HP Procurve 8200 Configuration help

[uk.helpdesk]

Hello Everyone,

This is my first post and my first HP switch configuration so please bear with me.

Config of both the cores have been attached with this post.

Both the switches have been configured with a 40 GB inter link connection i.e. a Trunk.

I have the following queries if anyone can help me with will be grealty apprecaited.

VRRP
====

1. Is the config for VRRP correct ?
2. Will this config in VRRP be stable i.e. once failover occurs will do what is expected ?

Spanning Tree
==============

1. Can I further modify the Spanning tree config by using Root Guard / BPDU Guard / etc..
If yes can somone please give me some help. As I am finding it difficult to understand a sampe config article i read and apply that scenario in my config.

QOS
===

1. Can somone please give me a config for VOIP. We are implementing VOIP and I dont know how to apply any QOS on these switches either.

I am sure many of you have already got a baaseline best practise config for the HP switches running VOIP. The phones are not Cisco.




Any other suggestions
======================

1. Please make any other suggestions OR best practices I can implement which all of you have learnt overtime. So I can get it right the first time.

a. I was thinking I should implement SSH as well.



Thnak you in advance for all your help.

cheers

David

[cenk sasmaztin]

hi David
fristly your vvrp configuration is wrong
please examine following configuration

Core1:
-----
hostname "Core1"
time timezone 240
console inactivity-timer 15
ip routing

vlan 1
name "MAN"
ip address 10.1.1.1 255.255.255.0
exit
vlan 2
name "ADMIN"
ip address 10.1.2.1 255.255.255.0
exit
vlan 3
name "Guest"
ip address 10.1.3.1 255.255.255.0
exit
vlan 4
name "WLAN"
ip address 10.1.4.1 255.255.255.0
exit

ip dns server-address a.b.c.d
ip route 0.0.0.0 0.0.0.0 a.b.c.d

spanning-tree
spanning-tree config-name "IBT"
spanning-tree config-revision 8
spanning-tree instance 1 vlan 1-2
spanning-tree instance 1 priority 0
spanning-tree instance 2 vlan 3-4
spanning-tree instance 2 priority 1
spanning-tree priority 0

router vrrp
vlan 1
vrrp vrid 1
owner
virtual-ip-address 10.1.1.2 255.255.255.0
priority 255
enable
exit
exit
vlan 2
vrrp vrid 1
owner
virtual-ip-address 10.1.2.2 255.255.255.0
priority 255
enable
exit
exit
vlan 3
vrrp vrid 1
backup
virtual-ip-address 10.1.3.2 255.255.255.0
enable
exit
exit
vlan 4
vrrp vrid 1
backup
virtual-ip-address 10.1.4.2 255.255.255.0
enable
exit
exit




Core2:
-----
hostname "Core2"
time timezone 240
console inactivity-timer 15
ip routing

vlan 1
name "MAN"
ip address 10.1.1.2 255.255.255.0
exit
vlan 2
name "ADMIN"
ip address 10.1.2.2 255.255.255.0
exit
vlan 3
name "Guest"
ip address 10.1.3.2 255.255.255.0
exit
vlan 4
name "WLAN"
ip address 10.1.4.2 255.255.255.0
exit

ip dns server-address a.b.c.d
ip route 0.0.0.0 0.0.0.0 a.b.c.d

spanning-tree
spanning-tree config-name "IBT"
spanning-tree config-revision 8
spanning-tree instance 1 vlan 1-2
spanning-tree instance 1 priority 1
spanning-tree instance 2 vlan 3-4
spanning-tree instance 2 priority 0
spanning-tree priority 1

router vrrp
vlan 1
vrrp vrid 1
backup
virtual-ip-address 10.1.1.1 255.255.255.0
enable
exit
exit
vlan 2
vrrp vrid 1
backup
virtual-ip-address 10.1.2.1 255.255.255.0
enable
exit
exit
vlan 3
vrrp vrid 1
owner
virtual-ip-address 10.1.3.1 255.255.255.0
priority 255
enable
exit
exit
vlan 4
vrrp vrid 1
owner
virtual-ip-address 10.1.4.1 255.255.255.0
priority 255
enable
exit
exit

[Shadow13]

Actually the configuration is right, the Virtual IP in both switches must be set to the ip address of the owener, What Cenk posted i think is for XVRRP.

You can double check from the blow document that shows how to configure VRRP on the switches with even using both switches as forwarding ( core 1 for half of the VLANS and core 2 for the other half)

http://h40060.www4.hp.com/procurve/uk/en/pdfs/application-notes/How_to_configure_Virtual_Router_Redundancy_Protocol_%28VRRP%29_Configuration_note_Sept_08_EMEA_Eng_A4.pd.pdf

-Regarding the SHH i think it's better to enable it and disable telnet, since you don't 100% trust the employees :D

- For Root guard, i will pass this since i did not configure it before

-For QoS you can search on interoperability between the phone brand you are using the procurve switches, you will find a document about that i think.

[cenk sasmaztin]

true spanning tree configuration in above vrrp configuration

QoS have two type L2 and L3
L2 QoS running must be on tagged state switch port
if you setting on ip phone L2 priority value
for example priority 6
each frame (ip phone to network) included 4byte priority value, this value aware only tagged state switch port

for L2 config
must be QoS setting on ip phone
must be setting QoS on switch port and swich port must have tagged state

my advice you can use L3 QoS
L3 QoS assign priority value on packet network port number or ip address priority value no needed tagged state switch port
when packet included specific port number or ip address switch forward preferred this packet

for example
with this command port 80 and port 554 hight priority on switch

qos tcp-port 80 dscp 101110
qos tcp-port 554 dscp 101110
qos type-of-service diff-services

[Shadow13]

Nice QoS info Cenk :D

About the VRRP configuration you have posted "Cenk", it's showing that the virtual IP address on both switches are pointing to the other switch which is for XRRP not VRRP

For VRRP the virtual ip address must point to the ip address of the owner switch which is core 1.

The configuration posted by uk.helpdesk is correct and he doesn't have to change anything.

[uk.helpdesk]

Thank you all for responding to this post.

So as for VRRP config I am glad it is correct. I have also enabled the VRRP ping in global config to ensure ping response.

The thing I could not figure out in VRRP is Authentication to ensure security on "each vrid".

Thank you all of your earlier response