ITCORP Bogotá — Auditoría y Optimización de Infraestructura de Red

Fecha: Mayo 2025
Ingeniero: Antonio Perez
Alcance: Switch H3C 4800G · AP Aruba IAP 325 · Proxmox HPE G9 · Proxmox Dell R720

system-view
interface Vlan-interface4
 description VLAN 4 INVITADOS
 undo ip address 10.57.2.1 255.255.255.252
 ip address 10.57.2.1 255.255.255.0
 dhcp select relay
 dhcp relay server-select 1
quit
save force

Puertos GE1/0/1-2, 4-6, 8-14, 16-29, 33, 35, 38-39 movidos a VLAN 8 access con undo description.

system-view
interface Bridge-Aggregation1
 description PROXMOX-DELL-R720-10.57.0.240-LACP3x1G
 port link-type trunk
 port trunk permit vlan all
 link-aggregation mode dynamic
quit
interface GigabitEthernet1/0/41
 port link-aggregation group 1
interface GigabitEthernet1/0/42
 port link-aggregation group 1
interface GigabitEthernet1/0/43
 port link-aggregation group 1
interface GigabitEthernet1/0/44
 undo port link-aggregation group 1
 port access vlan 8
quit
save force

system-view
interface Bridge-Aggregation2
 description PROXMOX 10.57.0.122
 port link-type trunk
 port trunk permit vlan all
 link-aggregation mode dynamic
quit
interface GigabitEthernet1/0/11
 port link-aggregation group 2
interface GigabitEthernet1/0/12
 port link-aggregation group 2
interface GigabitEthernet1/0/13
 port link-aggregation group 2
interface GigabitEthernet1/0/14
 port link-aggregation group 2
quit
save force

Hardware: Aruba AP-325 · ArubaOS Instant 8.7.1.0 · Virtual Controller
IP gestión: 10.57.0.90 · Regulación: US (hardware FCC, no modificable)

configure terminal
[cambios]
end
commit apply
write mem

**Nota:** ''commit apply'' solo funciona desde el prompt normal (fuera de config). El ''exit'' del modo config NO persiste cambios.

configure terminal
arm
 min-tx-power 12
 max-tx-power 20
 band-steering-mode prefer-5ghz
 client-aware
 scanning
exit
end
commit apply
write mem

**Nota:** ''80mhz-support disable'' y ''virtual-controller-country CO'' no son válidos en esta build/hardware.

configure terminal
ids
 wireless-containment deauth-only
exit
end
commit apply
write mem

configure terminal
wlan ssid-profile ITCORP
 opmode wpa2-psk-aes
 broadcast-filter arp
 wmm-voice-dscp 46
 wmm-video-dscp 34
 wmm-best-effort-dscp 0
 wmm-background-dscp 8
 wmm-voice-share 100
 wmm-video-share 90
 wmm-best-effort-share 70
 wmm-background-share 40
 dot11r
 okc
exit
end
commit apply
write mem

configure terminal
airgroupservice itunes
 disable
exit
airgroupservice remotemgmt
 disable
exit
airgroupservice sharing
 disable
exit
airgroupservice AmazonTV
 disable
exit
airgroupservice DIAL
 disable
exit
airgroupservice "DLNA Media"
 disable
exit
airgroupservice "DLNA Print"
 disable
exit
airgroupservice allowall
 disable
exit
end
commit apply
write mem

configure terminal
wlan access-rule IoT
 index 4
 rule any any match any any any permit
exit
wlan ssid-profile IoT
 enable
 essid IoT
 wpa-passphrase <password_iot>
 opmode wpa2-psk-aes
 vlan 7
 rf-band all
 broadcast-filter arp
 dtim-period 3
 max-clients-threshold 32
 wmm-background-dscp 8
 wmm-best-effort-dscp 0
 wmm-video-dscp 0
 wmm-voice-dscp 0
 wmm-background-share 40
 wmm-best-effort-share 50
 wmm-video-share 50
 wmm-voice-share 50
exit
end
commit apply
write mem

Hardware: HPE ProLiant · 4 NICs (nic0-nic3) · ArubaOS Instant 8.7
Acceso de recuperación: iLO — ILOMXQ54702SY.ITC.LOCAL

El servidor no respondía en red. Solo nic2 estaba activa como uplink de vmbr0 sin bond configurado.

