Serviceguard - how to change package IP on line/ off line

domingo, 29 de julho de 2012

Change package IP address off line

Halt the package
# cmhaltpkg -v <package>

Update control files
/etc/cmcluster/package/package.conf

Propagate the changes manually or use cmapplyconf
(legacy or modular)

Start package
# cmrunpck <package>

Check that the IP was added.
# cmviewcl -v

Change package IP address on line

You can change the IP address while a package is up but there's some risky... but can be done.
The recommended is do it off line to avoid any problems.

Use the command cmmodnet to remove the IP addres and after to add.

Using netstat -in check that the ip address is correct.

Check the cluster status:
# cmviewcl -v

Update the package script, propagate the change to other nodes.

For more infos about cmmodnet check man pages.

Serviceguard - Change node ip address

**In this situation we are changing just the ip, the subnet stil is the same**

Backup configuration files:

/etc/hosts
/etc/rc.config.d/netconf
/etc/cmcluster/

Move the package(s) to another node
# cmhaltpkg -v <package>
# cmrunpkg -v -n NODE <package>

Remove node from all packages

Run cmapplyconf (or send the configuration files for others nodes manualy)

Stop the node
# cmhaltnode -v <node>

Remove node from cluster configuration

Apply new cluster configuration

Change IP on node
/etc/rc.config.d/netconf
/etc/hosts
Restart the net deamon for  apply the new network configuration
# /sbin/init.d/net stop
# /sbin/inti.d/net start

Add node to cluster
The bellow link is another post showing how to include a new node in the cluster running.
http://hp-ux-br.blogspot.com.br/2012/05/adding-new-node-in-running-cluster.html

Apply cluster configuration

Start the node again
# cmrunnode -v <node>

Add node to all relevant packages

Apply package configuration

Move package(s) back to node
# cmrunpkg -v -n NODE <package>
# cmhaltpkg -v <package>

Check cluster status
# cmviewcl -v

DHCP/ Bootp server on HP-UX?

sexta-feira, 13 de julho de 2012

You have the option to use the bootpd as a DHCP server, as well as a BOOTP server. You must to add the client entries in /etc/dhcptab and uncomment the bootps line in /etc/inetd.conf (don't forget to restart the inetd, inetd -c). See bootpd(1M) for details.
If you can't see the process running in top don't worry, the deamon must respawn when a client request an IP.

Ipfilter - logging tcp/upd connections

domingo, 8 de abril de 2012

First of all you need the ipfilter installed in you box, Ipfilter is a default software since HP-UX 11.23, for older you can download it free from software.hp.com.

1. Add the following rules to your Ipfilter.

The configuration file used for that is /etc/opt/ipf/ipf.conf.

pass in log first quick proto tcp from any to any flags S keep state
pass out log first quick proto tcp from any to any flags S keep state
pass in log first quick proto udp from any to any keep state
pass out log first quick proto udp from any to any keep state
pass in from any to any
pass out from any to any

2. Load the configuration file or restart the Ipfilter.

# /sbin/ipf -f /etc/opt/ipf/ipf.conf

Once the configuration is loaded every time a UDP or TCP connection is initiated it will be logged to the /var/adm/syslog/syslog.log

Can be a good idea now separate this log from syslog. 

IP forwarding

sábado, 4 de fevereiro de 2012

Check the current state:
# ndd -get /dev/ip ip_forwarding

(0 = disable, 2 = enable)
to enable use the follow command:
# ndd -set /dev/ip ip_forwarding 2

disable:
# ndd -set /dev/ip ip_forwarding 0

If you want leave this configuration permanet you have to add the follow lines in nddconf file
ndd conf file: /etc/rc.config.d/nddconf

lines that need be edited:
TRANSPORT_NAME[X]=ip
NDD_NAME[X]=ip_forwarding
NDD_VALUE[X]=2

Installing Powerpath (EMC)

First of all is necessary send the depot to server, download always the last version.
Obs. It's necessary reboot the server.

This command will install the patch:
#swinstall -x autoreboot=true -x mount_all_filesystems=false -s /tmp/EMCPower.HP.4.1.0.tar EMCpower
Where "-s" will receive the full path of the patch.

