- Recommendations for Applying Preferred Practices
- Principals of Mission-Critical Implementations
- Physical Environment
- Internal Network Planning
- External Network Planning
- System Controller Configuration
- Platform and Domain Administration
- Security
- Error Analysis and Diagnosis
- Platform and Domain Configuration
- Dynamic Reconfiguration
- References
- Related Resources
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
External Network Planning
External network design and planning is completely separate from the MAN internal I1 and I2 networks. The external application networks should be separate and secure VLANs, as required by the application architecture. Additionally, you should configure managing and monitoring network segments using secure, non-routable IP addresses although, in many cases, this is not typical. These network segments should be located on a switch that is separate from the larger core switch VLANs used for applications. The managing and monitoring network is typically used for system administrators and monitoring agents such as Sun_ Management Center (SunMC). This network should connect through the SunMC server and terminal concentrator, as shown in FIGURE 4 on page 11, and should be secured with the appropriate minimization and hardening.
)
FIGURE 4
External Network Overview
Configuring an External System Controller Network
Each system controller comes with two external network 10/100 ports. To ensure maximum redundancy and quick failover, we recommend that you configure both the hme0 and the eri1 public interfaces on both system controllers and include both of the interfaces in an IPMP configuration.
With this type of configuration, seven public IP addresses will be required; two for each system controller's hme0 and eri1 (for a total of four), one for each system controller for local failover (for a total of two), and one floating or community IP address. To do this, use the smsconfig command on each of the controllers and then reboot. Then, test each of the interfaces to ensure they failover. Depending on the requirements of each site, a default router might be required when all domains on a subnet are secured, which can affect the way IPMP test partners work. Refer to the appropriate IPMP procedures for configuration instructions regarding installations that require a default router (available at http://sunsolve.sun.com). This applies to IPMP configurations on the domains, as well. For specific commands and setup instructions refer to the System Management Services Installation Guide and Release Notes for the version of SMS software you are using on the system controllers. FIGURE 5 shows how the system controllers can be implemented with IPMP.
)
FIGURE 5
Implementing System Controllers With IPMP
For security reasons, separate the system controller's two external network connections hme0 and eri1 from all other networks. We recommend that you place this network on separate network switches and that you do not use VLANs on a larger shared core switch. If separate switches are used, monitor them as you monitor other critical network components.