4

I am familiar with adding a secondary ip address to cisco device interfaces in order to work around corner case scenarios, for example having 2 ip subnets within the same vlan, needing to expand when one subnet is exhausted or to migrate the default gateway of a host from one address to another etc.
The implementation scenarios I have seen Customers/clients use seem to point towards poor network design but I am not sure whether its usage is also perfectly valid either?

I would like to know what are the main pitfalls related to using a secondary ip addresses on an interface, i.e use of the same broadcast domain, any impact upon TTL, impact on DHCP, sharing of mac address, sub-optimal routing between hosts etc?

  • I have a server farm that has a secondary address because of legacy systems that haven't had their gateways changed for licensing reasons. That's out of necessity, though. – Ryan Foley Nov 28 '14 at 16:06
3

The use of secondary IP interface addresses on Cisco routers at least do not seem to have major pitfalls necessarily but moreover some limitations I've found it is useful to be aware of.

  • A flat network using secondary addresses/multiple subnets will avoid the need employ dot1q trunking but will generate more broadcast traffic (if the purpose is to be able to increase the number of hosts). Depending on design this can impact upon network performance, specifically the hosts/clients.
  • Routing protocols:
    • In EIGRP neighbour adjacencies will not form on secondary ip addresses full stop.
    • In OSPF then secondary addressed networks are considered as stubs so no hello packets are sent on them and will not form adjacencies either.
    • In BGP then since it acts as an application on top of TCP then its doesn't seem to care if they are primary or secondary due to the TCP process just attempting to match a source address received with an available BGP peer to form neighborship... So this can work but be careful not to mismatch primary and secondary.
  • Packets sourced from the router will be from the primary interface address (Routers on a segment should normally agree on what the primary subnet is).
  • Multicast PIM interface configuration needs routers that connect to each other to use the same subnet as the primary address as opposed to secondary.

To avoid issues then I'll use primary addressing wherever possible and secondary in corner case scenarios.

| improve this answer | |
2

In addition to and in support of the existing answer's conclusion:

Secondary addresses do not support DHCP if the Cisco router is acting as the DHCP relay agent. The router will insert it's primary interface IP address into the DHCP request and the remote server will never see a request for the secondary subnet.

Adding the secondary IP address can change well-known/default behaviors, some IOS and IOS/hardware combinations will disable IP redirects or enable specific CEF functions to support the secondary address feature. Also removing the secondary address will automatically re-enable IP redirects, even if the command was specifically configured on the interface.

Sourcing packets from the secondary address can also be problematic (either for management or troubleshooting), as some commands do not support the source-address option and only offer source-interface which will use the primary interface IP address.

Additionally semi-technical customer admins/users can become easily confused if the network or server is described generally (as in 'vlan ## can't reach server xxx' or 'server yyy is on vlan ##') since the vlan has two subnets attached.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.