Friday, May 14, 2021

Aruba CX BGP Setup Example

 Very simple setup of BGP and advertising networks.

Version 10.05.0020

Switch 1

1.  Create your Vlan interfaces

vlan 100
    name BGP-1

interface vlan 100
    ip address 20.20.20.254/24

2.  Set up interface

interface 1/1/5
    no shutdown
    no routing
    vlan trunk native 1
    vlan trunk allowed 100

3.  Set up BPG

router bgp 1234
    bgp router-id 20.20.20.254
    neighbor 20.20.20.253 remote-as 12345
    address-family ipv4 unicast
        neighbor 20.20.20.253 activate
        exit
    exit

//  The route-id we are using as the "interface vlan id"... this does not have to be like this... you could set this up as 1.1.1.1 if you would like.  Keep in mind though that if you change it the BGP setup will have to rebuilt itself.
//  The "neighbor" will be the other side of our BGP peer
//  neighbor "20.20.20.253 activate"  will actually enable the routes to transverse between BGP peers

_________________________________________________

Switch 2

1.  Create your Vlan interfaces

vlan 100
    name BGP-1
vlan 200
    name test-vlan

interface vlan 100
    ip address 20.20.20.253/24
interface vlan 200
    ip address 30.0.0.254/24

2.  Set up interface

interface 1/1/5
    no shutdown
    no routing
    vlan trunk native 1
    vlan trunk allowed 100
interface 1/1/7
    no shutdown
    no routing
    vlan trunk native 1
    vlan trunk allowed 200

3.  Set up BPG

router bgp 12345
    bgp router-id 20.20.20.253
    neighbor 20.20.20.254 remote-as 1234
    address-family ipv4 unicast
        neighbor 20.20.20.254 activate
        network 30.0.0.0/24
        exit
    exit

//  Notice that we have added "network 30.0.0.0/24" to our BGP setup... this is the network that we are advertising out through BGP.  If we go back to Switch 1 we can run "show ip route bgp" and we will see that this network is being advertised through BGP and we are able to ping it.



















show bgp ipv4 unicast neighbors
















show bgp ipv4 unicast summary




Monday, November 16, 2020

eduroam - Setup for Windows NPS

 

Windows NPS Config


 

      - we will need to set up the NPS server for local, external access for local users and local access for remote users.

 

       - Setup the 2 external radius servers from eduroam as "Radius Clients".

-   tlrs1.eduroam.us

- tlrs2.eduroam.us 

set the "Shared Secret" and remember them so you can add them on eduroam's webpage later on.


   - Set up the "Group Server" under "Remote Radius Server Groups".... set the name to "eduroam" and add eduroams servers.


 





  Next set up the "Connection Request Policies"

  • "eduroam - School"  - will be triggered for local users that are authenticating FROM School's network.

  • "eduroam - USTopLevel"  -  triggered for local users that are authenticating FROM a EXTERNAL eduroam members network.

  • "eduroam - external"    - will be triggered for non-School domain users that are authenticating FROM School's network.

    •  This profile you will be forwarding to the "Remote Radius Server Group" labeled "eduroam"

 

        - THESE POLICIES NEED TO BE IN THIS ORDER.... you will get a "domain loop" error from eduroam if you have them messed up.


- Below for the “eduroam-External” Policies we are dropping users on a specific vlan, in this case we are dropping them on VLAN 10 (school’s guest network).



  •  Now Setup the "Network Policies"

  • Each Network Policy is pretty much the same.. The only difference is”

    •  Condition: “Windows Groups” 

    • Settings :  “Filter-ID”