Smart Link in ProCurve Switches

Smart Link provides link redundancy using dual uplinks between different layers of the network, such as between the access layer and the distribution layer as shown in the figure below.

In this type of scenario Smart Link can be used in place of STP for faster convergence. Normally only the primary connection is active. When the primary connection is down, the backup connection will carry the traffic. This arrangement can be used for load sharing as well, in which case one link is configured as primary for a group of VLANs and the other link as primary for another group of VLANs (similar to MTSP instances).

Below is an example on how to configure Smart Link with VLAN load sharing. VLANs 1-10 are mapped to Smart Link group 1, while VLANs 11-20 are mapped to Smart Link group 2. The "role" option that follows "preemptive-mode" indicates that a Master port will take over as Master (for a group) after it comes back up from a failure.

smart-link group 1 master a1 slave a2
smart-link group 1 protected-vlans 1-10
smart-link group 1 send-control-vlan 1
smart-link group 1 preemption-mode role
smart-link group 1 preemption-delay 10

smart-link group 2 master a2 slave a1
smart-link group 2 protected-vlans 11-20
smart-link group 2 send-control-vlan 11
smart-link group 2 preemption-mode role
smart-link group 2 preemption-delay 10

To view Smart Link configuration and status, use the show smart-link commands.

ProCurve Switches - Illegitimate 802.1x Clients Get past RADIUS via Backup Authentication Method

The symptom is that illegitimate 802.1x clients gain access to the VLANs they are not supposed to be in even though RADIUS authentication is configured.

This is a configuration error that might have easily escaped attention: the backup authentication method is configured as "authorized", which means to allow access without authentication, as seen in the following command:

# aaa authentication port-access eap-radius authorized

If for some reason RADIUS service becomes unavailable, the backup authentication method will kick in, and in this case will allow access with no authentication.

To fix this problem, instead of specifying the backup authentication method as "authorized", use "none" (which means no backup method is used) as follows:

# aaa authentication port-access eap-radius none

ProCurve Switches - Configuring a Failover Link in OSPF

In the above example, switch ProCurve A has two connections to network 10.10.13.0/24. Switch ProCurve A needs to be configured in such a way that when both connections are up, the traffic to and from network 10.10.13.0/24 will pass through ProCurve B (the main link). If the main link is down then the backup link through ProCurve C will carry that traffic. All three ProCurve switches run OSPF for routing.

The method described below also works in the scenario where the main link is connected to the Internet via ISP 1 (the preferred ISP) and the backup link is connected to the Internet via ISP 2. Just replace the remote network address (10.10.13.0/24 in this example) by 0.0.0.0/0.

Using static routes with different administrative distances, then redistribute them into OSPF:

In ProCurve A, configure two static routes as follows:

HP-5406zl(config)# ip route 10.10.13.0/24 192.168.200.2 distance 10
HP-5406zl(config)# ip route 10.10.13.0/24 192.168.300.2 distance 20
HP-5406zl(config)# router ospf redistribute static

The link through ProCurve B has a lower distance than the backup link, so it will be chosen to carry traffic to and from network 10.10.13.0/24 under normal conditions. When this link fails, the link through ProCurve C will kick in as backup. The last command makes sure that these static routes be redistributed throughout the OSPF domain.

In the first two commands, the parameter metric can be modified instead of distance. The effect will be the same.