People who code: we want your input. Take the Survey
15

4 nines = 99.99 %. That means the probability that a link fail is 0.01 % or 0.0001 in terms of probability (scale 0 - 1). Assuming independence, The probability that both link fails is 0.0001 x 0.0001 = 10-8, which gives back 99.999999. Yup, that's 8 nines and not 5, but we usually don't consider more than 5 nines. Note that Assuming independence, is in ...


14

I have been migrating sites away from policy-based VPNs for just this reason. Policy-based VPNs are too unpredictable when it comes to failover behavior. I much prefer route-based IPsec tunnels, either point-to-point or DMVPN. Unfortunately, to my knowledge the ASA platform still doesn't support route-based tunnels.


14

A link that is 99.99% reliable is down 0.01% or 0.0001 of the time. So if the downtime of the two links is independent then both lines will be simultaneously down 0.00000001 of the time. Your link is in-theory up 99.999999% of the time. In practice though you don't usually get the full benefits because of other factors. Do you know how independent the ...


13

SSO is preferred due to shorter switchover if supervisor fails. From Cisco: With supervisor engine redundancy enabled, if the active supervisor engine fails or if a manual switchover is performed, the standby supervisor engine becomes the "new" active supervisor engine. The standby supervisor engine has been automatically initialized with the ...


12

Have you looked at using a separate external mux? I've run parts of our rings on pairings of ordinary (but colored) 10G optics and passive CWDM muxes with a single strand on each side. This let us also do multiple parallel links at the same time (we used 8 channel muxes).


11

Things you should be aware of: SRX HA links communicate using jumbo frames and multicast addresses. So to make this work you need at least the following changes on the EX switches: Configure a jumbo MTU on the HA links and the links between the EX switches. This will enable jumbo frames to go trough the switch infrastructure. set interface x mtu 9216 ...


10

I'm not HP savvy but I did some quick Googling (hp irf ring topology) and found a couple of docs that indicate it does support a ring topology. c02648772.pdf Quote from page 5: IRF topologies Create an IRF virtual device in daisy chain topology, or more reliably, ring topology, as shown in Figure 2. In ring chain topology, the failure of one ...


10

I would HIGHLY recommend getting rid of HSRP and using routing over the tunnels (both up all the time), whether OSPF or EIGRP. Set an inferior metric on one of the tunnels at both ends. Problem solved. HSRP is BAD NEWS over WAN. I am struggling to see what use the HSRP is. As you're now seeing it also causes a lot of issues when overlaid on top of routing. ...


10

I am looking for a technology to achieve TCP connection fault tolerance with the help of two links between hosts and without time delays for route failure detection. Something like this: link1 packet1copy1-> -------------------------- packet1-> / \ packet1copy1/...


9

There are two main options for controller redundancy in Cisco's current wireless offerings. You can either use Backup Controllers or High Availability; depending on the firmware level of your 5508's, your acceptable failover time, and your budget. Based on your question, we're working with the following topology: Traditionally, utilizing Backup ...


9

As you mentioned, your static routes break, because there is no existing way to force failover to the WAN link at both sites when one site looses the uplink to the internet. The best solution to this problem is to set up some form of routed tunnel (sourced from the ISP-link addresses on R1 and R2 in the diagram) through the internet, run a dynamic routing ...


9

I would recommend using a DMVPN solution to connect remote sites over L2L (Lan-to-Lan) IPSec tunnels between ASAs. The DMVPN solution is much easier, cleaner, and will allow spoke to spoke communication as well.


9

To add to Zac67's and JFL's answers: In case you decide to enable spanning-tree on the single switch, don't forget to configure the client's and server's switchports as Edge Ports (Cisco speak; spanning-tree portfast [trunk], spanning-tree portfast edge [trunk] or spanning-tree port type egde [trunk] , depending on platform and software generation). This ...


8

I agree with @network_ninja but will extend it a bit. How I'd solve this Router1--L3--Router2 | | | | Switch1--L2--Switch2 | | | | | | PC1 PC2--------+ Router1 and Router2 are running VRRP, HSRP, GLBP or CARP to produce virtual default-GW IP address to the LAN. This protocol will converse over the Switch ...


8

This will work but it would be a poor design choice (IMHO) unless you have a specific reason for doing so. See this discussion: Duplicate OSPF area IDs OSPF Best Practicies Recommended OSPF configuration best-practices (using the SSM example) OSPF area configuration best practices Update #1: For the sake of completeness, I mocked up this situation using ...


