2

I have a stack of 2x 3850 L3 Cisco switches. This stack has multiple SVIs created for several VLANs and is use mainly for distribution (inter-vlan routing).

The problem with the stack is that I can't do patching without a downtime on the stack. Hence, I am breaking up the stack.

With the stack, I have 1 common IP/SVI/VLAN, if I break the stack,

Q1) Is HSRP/VRRP the only way for me to have 1 common gateway IP/VIP for my VLAN ?

Q2) Can I use HSRP on SVIs and use the trunk link between the 2 x L3 switches for the HSRP hello packets as I do not want to use physical interfaces + 3rd switch for the HSRP communication

enter image description here

Q3) I have multiple SVIs/VLANs on my current stack switch -> does that also mean when I breakup the stack and use HSRP instead, I would need to have multiple HSRP groups running concurrently for the different VLANs ?

|improve this question
  • Is the switch stack running as a layer-3 switch as the gateway for the VLANs? – Ron Maupin♦ Dec 17 '17 at 6:21
  • @RonMaupin - yes, the stackswitch is running as a L3 switch with SVI acting as gateway for the VLANs – Noob Dec 17 '17 at 6:22
5

You will need HSRP or VRRP for you FHRP if you want redundancy for your gateway. Each switch will need an SVI for each VLAN, and each VLAN will have its own FHRP group. You place the group for a VLAN on the SVI. The FHRP will use a path on the VLAN (dictated by STP) between the switches for the FHRP traffic.

One thing you want to carefully plan is that the FHRP primary switch should also be the root bridge for the VLAN, otherwise you will get suboptimal traffic paths. For example, if the root bridge for VLAN 10 is Switch 2, but the gateway for VLAN 10 is on Switch 1, any traffic on VLAN 10 that is destined for a different network will first go to the root bridge for the VLAN (Switch 2) before it is sent to the gateway (Switch 1), but if the FHRP primary switch and the root bridge are the same, then the traffic doesn't need to travel between the switches.

A better solution may be to use ISSU for your switch stack. FHRPs are slow to converge, and they are a security weakness on your LAN.

|improve this answer
  • thanks for your prompt response. Never try ISSU before, Is it some kind of live upgrade technology, does it work on stack switches e.g. on 3850 ? – Noob Dec 17 '17 at 6:47
  • Yes. Cisco has done a lot of work toward Non-Stop Forwarding (NSF), Stateful Switchover (SSO), and In-Service Software Upgrade (ISSU). The latest 3850 IOS-XE has these features. Search on Cisco for how to use them. – Ron Maupin♦ Dec 17 '17 at 6:52
  • are you able to point me in the right direction, reading supportforums.cisco.com/t5/lan-switching-and-routing/… and cisco.com/c/en/us/support/docs/switches/… seems like ISSU is not supported on 3850 – Noob Dec 17 '17 at 7:00
  • It really depends on your code version. I think you need to have IOS-XE 16.x (Denali) for ISSU on the 3850. Also, you can look for NSF and SSO. I know Cisco has a 3850 High Availability guide, and other documents that discuss all this. I don't have any handy, and I need to leave right now. – Ron Maupin♦ Dec 17 '17 at 7:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.