4

I have a customer that is getting a new 1Gbps ISP connection and wants his servers connected across two switches for redundancy and protection from:

  • failure of a router port
  • failure of a network cable
  • failure of a switch
  • failure of a power supply to a switch

Network architecture:

Dual LAN with HA

The router is a Cisco ISR4451X with latest IOS 16.7.1, the switches are Netgear GS724Tv4 and the servers are modern Dell boxes running Ubuntu 16.04 LTS.

The Ubuntu boxes uses the 'bonding' driver with the two gigabit interfaces (eth0, eth1) providing a bonded/teamed interface bond0. The bonding interface is configured for high availability, not throughput.

The network has to run dual stack with public IPv4 and IPv6 but there is no requirement for VLANs.

What's the best approach to configure this on the ISR4451X? The obvious choices appear to be:

  1. Redundant interface (but we're going into different switches)
  2. Port-Channel
  3. Bridge Domain Interface (BDI)
  4. Bridge Virtual Interface (BVI)

The goal is to protect against all of the failure modes and avoid MAC address flapping. It shouldn't matter which leg of the bond0 interface the Linux box uses to communicate the packet should find its way back without duplication or drops.

The connections between the ISR4451X and each GS724Tv4 will use the SFP ports (port 23) and the interconnect between the switches can use SFP on port 24. These connections can be in access port or trunk port mode and with or without LACP.

Can someone recommend the best approach?

Mike

1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Apr 1 '18 at 23:28
3

Configuring the router with a BVI interface seems to make the most sense. You can't use a port channel, and BDI is for IOS-XE routers. Make the router the root of the spanning tree.

5
  • 1
    I thought that IOS-XE and IOS had effectively been merged on the 4451 platform, "show ver" gives me: Cisco IOS XE Software, Version 16.07.01 Cisco IOS Software [Fuji], ISR Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 16.7.1, RELEASE SOFTWARE (fc6) – Mike Tubby Mar 28 '18 at 13:29
  • BVI/BDI, they are essentially the same thing so whatever your platform supports. But since you are running ios-xe now then its probably BDI. – A-A-Ron Mar 28 '18 at 22:38
  • @ron-trunk do the ports on the router operate in 'access port' mode or 'trunk port' mode? What spanning tree algorithm to use? What about VLAN and tagging? – Mike Tubby Apr 2 '18 at 20:33
  • @MikeTubby it depends. It you're using only one VLAN for your servers, then they're access ports. Use rapid-spanning tree 802.1w. – Ron Trunk Apr 3 '18 at 0:38
  • @ron-trunk the issue here appears to be that the ISR4451 will only implement spanning-tree on a per-VLAN basis since VLANs are the broadcast domain. I don't appear to be able to configure spanning-tree globally so I think I have to enable 'encapsulation dot11q' and place the BDI in VLAN1 and switch the Netgear ports from access mode to trunk mode so that tagged packets traverse between the switches and router ports.... ? – Mike Tubby May 3 '18 at 13:44
0

So, after some reading and experimenting I've come up with a solution that works for me using a BDI, VLAN and Rapid spanning-tree.

The problem would appear that spanning-trees are 'per VLAN' because VLAN is a broadcast domain, hence I needed to use a VLAN.

This is what I did:

1. On the Cisco ISR4451X

a) configure Rapid spanning tree as the default

b) configure the two interfaces in a 'service instance' with dot1q encapsulation and VLAN 100

c) arrange for the VLAN tags to be stripped

d) configure one of the interfaces with a lower port priority than the other to give predictable start up

e) configure the BDI with the layer-3 stuff (IPv4 and IPv6)

The config looks like this:

!
spanning-tree mode rapid-pvst
spanning-tree extend system-id
!

!
interface GigabitEthernet0/0/2
 description *** Internet Leg #1 ***
 no ip address
 media-type sfp
 negotiation auto
 no cdp enable
 spanning-tree port-priority 32
 service instance 100 ethernet
  encapsulation dot1q 100
  rewrite ingress tag pop 1 symmetric
  l2protocol peer stp
  bridge-domain 100
 !
!
interface GigabitEthernet0/0/3
 description *** Internet Leg #2 ***
 no ip address
 media-type sfp
 negotiation auto
 no cdp enable
 spanning-tree port-priority 48
 service instance 100 ethernet
  encapsulation dot1q 100
  rewrite ingress tag pop 1 symmetric
  l2protocol peer stp
  bridge-domain 100
 !
!

!
interface BDI100
 description *** Internet LAN ***
 ip address 195.xxx.xxx.1 255.255.255.192
 ipv6 address 2A00:xxxx:xxxx::1/64
 ipv6 enable
 ipv6 mtu 1500
 no cdp enable
 spanning-tree link-type shared
 spanning-tree port-priority 16
!

2. Netgear GS724Tv4 switches

On the switches I used the web-based interface and:

a) create a new VLAN #100

b) made all copper ports work as access ports in VLAN 100 ('U' membership VLAN=100, 'untagged -> tagged' on egress with PVID=100)

c) made the two SFP ports 'tagged' (trunk) ports

d) enabled Rapid spanning-tree as the default

3. Results

I now have both switches and the working and can:

  • power fail a switch
  • fail any fibre port (trunk)
  • unplug either leg of a Linux server (bonded Ethernet)

and the ISR4451X as the root of the spanning tree.

Here's what the router says:

router-4451x#show spanning-tree vlan 100

G1:VLAN0100
  Spanning tree enabled protocol rstp
  Root ID    Priority    32868
             Address     f07f.06bc.f502
             This bridge is the root
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32868  (priority 32768 sys-id-ext 100)
             Address     f07f.06bc.f502
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  0   sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi0/0/2             Desg FWD 4          32.10   P2p
Gi0/0/3             Back BLK 8          48.11   P2p

router-4451x#

Mike

3
  • You should accept your answer so that the question doesn't keep popping up forever, looking for an answer. – Ron Maupin May 7 '18 at 13:41
  • @RonMaupin happy to accept my own answer to this but where is the button to press? – Mike Tubby May 14 '18 at 23:11
  • It's the checkmark on the left by the Up/Down arrows. – Ron Maupin May 15 '18 at 2:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.