It's time to configure now:
This command will ask te registration key.
#emcpreg -install  
#powermt config
#powermt set policy=so dev=all
#powermt save

You can check your disks:
# powermt display dev=all

Check the powerpath configuration:
# powermt display

APA - Auto Port Aggregation

domingo, 8 de janeiro de 2012

HP APA, the HP link aggregation or trunking product, provides the ability to logically group two or more physical network ports into a single “Fat Pipe”, often called a “trunk”. Network traffic is load balanced across all of the links in the aggregation, which allows you to build large bandwidth logical links into the server that are highly available and completely transparent to the client and server applications. This version of HP APA is available for HP-UX 11i v3. For HP-UX 11i v1 and v2, use the HP APA product at HP Auto Port Aggregation - J4240AA.
You have three ways to configure APA, you can do it through SAM/SMH, command line or editing the configuration files.

SMH

1. Log in the server and call the smh:
# smh
Choose Networking and communication.
2. Choose network interface configuration
3. Choose network interface card
Ensure that none of the two interfaces have IP address.
Select network card and press enter.
4. Choose Auto port Aggregation
5. Choose c - create link aggregate.
6. Select Mode = LACP_AUTO and choose both network card and select OK.
Click on OK
7. Now you get aggregated network interface name.
8. Press Enter and assign IP address and other details.
Choose p – View / Modify IP Attributes and put your IP address.

Command line (11.31)

In addition to the preferred SMH GUI and TUI interfaces for configuring and managing HPAPA, HP-UX provides the nwmgr command for managing all LAN-basedand IB-basednetworkinterfaces.The
nwmgr command serves as a single tool for performing all network interface-related tasks, offering the functionality provided by the lanscan, lanadmin, linkloop, lanapplyconf and landeleteconf commands.

Check the current configuration:

# nwmgr -g
This command will show your configuration/status of your NIC and APA if you have it configurated

# nwmgr -g -S apa
This command show just the APA configuration/status.

Now you can choose any configuration mothoods, follow two options useful:

To create a MANUAL mode link aggregate lan900 from ports lan1 and lan2, enter the following command:
# nwmgr -a -A links=1,2 -A mode=MANUAL -I 900 -S apa

# nwmgr -s -S apa -A all --saved --from cu

The port's priority if the link aggregation mode will be MANUAL and will use Hot Standby. The port with thehighest priority will be the primary port.

Now proceed with the creation of the new failover group for lan0 and lan1:

# nwmgr -a -S apa -c lan900 -A links=0,1 -A mode=LAN_MONITOR

# nwmgr -s -S apa -A all --saved --from cu

HP APA enables you to combine 2 to 32 physical link ports into one failover group. A fail over group is a link aggregate in LAN_MONITOR mode.

Check yours interfaces:

# netstat -ni
Check the APA configuration:

# nwmgr -g -S apa

Check if all ports are active:

# nwmgr -v -c lanXXX

Remove a interface from the group:

# nwmgr -d -S apa -c lan901 -A links=1



Obs.

(nwmg) Make changes persist across reboots with the --saved option.You can also use the lanadmin (lanadm was replaced by nwmgr in the 11.31) command from the HP-UX command line prompt to make temporary changes to APA. However, if you change some variables using the lanadmin command, those changes are not preserved across reboots.

Editing the configuration files

Follow the APA configuration files:

 /etc/rc.config.d/hp_apaconf -  This file contains configurationvalues for link aggregates.
 /etc/rc.config.d/hp_apaportconf - This file contains configuration values for specific physical ports that are supported by HP APA.


APA Parms for Link Aggregates — hp_apaconf

In preparing an APA configuration, special attention should be given to the load balancing policy, protocol settings, and lan selections.
Determine the Load Balancing Policy
Use LB_MAC based load balancing for Server-to-Switch configurations. This algorithm uses a portion of the MAC address to determine how data is distributed across physical ports. This is the default and most common algorithm for all link aggregates.

Use LB_IP for Server-to-Router configurations. Be careful with this option because many routers do not support APA. Additionally, if switches are used between the server and the router expect additional complexity.

Use LB_PORT for server-to-server configurations. LB_PORT uses the TCP/UDP protocol to distribute traffic across the aggregate ports. If you don’t have a capable router or switch, this is your only option.

Determine the Protocol Settings
Your choice is determined by the capabilities of the switch, router, or server. APA is not supported on all routers and switches. Check with you networking group to determine your switch/router’s APA capabilities. The switch and server must have matching protocols.

* FEC_AUTO – Cisco’s proprietary Fast EtherChannel (FEC/PAgP) technology). This is NOT standard for all CISCO switches.
* lACP_AUTO – IEEE 802.2ad link aggregation control protocol (LACP)
* MANUAL configured port trunks (Default)

EXAMPLES: 

Configure lans 1,2 and 3 into an aggregate called lan900 for each of the three configuration modes. Where values are not entered, assume the defaults.

