, Management

MPLS per User?

vaningend — Thu, 28 Feb 2008 11:40:00 GMT

These days everybody is thinking about Multiprotocol Label Switching (MPLS) as the core networking technology for their enterprise local area network (LAN). Reason why organizations are thinking about MPLS is segmentation of groups of users, business units etc. My opinion about MPLS is that it’s difficult and very expensive protocol to manage. Within an enterprise LAN administration must be simple to reduce operation costs. A protocol like MPLS is complex to manage and troubleshoot. Another disadvantage is the price for the MPLS equipment. If segmentation is the requirement for these organizations HP ProCurve has the optimal solution ‘MPLS per user’. Products that you can use for this solution is the HP ProCurve Intelligent edge switches in combination with HP ProCurve Identity Driven Manager (IDM). Within IDM you can create policies for users, groups and or devices (like IPT phones, clients etc.). You can assign the policies to Access Policies Groups (APGs). To each APG you can assign policies for different parameters like location, time, system, user/group, endpoint-integrity state and WLAN. The policies consist of a few parameters:

- VLAN

- Access Control List

- QoS

- Bandwidth

Below I provide an example how you can use this solution:

Company X wants to create companywide flexible users in the organization. The company will implement flex desks where everybody can connect and authenticate by IEEE 802.1x to the network via wired LAN and for the conference room via wireless LAN. The company wants to authenticate users and limit their privileges on the network attach to their job role. There are some departments where this flexibility is difficult because of privacy regulations. The HR department is based on the 4^th floor behind a wall of glass. The company also wants to have a lot of flexibility and automation of administration and specific demands on reporting.

To implement this solution the ‘MPLS per user’ solution really fits perfect. You can create a group within Active Directory for e.g. all domain users and HR users (Active Directory groups is not mandatory you can also use IDM own groups). Turn on Auto synchronization and the group will be automatically sync within the IDM application. Now can you create policies, if the HR user connects on the 4^th floor then he/she can access:

- HR apps

- Internet

- Mail

- His/her user share(s).

If the HR user connects to a different location than the 4^th floor he/she can access:

- Internet

- Mail

- His/her user share(s)

- But not the HR apps

All the other users are placed into another group and can access mail, internet and user share. But if these users logon via the wireless LAN they can only access mail, internet. This is fully transparent for the users. The policies will follow the users anywhere anytime. This is really segmentation per user and you control the entry point of the user in a flexible, automated and secure way.

A lot of companies are trying to find the best fit for their enterprise LAN. During this search they are looking for the best relationship between:

- Cost

- Security

- Flexibility

- Speed

The problem is that the points above also have negative influence to each other. For e.g. if you want to have a very secure network the cost will go up and flexibility will drop. The other way around if you want to have a very flexible network cost will go up and security will drop etc. I think that the ‘MPLS per user’ is a perfect solution for enterprise LANs because you implement a lot of flexibility, speed for changes and a lot of security and the cost will be in control.

Hewlett Packard, HP, ProCurve, Network, Networking, Tools, Tips, MPLS, Identity management, Architecture

Playing with STP Protection

vaningend — Tue, 22 Jan 2008 11:16:00 GMT

Most of you will know that the spanning tree protocol is a layer2 protocol which was never designed with maximum security in mind. Over the years, this has resulted in various security configuration options to make sure the end-user edge ports can only perform edge-roles/functions and can't control the entire STP topology anymore.

The key security commands are the "bpdu-protection" on the edge switches and the "root-guard" on the distribution layer switches. Both result in the port being disabled (optionally temporary with the bpdu-protection-timeout command) and an SNMP trap being generated.

To facilitate the test process, this small script (written by Peter Debruyne) can help you to demonstrate the advantage of the bpdu-protection and root-guard features. The script can be run from a standard Windows box, just install WinPcap and follow the readme.txt.

The script will send new root STP BPDU packets for about 12 seconds, so the current (non-protected) network will encounter an STP topology change, then it will sleep for 21 seconds to allow the current network to detect the root failure and encounter another STP topology change back to the original root. This procedure is repeated by the loop.

On the ProCurve switches, you can easily follow this situation by running the "show span" command, and then using the "repeat 1" command to repeat the show process automatically. Next run the fakeroot script and watch the root port flap from the original to the new root port, you may also use some ping -t to watch the network hick every 10-15 seconds.

Then configure your ProCurve switch with the bpdu-protection (on all ports except the uplinks) e.g. with the "span 1-46 bpdu-protection" command for ports 1-46, set the timeout to e.g. 60 seconds with "span bpdu-protection-timeout 60" and retry the test. You will notice that the port of your test box will be disabled for 60 seconds and then it comes back online (if you stop the script, otherwise it will go down again of course). This also allows room for these "standard" end-user issues, where end-users connect e.g. a cable from 1 wall-outlet to another (with or without intermediate switch/hub) and cause the loop. Thanks to the bpdu-protection, the port will be disabled and will be retried after 60 seconds. So if the end-user notices that the network doesn't work, he just needs to remove 1 cable and after a minute the system will be operational again.

Please be aware to run this test only in a controlled test environment! Don't say you haven't been warned. Good luck with the testing and feel free to send any comments.

At the moment it’s possible to add files to the posts. If you are interested in this script please leave you email in a comment post or send me an email.

Hewlett Packard, HP, ProCurve, Network, Networking, Tools, Tips, Spanning Tree, BPDU Protection, Root Guard, STP, Test, Script

Microsoft Windows 2008 Network Policy Server

vaningend — Thu, 17 Jan 2008 14:35:00 GMT

The days for network engineers are changing. Five years ago networking was only focusing on switches and routers. These days a lot of software applications make use or have a big impact on networking infrastructure. Therefore I think it’s important to stay up to date with these technologies. Everybody in this industry knows that Microsoft is soon launching it’s new Windows 2008 server platform. Part of the Windows 2008 server is the Network Policy Server. Network Policy Server will replace the current Internet Authentication Server(IAS). From a networking perspective we use the IAS server for e.g. to authenticate PC’s that are using 802.1x. Within the new Windows 2008 Server platform we have to configure this on the Network Policy Server.

On the web site WindowsNetworking.com I found a very good article from David Davis about the new Network Policy Server. See Understanding new Windows Server 2008 Network Policy Server. One of the reasons Microsoft changes the current IAS server is to support Network Access Protection (NAP). NAP can be used to check the system integrity before accessing the network. In the summary of the above mentioned article you can find a lot of links that provide you information about Network Access Protection. I found the introduction to NAP a good article.

I think that Microsoft NAP has a lot of potential in the market but combing NAP with a ProCurve networking infrastructure provides you a more dynamic IT infrastructure. If you combine NAP in the future with ProCurve Identity Driven Manager you will create a more dynamic and adaptive infrastructure that really controls the edge of the network together with client integrity.

Hewlett Packard HP ProCurve Network Networking Microsoft Windows Network Access Protection Network Policy Server Windows 2008 Server

The beginning of a new ProCurve community.

vaningend — Mon, 14 Jan 2008 14:08:00 GMT

Welcome to the first blog lines in the ProCurve Networking blog.

It is important to start out with the intended purpose of this blog:

1.) Start a technical ProCurve networking community wich connects ProCurve partners and customers to share knowledge about ProCurve products, ProCurve network solutions/architectures, implementation tips & tricks and tools that can do the work.

2.) Provide additional technical information around ProCurve networking for everybody who is working on business development, design ProCurve networks and implements ProCurve networks or just want to know more on these topics.

Sound cool? I think so. Please let me know what you think and feel free to send me your direct feedback (or just post lots of comments).

Dobias van Ingen
Technical Consultant