Is there a way to provide two physically diverse channels between two switches? I'm using two Cisco Catalysis 3560s, and I want to have two separate channels between them, with different access control lists enforceable.

I know I can use an EtherChannel to group two or more interfaces together, but I want to have more control over what traffic uses which interface. With EtherChannels, I would have to enforce the same ACL on every interface (not an option for me).

Perhaps there is a solution using GRE Tunnels or manually editing the forwarding table. I'm just wondering if anyone here has experience that could help me out.

Thank you!

  • 3
    We need a little more clarity on what you're trying to accomplish. Two VLANs using two different ports? – Ron Trunk Dec 6 at 19:21
  • With the same VLAN(s), STP will create a single loop-free path. Using etherchannel is simply the way to fool STP into thinking that multiple links are a single link so that STP doesn't disable all but one link, and the switches will not try to send broadcasts, unknown unicasts, and multicasts back on a different link in the channel. – Ron Maupin Dec 6 at 19:36
  • I'll try to be clearer: I'm trying to have multiple links between two switches, such that I can guarantee isolation of traffic on particular links. Maybe multiple VLANs is the way to do this. VLAN 1 could use interface 1, configured as an access port, and VLAN 2 could use interface 2, also configured as an access port. – Matt Hall Dec 6 at 19:53
  • @MattHall This is exactly what MSTP or RPVST+ are for. Look at "VLANs with spanning tree". – Zac67 Dec 6 at 21:14
  • OK. Then I am confused. You could certainly have channels that are access interfaces, but multiple channels would need to have a different VLAN, or channels that are trunk interfaces, but each channel would need a separate set of non-blocked VLANs. That is something that is done all the time. GRE tunnels and forwarding tables are routing (layer-3), not bridging (layer-2). – Ron Maupin Dec 6 at 21:32
up vote 2 down vote accepted

Depending on your actual goal, there are several possibilities. Load balancing your flows 'at will' requires them to be split across different VLANs or very delicate fine tuning.

VLANs with spanning tree

Using MSTP with multiple instances or RPVST+, you can arrange/configure your VLANs onto both links and then connect the switches redundantly but with dedicated links for each VLAN group. In case of a link failure, the disconnected VLANs can use the remaining link.

To configure, set the links as VLAN trunks and use the same tagging scheme - don't connect yet.

With MSTP, set up two instances and group your VLANs according to the desired distribution. Most simply, use one instance for VLAN 1 and the other for VLAN 2. Configure each link port to use one of the instances. MSTP will build a separate spanning tree for each instance, forwarding only over the desired port (unless the other link fails).

With RPVST+, you configure each VLAN's priority on each port and (pretty much) draw the traffic to that link.

VLANs without spanning tree

You could simply connect different VLANs across both links and deactivate spanning tree altogether. Note that there is no loop protection and no failover this way - not really recommended unless you want an simple setup.

LAG without VLANs

Setting up a link aggregation group/Etherchannel you'd need to select the port traffic distribution algorithm or change the MAC/IP addresses/port numbers that result in your optimal flow balancing. This may sound the easiest but is actually the hardest to do outside a lab.

We were using this variant for load balancing our Veeam backup streams across both core switches with only gigabit links with LACP - the backup flows use a special subnet with hand-picked IP addresses to optimize the flows.

(This is included for completeness - since your question is about using separate ACLs, LAG won't work as you've already stated.)

  • Thank you! Forgive this sort of X/Y follow up question, but do you know if I could use a combination of these? Obviously, I can't have spanning-tree and NOT spanning-tree, but I've thrown out spanning tree already. So is it possible to have a LAG on two interfaces, and a VLAN on a third, between the same two switches? Or two LAGs, with their own ACL parameters? – Matt Hall Dec 6 at 20:02
  • 3
    You can use multiple LAGs of course, but that doesn't solve your problem of loop prevention and traffic distribution. Multiple logical links require VLAN separation or spanning tree. You cannot have multiple active links in the same L2 segment. – Zac67 Dec 6 at 20:28

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.