For MANUAL configuration:

Edit the hp_apaconf file

HP_APA_INTERFACE_NAME[0]=lan900
HP_APA_LOAD_BALANCE_MODE[0]=LB_MAC
HP_APA_MANUAL_LA[0]=”1,2,3″ <— lans 1, 2 and 3

Edit the hp_apaportconf file

HP_APAPORT_INTERFACE_NAME[0]=lan1
HP_APAPORT_CONFIG_MODE[0]=MANUAL
HP_APAPORT_INTERFACE_NAME[1]=lan2
HP_APAPORT_CONFIG_MODE[1]=MANUAL
HP_APAPORT_INTERFACE_NAME[2]=lan3
HP_APAPORT_CONFIG_MODE[2]=MANUAL

FEC_AUTO Port Configuration Mode

Edit hp_apaconf

HP_APA_INTERFACE_NAME[0]=lan900
HP_APA_LOAD_BALANCE_MODE[0]=LB_MAC
HP_APA_GROUP_CAPABILITY[0]=900 <– Any integer value pointing to the physical ports in the hp_apaportconf

Edit hp_apaportconf
HP_APAPORT_INTERFACE_NAME[0]=lan1
HP_APAPORT_GROUP_CAPABILITY[0]=900 <— must be the same value as in hp_apaconf
HP_APAPORT_CONFIG_MODE[0]=FEC_AUTO
HP_APAPORT_INTERFACE_NAME[1]=lan2
HP_APAPORT_GROUP_CAPABILITY[1]=900
HP_APAPORT_CONFIG_MODE[1]=FEC_AUTO
HP_APAPORT_INTERFACE_NAME[2]=lan3
HP_APAPORT_GROUP_CAPABILITY[2]=900
HP_APAPORT_CONFIG_MODE[2]=FEC_AUTO

LACP_AUTO Port Configuration Mode

Edit hp_apaconf

HP_APA_INTERFACE_NAME[0]=lan900
HP_APA_LOAD_BALANCE_MODE[0]=LB_MAC
HP_APA_KEY[0]=900 <— an integer value pointing to the physical ports in hp_apaportconf

Edit hp_apaportconf
HP_APAPORT_INTERFACE_NAME[0]=lan1
HP_APAPORT_KEY[0]=900 < — must be the same value as HP_APA_KEY in hp_apaconf
HP_APAPORT_CONFIG_MODE[1]=LACP_AUTO
HP_APAPORT_INTERFACE_NAME[1]=lan2
HP_APAPORT_CONFIG_MODE[2]=LACP_AUTO
HP_APAPORT_INTERFACE_NAME[2]=lan3

To stop/start the new configuration (APA doesn’t require a reboot to take effect)

/sbin/init.d/hpapa stop
/sbin/init.d/hpapa start

Assign an ipaddress to lan900.

# ifconfig lan900 ipaddress netmask netmaskaddress
# ifconfig lan900 # # to check
# modify /etc/rc.config.d/netconf ##to make the ipaddress permanent

Verify the status of the link aggregate

* lanadmin -x -v 900 ## will show the number of ports, state, mode
* lanscan -v ## verify which link aggregates have been configured.
* lanadmin –x –p 2 900 ## verify the status of a particular port.

Editing configurations files can minimize the number of stops (which caninterrupt traffic on existing link aggregates). You will then only need to run one series of hplm stop(optional);
hpapa stop
hpapa start
hplm start (optional) to activate the link aggregates and (optionally) fail over groups.

Ipfilter - Configuring HP-UX Ipfilter

sábado, 7 de janeiro de 2012

Firt of all.. check if you have installed the Ipfilter:

# swlist | grep IPF

B9901AA A.03.05.12 HP IPFilter 3.5alpha5

Configuration file:

/etc/opt/ipf/ipf.conf

Check the rulles actives:

# ipfstat -io

Verify that IP Filter is running:

# ipf -V

Check the kernel module is loaded:

# kcmodule| grep -i ipf


To start the Ipfiter:

# /sbin/init.d/ipfboot start

In the file /etc/rc.config.d/ipfconf set the IPF_START to 1 and the ipfilter will be started with the system boot:

IPF_START=1

Follow a simple example, we block any incoming conections from the server 0189 to our HP-UX box:

# vi /etc/opt/ipf/ipf.conf

block in quick on lan0 from 0189 to any
pass in from any to any

It's not recommended use it with ServiceGuard and 11.31, read the docs of Ipfiter for more details.

Looking for WWPN

sexta-feira, 30 de dezembro de 2011

Check the device with ioscan:

# ioscan -fnCfc

Use fcmsutil to get the "World Wide Name":

# fcmsutil /dev/td1 | grep World