topic Re: Isolating network traffic in Operating System - HP-UX

Isolating network traffic

Marco Castillo — Fri, 22 Dec 2006 14:06:28 GMT

I have 2 ethernet cards in the same subnet (no APA). Does anyone have any idea how can I isolate the network traffic of a single application through one of the cards and use the other one for the rest?.

Re: Isolating network traffic

Michael Steele_2 — Fri, 22 Dec 2006 14:35:22 GMT

Dear Marco:

Why can you have different net ids for each lan card? This will force the router to separate the hostname by using two netids. When you use two ips within one subnet the router is always going to take the first entry.

This is done with ServiceGuard packages and backup applications all the time.

http://docs.hp.com/en/B9903-90050/apbs03.html

Re: Isolating network traffic

Marco Castillo — Fri, 22 Dec 2006 14:53:01 GMT

Hey Michael, thanks.. that's exactly what I have in mind, to use one netid for a backup application and leave the other free.. is there any cookbook on how to do this?.. thanks again.

Re: Isolating network traffic

Bill Hassell — Fri, 22 Dec 2006 21:03:10 GMT

You just add the second network card to the subnet by giving it a different IP address. Then update your DNS server with a different hostname (ie, cpua is the original, cpub is the name of the second LAN card.

Now because we don't know anything about the application, I'll assume that users login and run it. So now you instruct users to login to cpub and run the application. The recommendations for webservers or databases or middleware require a lot more thought.

Re: Isolating network traffic

Jim Keeble — Sat, 23 Dec 2006 06:52:06 GMT

There is an ndd parameter called ip_strong_es_model that I think addresses your goals.

# ndd -h |grep strong
ip_strong_es_model - Controls multihoming
# ndd -h ip_strong_es_model

ip_strong_es_model:

Controls the requirement issues related to multihoming as
described in RFC1122, Section 3.3.4.2:

(A) A host MAY silently discard an incoming datagram whose
destination address does not correspond to the physical
interface through which it is received.

(B) A host MAY restrict itself to sending (non-source-
routed) IP datagrams only through the physical
interface that corresponds to the IP source address of
the datagrams.

When set to 0, it corresonds to the "Weak ES Model" and would therefore substitute MUST NOT for MAY in issues (A) and (B).

When set to 1, it corresonds to the "Strong ES Model" and would therefore substitute MUST for MAY in issues (A) and (B).

When set to 2, substitute MUST NOT for MAY in issue (A) and SHOULD for MAY in issue (B).

[0,2] Default: 0

#

Re: Isolating network traffic

Marco Castillo — Fri, 29 Dec 2006 01:41:27 GMT

Thank you very much for your comments. Problem solved.