9

I'm in the middle of setting up a lab with a VRRP configuration, and I'm trying to search for any possible issues we might run into in production.

One issue I am aware of with VRRP is that it seems that STP convergence time (of about 45 seconds I believe) can sometimes cause the VRRP nodes to flap. According to my diagram, I can't see any loops (ignoring the multi-homed servers at the bottom), so I suppose I can just disable STP and forget about it. But I'd like to see what happens with STP enabled, all the same.

I am using Vyatta Core 6.5 for both ISPA and ISPB's routers. I am running the VMs on VMWare workstation.

The reason my lab includes switches between ISPA and ISPB is that in production we are using these to terminate the fibre uplinks to our provider. So I've tried to make my lab as close to production as possible.

My configuration is like so:

VRRP Lab Diagram

My issue is that, right now, the switches don't actually exist in my lab. I am simply using LAN Segments in VMWare workstation to allow the Vyatta VMs to talk to one another. My issue is that because all the connections between VMs is done inside the Hyervisor, it seems there is no possibility to test things like this.

My question is: Can someone think of a way of connecting these VMs together in such a way that it would simulate physical Vyatta machines connected via Cisco (or otherwise) switches, so that I can test STP (and anything else I can think of)?

What I've tried

Using GNS3 to inter-connect VMs

One thing I have tried doing is getting the VMs to communicate via GNS3 using VMNet Host-Only adapters to integrate with GNS3, then using a Cisco 3745 with a FastEthernet switching module added. There's a few issues here:

  • In my lab I am using a single subnet to talk between ISPA and ISPB (10.11.246.0/29).
  • VMWare expects that a single VMNet adapter uses a single subnet, so I cannot use multiple separate VMNet adapters with the one 10.11.246.0/29 subnet.
  • In any instance where two VMs use the same VMNet adapter, packets are sent directly to each other, and so without separate VMNet adapters, I can't see a way forcing the VMs to communicate via a GNS3 router.
  • My understanding is that with VRRP, using a subnet smaller than what could accomodate all nodes + virtual IPs would be considered a hack and not advisable. So for example, using /30s and multiple VMNet adapters is not a good idea.

Other Notes

  • I am open to using other Virtual Machine platforms such as virtual box.
  • I have a physical Cisco Catalyst 2950 at my desk, and the host machine has two physical NICs available.
Improve this question
6
  • 1
    I can see a loop so I wouldn't disable STP. ISPB-BDR-01, ISPB-BDR-02, Cisco switches is one loop. ISPB-BDR-01, ISPB-BDR-02 and ISPB-BDR-SW01 and ISPB-BDR-SW02 is another. 45 seconds seems a long time, do you have rapid-spanning enabled (802.1w)? This would lower the convergence time. Where is the STP root bridge? It is recommended to have the STP root on the active VRRP/HSRP device.
    – Epaphus
    Jun 30, 2013 at 9:10
  • @Epaphus Oh really? I must be fundamentally mis-understanding what consistitutes a loop. I don't currently have rapid-spanning enabled, though I would have thought that either way the fact that there is a convergence time means I would want to test to ensure that said convergence time is still low enough. Regarding STP root, I haven't given any thought to STP configuration as of yet, since I'm still focused on putting together the lab in order to test such configuration (and as you might have guessed I have minimal experience with STP).
    – Geekman
    Jun 30, 2013 at 9:54
  • @Epaphus Oh I think I see now. This is because even though there's only one physical connection between each router <-> switch combination, they're all part of the same broadcast domain, so this still consistitutes a loop. Right?
    – Geekman
    Jun 30, 2013 at 10:02
  • Why is this worry? You are stuck with 802.1D only? Can't you run RSTP?
    – laf
    Jul 1, 2013 at 9:08
  • Unless you are going to work real hard and enable bridging in your routers (or your diagram is not right) there is no loop because 2 switches are not interconnected.
    – fredpbaker
    Jul 20, 2013 at 20:16

3 Answers 3

Reset to default
1

My question is: Can someone think of a way of connecting these VMs together in such a way that it would simulate physical Vyatta machines connected via Cisco (or otherwise) switches, so that I can test STP (and anything else I can think of)?

You can use ESXi hypervisor to run the VM's which is free and add on the NEXUS 1000 Cisco virtual switch. Nexus switch download

Improve this answer
0

I don't understand your worry about VRRP.

Looking at the topology none of the switches are attached to each other. Unless you are doing something crazy like enabling bridging on the servers dont see how you create a loop.

More interestingly if ISP-BDR-01 is attached to LAN 2 and ISP-BDR-01 is attached to LAN 1 they don't see each other at layer 2, Cisco routers do not allow same subnet on multiple interfaces so I would suggest your topology as documented does not work. Now adding a link between the switches fixes that, connecting the switches together does not create a loop either.

Most routers support adjustmets in timers so that you can if you wish set VRRP failover to be larger than STP convergence, but given the simple topology, you are worried about the wrong thing

Improve this answer
3
  • My understanding is that the loop is caused because, for example, you can get from router ISPB-BDR-01 to ISPB-BDR-02 via either ISPB-BDR-SW01 or SW02, so that's two possible paths within the same broadcast domain, so there's the loop. I'm not 100% on this, but it makes sense. In reference to your second paragraph, I'm going to assume you're talking about ISP_B_-BDR-01/02. Where does my digram show that they are on separate LANs? Both routers share the same LAN on the public-facing NICs (it says LAN1 on left and right), and another (LAN2) on the private side.
    – Geekman
    Jul 6, 2013 at 13:33
  • I guess my issue is not so much how to solve this potential problem, because I did see there's a preempt-delay parameter in Vyatta that I'm guessing would resolve any potential problems. But issue is more - how can I test this out with minimum physical hardware? Particularly STP stuff, but there's probably a bunch more things I haven't thought of.
    – Geekman
    Jul 6, 2013 at 13:35
  • at list in cisco land you CANNOT configure the same subnet on 2 interfaces in the same router. so yes subnet A can go ISPB-BDR-01 to ISPB-BDR-02 via ISPB-BDR-SW01 but a DIFFERENT subnet would go via SW01 also to have a L2 loop the routers have to forward at L2 and they do not that is ISPB-BDR-01 will NEVER forward an ARP from SW01 to SW02
    – fredpbaker
    Jul 20, 2013 at 20:19
0

ok, you have to have stp on, do any of the users have a laptop? long Ethernet cables? two-port adaptors? hehe, user rules! what about the server farm? no loop potential there eh?

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.