In a colo/DC environment, if you had a customer wanting to do their own VLANs & subnetting, would you configure the port going to their L3 switch as a trunk port or an access port?
Add a comment
|
8 Answers
The best solution here would be a routed port. Turn DTP off and leave the port as routed so that VTP updates don't travel into your network and all their layer 2 protocols/information remain on their side.
answered May 26, 2013 at 10:42
-
Having a routed port is only an option if the customers DC port terminates on your L3 platform, if however you have an environment like mine where customers terminate on an intermediate switch a routed port isn't an option. May 26, 2013 at 19:55
If they only need "Internet" or some other kind of L3 connectivity from you, go for access port. Only configure a trunk if your customer has multiple VLANs that are used to interact with your infrastructure (or other customers located in your network). If the customer wants to connect his own switches/sites over your network and wants to use VLANs, try to do Q-in-Q (VLAN/dot1q tunneling) if your equipment supports it.
That said, if you only need to provide L3 connectivity and you're connecting your customer directly to a router, configure the port as a "routed" port (no switchport on Cisco) so you don't have to do mac learning and have no interaction with the customers STP, etc.
answered May 26, 2013 at 10:40
It depends of what are you providing the customer with. Most of the time access port is used for transporting the service to the customer, then it's up to him what he will do with it.
I choose access-port as it is more secure than a trunk-configured-port.
-
Absolutely. Trunk only if you know you have to, otherwise access. And even more, if you can do IP routing in the port, configure port as L3, so you don't need to do any MAC learning and flooding. Also remember to set 'switchport nonegotiate' to disable DTP (dynamic truning protocol).– yttiMay 26, 2013 at 10:28
I would give them a VLL (L2VPN) or a dot1q tunnel port.
But really it depends on what service they are buying
Like most things the answer is it depends,
I've done it before with a Layer-2 Port, the problem you will run into is: - ensure different customer VLAN # do not overlap. i.e use 802.1q tunneling in that case you are like an ISP
If you are providing the customer private line transport, you are likely going to offer the customer a tunneling service between sites with a technology such as MPLS L2VPN (VPLS, or Pseudowire), or QinQ.
If this is not the case, a classic access port will not do the trick since the customer wishes to pass VLANs, and a Trunk port would only work IF you are willing to provision the customer's VLANs through your network instead of transparently tunneling them.
As others have mentioned, Access Ports are the way to go, but in a Colo senario I would look at Private VLAN's as a way to isolate every customer from each other by using Isolated ports thus saving on addressing space in your DC.
trunk port with allowed vlan (theirs) and native vlan encapsulate. mimics an access port but lets you throw multiple vlans at a later stage if you want. Though it depends again on what they've bought from you as described above.
