High availability LAN segment with Cisco ISR4451X and 2 x Netgear GS724 - Port-channel vs. BDI vs. BVI?

Question

I have a customer that is getting a new 1Gbps ISP connection and wants his servers connected across two switches for redundancy and protection from:

• failure of a router port
• failure of a network cable
• failure of a switch
• failure of a power supply to a switch

Network architecture:

The router is a Cisco ISR4451X with latest IOS 16.7.1, the switches are Netgear GS724Tv4 and the servers are modern Dell boxes running Ubuntu 16.04 LTS.

The Ubuntu boxes uses the 'bonding' driver with the two gigabit interfaces (eth0, eth1) providing a bonded/teamed interface bond0. The bonding interface is configured for high availability, not throughput.

The network has to run dual stack with public IPv4 and IPv6 but there is no requirement for VLANs.

What's the best approach to configure this on the ISR4451X? The obvious choices appear to be:

1. Redundant interface (but we're going into different switches)
2. Port-Channel
3. Bridge Domain Interface (BDI)
4. Bridge Virtual Interface (BVI)

The goal is to protect against all of the failure modes and avoid MAC address flapping. It shouldn't matter which leg of the bond0 interface the Linux box uses to communicate the packet should find its way back without duplication or drops.

The connections between the ISR4451X and each GS724Tv4 will use the SFP ports (port 23) and the interconnect between the switches can use SFP on port 24. These connections can be in access port or trunk port mode and with or without LACP.

Can someone recommend the best approach?

Mike

Answer 1

Configuring the router with a BVI interface seems to make the most sense. You can't use a port channel, and BDI is for IOS-XE routers. Make the router the root of the spanning tree.

Answer 2

So, after some reading and experimenting I've come up with a solution that works for me using a BDI, VLAN and Rapid spanning-tree.

The problem would appear that spanning-trees are 'per VLAN' because VLAN is a broadcast domain, hence I needed to use a VLAN.

This is what I did:

1. On the Cisco ISR4451X

a) configure Rapid spanning tree as the default

b) configure the two interfaces in a 'service instance' with dot1q encapsulation and VLAN 100

c) arrange for the VLAN tags to be stripped

d) configure one of the interfaces with a lower port priority than the other to give predictable start up

e) configure the BDI with the layer-3 stuff (IPv4 and IPv6)

The config looks like this:

!
spanning-tree mode rapid-pvst
spanning-tree extend system-id
!

!
interface GigabitEthernet0/0/2
 description *** Internet Leg #1 ***
 no ip address
 media-type sfp
 negotiation auto
 no cdp enable
 spanning-tree port-priority 32
 service instance 100 ethernet
  encapsulation dot1q 100
  rewrite ingress tag pop 1 symmetric
  l2protocol peer stp
  bridge-domain 100
 !
!
interface GigabitEthernet0/0/3
 description *** Internet Leg #2 ***
 no ip address
 media-type sfp
 negotiation auto
 no cdp enable
 spanning-tree port-priority 48
 service instance 100 ethernet
  encapsulation dot1q 100
  rewrite ingress tag pop 1 symmetric
  l2protocol peer stp
  bridge-domain 100
 !
!

!
interface BDI100
 description *** Internet LAN ***
 ip address 195.xxx.xxx.1 255.255.255.192
 ipv6 address 2A00:xxxx:xxxx::1/64
 ipv6 enable
 ipv6 mtu 1500
 no cdp enable
 spanning-tree link-type shared
 spanning-tree port-priority 16
!

2. Netgear GS724Tv4 switches

On the switches I used the web-based interface and:

a) create a new VLAN #100

b) made all copper ports work as access ports in VLAN 100 ('U' membership VLAN=100, 'untagged -> tagged' on egress with PVID=100)

c) made the two SFP ports 'tagged' (trunk) ports

d) enabled Rapid spanning-tree as the default

3. Results

I now have both switches and the working and can:

• power fail a switch
• fail any fibre port (trunk)
• unplug either leg of a Linux server (bonded Ethernet)

and the ISR4451X as the root of the spanning tree.

Here's what the router says:

router-4451x#show spanning-tree vlan 100

G1:VLAN0100
  Spanning tree enabled protocol rstp
  Root ID    Priority    32868
             Address     f07f.06bc.f502
             This bridge is the root
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32868  (priority 32768 sys-id-ext 100)
             Address     f07f.06bc.f502
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  0   sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi0/0/2             Desg FWD 4          32.10   P2p
Gi0/0/3             Back BLK 8          48.11   P2p

router-4451x#

Mike