LAN Card Hell.......

[Michael Tully]

Hi,

A class Web Server using multiple apache trees
HPUX 11
1 x Standard PCI LAN card using hardware address 0/0/0/0
4 way LAN card (HP A5506B PCI 10/100Base-TX 4 port) using 2 ports and individual ip addresses

Background:
Traffic enters fron LAN1 and attempts to exit through LAN2 (different ip) and gets blocked.
When I have a query that comes from lan1 that is from say address www.xyz.com the information is supposed to go to another server through our firewall and retrieve
the information and return it. How can I hard-code each LAN card to only service it's own traffic.
LAN 1 traffic coming in LAN1 traffic going out.
LAN 2 traffic coming in LAN2 traffic going out. etc. etc
I've tried using the 'ndd -set /dev/ip ip_forwarding 0' but this does not seem to make any difference.
Is this something that needs to be set with the LAN cards themselves, or will having configuration work done from within the apache config that will fix this problem.

All answers will receive a reward.....
Beer for Harry if he get this right!!

Cheers
~Michael~

[harry d brown jr]

I'm thirsty:

Rick Jones answer from the link below:

Anyhow, if you are running HP-UX 11, you can use ndd to set ip_strong_es_model to one. This causes route lookups o include the source IP address in addition to the destination IP address. One effect of this is that each interface can have a default route, and that traffic which arrives on one interface will have the reply go out that interface.


from:
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xc57337f45ef7d4118fef0090279cd0f9,00.html

live free or die
harry

[Michael Tully]

Harry,

I forget to mention two things:

1. Each of the LAN cards has it's own IP address, and they use the same router addressing as well.
2. I'll have a look at a post that you mentioned setting 'ndd to set ip_strong_es_model 1' which unfortunately didn't work...

One beer (because I forgot these) ... keep on it....

Thanks mate!

[Michael Tully]

I'm going to have a look at installing some patches that I don't seem to have. Should have got Junior SA to look for these first, DOH!!

PHNE_21031
PHNE_26125
PHNE_24419
PHNE_26771
PHNE_21030

[harry d brown jr]

When are you going to learn? You send the junior SA out for the beer, while you do the actual work !!!

Rick Jones is the network dude. Too bad he doesn't hang around here a lot, he must have a life!

live free or die
harry

[Tim D Fulford]

Risking a grad telling a pharoh to suck eggs...

What does your routing tables look like.. (netsta -rn) & interface definitions (ifconfig lan1).

If the network addresss are close (i.e 158.234.78.xxx & 158.234.79.xxx netmask suposed to be 255.255.255.0 but set to default) & the netmask was set incorrectly you might see this.

Tim

[Michael Tully]

Hi Tim,

No risk mate.... Checking the routing tables, ifconfig definitions and subnet masks was the first port of call. I've been liaising with our Network people as well with. I'm currently look at the patches as I've mentioned above. Too bad it's too soon for a beer!.... It's only
3PM....

Thanks anyway.......
Cheers
Michael

[Tim D Fulford]

Patching aside, does the same thing happen if you switch 'round lan1 & 2?

Tim

[Michael Tully]

The 4 - way card has been checked and each port of the card has been used in a different order (IP wise) except for lan 0 which cannot be changed. Unfortunately this has only happened after the start of using of LAN2 (second port on the 4 -way)

Back to downloading patches.

Mick

[Michael Tully]

Back to the top for any further ideas.... before I implement change control....YUK!!!

[Duncan Edmonstone]

Michael,

Have you considered posting this question on Usenet comp.sys.hp.hpux ?

I beleive Rick Jones still frequents this newsgroup - If he reads this, I'm sure he'll be able to give you a better answer!

HTH

DUncan

[Michael Tully]

Thanks for the info. :-))

I'll load the patches as I've mentioned above and see what the results are after change control yada yada yada and post those results back here. Any other information greatfully received.

Cheers
Michael

[Duncan Edmonstone]

Don't know if you've seen this:
------------------------------
ip_strong_es_model:

Controls support for "Strong End-System Model" described in
RFC1122, Section 3.3.4.2. When enabled, packet source addresses
(and therefore interfaces on a multihomed host) affect selection
of a gateway for outbound packets. Set to 0 to disable; set to 1
to enable. [0,1] Default: 0 (disable)

Setting this value to one will have the beneficial effect of allowing
(should they be desired) per-interface default routes. It also means
that if a packet is received on a given interface, the reply to that
packet will be sent-out that interface. This can be useful if one is
the rare situation of needing to have separate physical (in the
context of IP - see ip_ill_status) interfaces configured with IP
addresses in the same subnet. Generally though, using Auto Port
Aggregation (APA) to create one virtual interface with a logical
interface for each address is a more robust solution.

Also, when ip_strong_es_model is set to a value of one, IP datagrams
arriving on the "wrong" interface (one that does not have an IP
address which matches the IP datagrams' destination IP address) are
discarded.

------------------------------

Which is from the document 'Annotated Output of "ndd -h" -Further Discussions of the Tunes'

to be found here:

ftp://ftp.cup.hp.com/dist/networking/briefs/annotated_ndd.txt

HTH

Duncan