setting two segeragated lans on same server

[Sandeep_Chaudhary]

I have hp-ux 11.11 server with multiple lans
wuxprbe1# />lanscan
Hardware Station Crd Hdw Net-Interface NM MAC HP-DLPI DLPI
Path Address In# State NamePPA ID Type Support Mjr#
1/0/1/0/0/4/0 0x000F202B83A0 1 UP lan1 snap1 1 ETHER Yes 119
0/0/6/0/0 0x00306E37B78A 0 UP lan0 snap0 4 ETHER Yes 119
LinkAgg0 0x00306EF4F7E1 900 UP lan900 snap900 6 ETHER Yes 119
LinkAgg1 0x000000000000 901 DOWN lan901 snap901 7 ETHER Yes 119
LinkAgg2 0x000000000000 902 DOWN lan902 snap902 8 ETHER Yes 119
LinkAgg3 0x000000000000 903 DOWN lan903 snap903 9 ETHER Yes 119
LinkAgg4 0x000000000000 904 DOWN lan904 snap904 10 ETHER Yes 119

current lan configurations are as below
wuxprbe1# />netstat -in
Name Mtu Network Address Ipkts Ierrs Opkts Oerrs Coll
lan900:1 1500 10.10.253.0 10.10.253.101 335444024 0 1328 0 0
lan1 1500 10.50.254.0 10.50.254.51 14177 0 758 0 0
lan0 1500 192.168.155.0 192.168.155.201 1572599 0 2206271 0 0
lo0 4136 127.0.0.0 127.0.0.1 1022006 0 1022012 0 0
lan900 1500 10.10.253.0 10.10.253.51 5691848 0 346719960 0 0
wuxprbe1# />netstat -rn
Routing tables
Destination Gateway Flags Refs Interface Pmtu
127.0.0.1 127.0.0.1 UH 0 lo0 4136
10.10.253.101 10.10.253.101 UH 0 lan900:1 4136
10.10.253.51 10.10.253.51 UH 0 lan900 4136
192.168.155.201 192.168.155.201 UH 0 lan0 4136
10.50.254.51 10.50.254.51 UH 0 lan1 4136
10.10.253.0 10.10.253.51 U 3 lan900 1500
10.10.253.0 10.10.253.101 U 3 lan900:1 1500
192.168.155.0 192.168.155.201 U 2 lan0 1500
10.50.254.0 10.50.254.51 U 2 lan1 1500
127.0.0.0 127.0.0.1 U 0 lo0 0
default 10.10.253.1 UG 0 lan900 0



10.10.253.51 is my primary interface ip . i want if i login through primary interface i should not able to ping interface with ip 10.50.254.51
please let me know how can i do it?


netconf entry as follows
ROUTE_GATEWAY[0]=10.10.253.1
ROUTE_COUNT[0]=1
ROUTE_DESTINATION[0]=default
INTERFACE_NAME[0]=lan900
IP_ADDRESS[0]=10.10.253.51
SUBNET_MASK[0]=255.255.255.0
INTERFACE_NAME[1]=lan0
IP_ADDRESS[1]=192.168.155.201
SUBNET_MASK[1]=255.255.255.0
IP_ADDRESS[2]=10.50.254.51
SUBNET_MASK[2]=255.255.255.0
INTERFACE_NAME[2]=lan1
BROADCAST_ADDRESS[2]=10.50.254.255
INTERFACE_STATE[2]=up

[Tim Nelson]

ping 10.50.254.51 from where ? the same server it is configured on or from somewhere else entirely, e.g. a different server on a different subnet with no connectivity to 10.50.254.x ?

[Sandeep_Chaudhary]

i am pinging from same server. i am using ip address 10.10.253.51(lan900)in to the server. 10.50.254.51 is ip address of lan1. currently i am able to ping ip address 0.50.254.51 which i dont want. i want complete segeragation. i want to use 10.50.254.51 this ip for backup.

[Matti_Kurkela]

So you want to effectively split the system into two sections, so that any process that uses lan900 (and its child processes, if any) is prevented from using lan1, and vice versa?

That cannot be done with basic network settings. You would need an add-on product like Secure Resource Partitions (SRP) or its predecessor, HP-UX 11i Security Containment.

Unfortunately, SRP is available for 11.31 only, and the Security Containment is for 11.23 only.

https://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=SecurityExt

https://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HP-UX-SRP

MK