7

Regarding the question of splitting area 1 across the backbone (area 0): [area 1, subnet 1]---[ABR #1]---[area 0, subnet 2]---[ABR #2]---[area 1, subnet 3] [area 1, subnet 1]---[Router #1]---[area 0, subnet 2, end device #1]---[Router #2]---[area 0, subnet 2, end device #2]---[Router #3]---[area 1, subnet 3] Short answer: There is no problem with ...


7

This is the logical view of what you're trying to achieve: Configure the router priorities for both VRRP 'a' and VRRP 'b' as follows: Router 1: 110 (master) Router 2: 100 (backup) The configure interface tracking as follows: Router 1 VRRP a: track interface R1b with a track priority of 90 Router 1 VRRP b: track interface R1a with a track priority of 90 ...


7

Assuming a single context active/passive failover configuration with the ASAs connecting to the 2911s on unique subnets, you could trunk the links using two subinterfaces and vlan tagging. But the hack is to not have both subinterfaces active at the same time on a single ASA. On the ASA on the left assuming it's active, the first subint would be alive and ...


7

Even if you could still get PI IPv4 addresses in Asia: if your ISPs don't want to route your IP addresses then there is nothing you can do. Tunnels and LISP could solve some of your problems (I use LISP here), but you already stated that this is not available in your region. BGP is the protocol that is used to route your IP addresses from an AS. You need ...


7

If i remember, default spanning tree (802.1d) takes about 50 secs to reconverge. That is the duration for which you will be losing frames. A link is detected down by the loss of 10 hello pkts. These are usually 2 secs apart. So total=20 secs. This is called the max-age timer Next it has to transition another blocked port through listening and learning ...


6

My question is if this is an OK design, what are the possible pitfalls (say if a sup blows, how long before the link fails over) This design seems fine if you don’t have any dedicated 10G uplink modules. You just need to remember that your supervisor cards will go down more than any other cards on your chassis for software upgrades. Those upgrades depend ...


6

A passive wavelength-division multiplexer, such as a CWDM or DWDM mux, would probably be your best bet; this is how Service providers supply fiber especially longer distances from their local Hub site. It is probably a larger investment upfront but it would also allow you to get more out of your existing leased fibers. This is also assuming that your lease ...


6

It is possible, even likely, that at least one (probably more) frames will be lost on any failover. The speed of the failover is highly dependent on what type of redundancy you are using. Spanning Tree is the slowest, routing is an order of magnitude faster, and etherchannels are yet and order of magnitude faster than that. When frames are lost, there is ...


6

I don't understand how a bridge decides that it is not connected to another bridge performing STP. If it doesn't hear BPDUs, then there's no bridge connected. How long will it until it decides it is alone and probably the root bridge? It starts out assuming it's "alone." That is, the bridge sends BPDUs with its bridge ID as the root until it hears ...


6

Scenario A: Switch 1 has ports 1+2 trunked together via LACP. They are plugged into Switch 2 ports 1+2. Both links will be used, but a single flow will only use one link. There is a hashing algorithm that determines which flow uses which link. If one of the links goes down, then all the traffic will be switched to the other link. This happens very rapidly....


6

As explained by Zac67 answer STP is normally only useful when connecting several switches together. However there's other related features than can be useful on a standalone switch. BPDU Guard will protect your network in case 2 links are connected to the same device. The most common case in my experience is with IP phones. BPDU Guard will disable the ...


5

You are really looking for the Brocade Track Ports and Track Priority features. With these features configured, when the red connection fails, it will lower the priority of the green connection. This should then allow the blue connection to take over as master in the group. Personally, I would also add a direct link between the two L3 switches as well. ...


5

(Original all-BGP answer changed, as-per OP's request of no dynamic routing to ISP) As @Mike suggested, tunnel+dynamic routing, especially in the INET facing is solid solution. But if for some reason you don't want tunnel (no HW support, don't want to lose MTU, dynamic routing not acceptable even internally) your other option is 'IP SLA' tracked routes. I'...


5

I'll toss out for consideration what most will consider a bit more unorthodox solution. Consider solving this with Layer 3 instead of Layer 2. Put both switches into place, and DON'T interconnect them. Connect the router(s) to both switches. Connect your HP servers to both switches. Use two different IP blocks internally for the servers to talk to the ...


5

From a design standpoint, specifically referring to the route servers, the answer is no, they should not peer with each other via an iBGP session [disclaimer: I've never personally attempted to do this, but I might now for fun]. The reason why is because route servers behave similary to route reflectors, only it's eBGP rather than iBGP. The most important ...


Only top voted, non community-wiki answers of a minimum length are eligible