# Solo nic2 UP como master de vmbr0
# nic0, nic1, nic3 DOWN sin usar
ip link show

Archivo /etc/network/interfaces:

auto lo
iface lo inet loopback

iface nic0 inet manual
iface nic1 inet manual
iface nic2 inet manual
iface nic3 inet manual

auto bond0
iface bond0 inet manual
        bond-slaves nic0 nic1 nic2 nic3
        bond-miimon 100
        bond-mode 802.3ad
        bond-xmit-hash-policy layer2+3
        bond-lacp-rate fast

auto vmbr0
iface vmbr0 inet static
        address 10.57.0.122/24
        gateway 10.57.0.1
        bridge-ports bond0
        bridge-stp off
        bridge-fd 0

source /etc/network/interfaces.d/*

Aplicación:

ifdown vmbr0; ifdown nic2; ifup bond0; ifup vmbr0

Ancho de banda agregado: 4 x 1Gbps = 4Gbps
Partner MAC (switch): 20:fd:f1:8f:42:00

**Pendiente:** Verificar persistencia tras reboot.

—-

Hardware: Dell PowerEdge R720 · iDRAC7 Express · 4 NICs LOM
Acceso de recuperación: iDRAC — 10.57.0.220

El iDRAC7 Express **no tiene puerto dedicado físico** — solo iDRAC7 Enterprise lo tiene. El iDRAC comparte LOM1 con el sistema operativo. GE1/0/40 está conectado a LOM1 y es exclusivo para iDRAC. LOM1 (nic2/enp1s0f0) fue excluido del bond para evitar conflicto LACP.

Archivo /etc/network/interfaces:

auto lo
iface lo inet loopback

iface enp1s0f0 inet manual
iface enp1s0f1 inet manual
iface enp2s0f0 inet manual
iface enp2s0f1 inet manual

auto bond0
iface bond0 inet manual
        bond-slaves enp1s0f1 enp2s0f0 enp2s0f1
        bond-miimon 100
        bond-mode 802.3ad
        bond-xmit-hash-policy layer2+3
        bond-lacp-rate fast

auto vmbr0
iface vmbr0 inet static
        address 10.57.0.240/24
        gateway 10.57.0.1
        bridge-ports bond0
        bridge-stp off
        bridge-fd 0

Aplicación (desde SSH con nohup):

nohup bash -c 'sleep 10; ifdown vmbr0; ifdown bond0; ifup bond0; ifup vmbr0' &

Ancho de banda agregado: 3 x 1Gbps = 3Gbps
Partner MAC (switch): 20:fd:f1:8f:42:00

Internet
   |
SonicWall UTM (10.57.0.2)
   |
H3C 4800G (10.57.0.1)
   |
   +-- GE1/0/40 -------- iDRAC Dell R720 (10.57.0.220)
   +-- BAGG1 (41-43) --- Proxmox Dell R720 (10.57.0.240) — bond0 3x1G
   +-- BAGG2 (11-14) --- Proxmox HPE G9 (10.57.0.122) — bond0 4x1G
   +-- GE1/0/45 -------- AP Aruba IAP 325 (10.57.0.90)
   +-- GE1/0/10 -------- iLO HPE G9
   +-- GE1/0/32 -------- Bridge HUE (IoT VLAN 7)
   +-- GE1/0/3  -------- Impresora (VLAN 11)
   +-- GE1/0/37 -------- SonicWall X6 (VLAN 12)
   +-- GE1/0/1-29 ------ Usuarios Ventas (VLAN 8)

Documento generado por IT Corporation — Base de Conocimientos ITCORP Bogotá