SHARIFUL's TECH BLOG

HP also produces another line of switches which are called procurve switches. After HP's acquisition of Aruba Networks, those procurve switches are marketed as Aruba switches. Some of the Aruba switches support stacking. And it is called: VSF - Virtual Switching Framework. Again, I will not cover the stacking architecture, I will show only how to configure a VSF stacking between two Aruba 2530F series switches. Let's define our network constraints; the example has following characteristics - The stack is consisting of two (2) Aruba 2350F series switches of same model and software version. In each switch two (2) 10G ethernet ports are used for stacking purposes. The stacking ports in the switches can be either cross connected or straight through connected in ring topology. In VSF, how switches are connected with each other does not matter. The switches are connected as the diagram below -  Fig 01 - Aruba VSF with 2 switches VSF allows stacking by using ...

Last couple of days I was busy configuring stacking of switches from different vendors. So, I thought it would be better to share my experiences and lessons that I have learned while configuring stacking technology from different network switch vendors. I will not go to the details of different stacking architectures, rather only try to cover how to configure them. First in line is - HPE IRF (Intelligent Resilient Framework). Let's define our network constraints; the example has following characteristics -   The stack is consists of two (2) switches of same model and software version. In each switch two (2) ethernet ports are used for stacking purposes. The stacking ports in the switches are cross connected in ring topology. The switches are connected as the diagram below -  Fig 01 - HPE IRF with 2 switches IRF allows stacking by using normal ethernet network ports, no special stacking ports are required. We have selected 2 forty gigabit et...

Today's writing will be about IPSec configuration when tunnel endpoints are located behind NAT. Let's explain the challenges we need to overcome when a tunnel endpoint is behind NAT. IPSec provides confidentiality, authenticity and integrity. A NAT device alters the source IP adress, so the remote endpoint will fail to match the source IP address. Authentication check will fail because of this alteration. Which also means integrity check will fail also as the original packet was altered in the middle. As the payload is encrypted the NAT device cannot also change anything in encrypted portion of the IP header. NAT-Traversal comes in rescue in such cases. With NAT-T, an extra UDP header is added which encapsulates the IPSec ESP header. As this new UDP header is not encrypted, the NAT device can now make the necessary modifications to the packet, so that encrypted packets can reach to the tunnel endpoint. And finally to the end hosts in the network. During IKE phase, ...