Cisco CSS 11501 Configuration

Haha, I've been asked that before... :)
If it's not evident from the config I posted, then I have no idea.  I've seen some references to these modes but haven't been able to see concrete config differences.

what does the output of the following command give you?

show bridging status

harbor235 ;}

See below for the output.  Keep in mind that I don't currently have all the cables connected as per diagram #2 in the original post because it was disrupting communications.

CSS11501# show bridge status
 
VLAN1 STP State:        Enabled
 
VLAN1:   Root Max Age:  6  Root Hello Time:  1  Root Fwd Delay:  4
Designated Root: 80-00-00-17-94-5e-b7-05
Bridge ID:       80-00-00-17-94-5e-b7-05
                                                                 Root Port Desg
Port       State    Designated Bridge       Designated Root      Cost Cost Port
----       ----- ----------------------- ----------------------- ---- ---- ----
 
 
 
 
VLAN3 STP State:        Enabled
 
VLAN3:   Root Max Age:  6  Root Hello Time:  1  Root Fwd Delay:  4
Designated Root: 80-00-00-17-94-5e-b7-06
Bridge ID:       80-00-00-17-94-5e-b7-06
                                                                 Root Port Desg
Port       State    Designated Bridge       Designated Root      Cost Cost Port
----       ----- ----------------------- ----------------------- ---- ---- ----
e5          Fwd  80-00-00-17-94-5e-b7-06 80-00-00-17-94-5e-b7-06    0   19 8005
 
 
 
 
VLAN4 STP State:        Enabled
 
VLAN4:   Root Max Age:  6  Root Hello Time:  1  Root Fwd Delay:  4
Designated Root: 80-00-00-17-94-5e-b7-07
Bridge ID:       80-00-00-17-94-5e-b7-07
                                                                 Root Port Desg
Port       State    Designated Bridge       Designated Root      Cost Cost Port
----       ----- ----------------------- ----------------------- ---- ---- ----
                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:

Oh, and to clear some confusion, VLAN3 in the output corresponds to VLAN2 in the diagram and VLAN4 corresponds to VLAN3.  The diag was made before the config was put in place and I made some changes during that time.

Well, that does confuse things. You are in routed mode,  so the outside interface of the CSS is in vlan 2 and the inside is vlan3? But you have both interfaces connected to the FW, traffic must flow outside to in, internet sourced traffic hits the outside of the CSS, performs NAT, then your service configs specify inside addressing for the physical servers to balance.

The switch in your diagram is the CSS?

looks like to me your outside interface of the CSS must be in the same broadcast domain as the inside interface of the ASA. Then you configure the inside interface of the CSS, there should not be an interface connected to the FW for this, I assume you have dedicated vlans for the servers that are being load balalnced?

You want to force all traffic through the CSS so it can NAT and balance, your setup is confusing, I would not do it that way. I realize you are asking fro help but this really entails a redesign of the entire site.

Did this help?

harbor235 ;}

Well, scratch the previous diagrams then.  Look at the one attached here (net3.pdf).  Also, the config as seen below.  I thought I was setting up port 1 and port 2 to be "outside" interfaces of the CSS, while port 5 and port 6 were "inside".  Is that not the case?

!**************** INTERFACE ****
interface e1
  bridge vlan 3
 
interface e5
  bridge vlan 3
 
interface e2
  bridge vlan 4
 
interface e6
  bridge vlan 4
 
!**************** CIRCUIT ****
circuit VLAN3
  ip address 172.16.2.3 255.255.255.0
 
circuit VLAN4
  ip address 172.16.3.3 255.255.255.0
 
!**************** SERVICE ****
service srv4
  ip address 172.16.2.21
  keepalive type tcp
  keepalive port 80
  active
service srv5
  ip address 172.16.2.22
  keepalive type tcp
  keepalive port 80
  active
 
service srv7
  ip address 172.16.3.31
  keepalive type tcp
  keepalive port 80
  active
service srv8
  ip address 172.16.3.32
  keepalive type tcp
  keepalive port 80
  active
 
!***************** OWNER *****
owner owner1
 
  content app1
    vip address 172.16.2.100
    add service srv4
    add service srv5
    balance leastconn
    port 80
    protocol tcp
    active
 
  content app2
    vip address 172.16.3.100
    add service srv7
    add service srv8
    balance leastconn
    port 80
    protocol tcp
    active

                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:

You are in routed mode, and you have your inside and outside interfaces addressed into the same network. The CSS will never forward the traffic to the servers because the VIP and the physical servers are on the same network as the outside interface. You need to address the physical servers differently, I would use some 10. x.x.x address. The CSS will proxy arp for the VIP, but the translation tells the CSS that the physical server is on the same network as the incoming interface. The CSS cannot do same wire load balancing nor will it forward packets to a different interface if the destination network is the same as the incoming interface, you see?

harbor235 ;}

Yes, I understand what  you mean.  I had to get at least one subnet running asap, so I am now in "bridged" mode with only the default VLAN1 and one circuit.  This was much easier and quicker than re-addressing the network, including ACL on the firewall, static mappings, etc.  It is working correctly in this mode.

Question here would be if it's possible to process two different subnets in bridged mode?  I ask this because the CSS will take two IP subnets into one circuit, such as:

circuit VLAN1
  ip address 172.16.2.3 255.255.255.0
  ip address 172.16.3.3 255.255.255.0

This is strange because no other device I've seen before that uses the term VLAN properly would allow this, such as an L2 switch for example.  I'm curious why the CSS allows this in the config?

In bridge mode you are manipulating spanning tree to force layer 2 traffic through the CSS for load balancing and NAT. The circuit addressess I beleive are only for connectivity to the CSS, in bridge mode the traffic is forwarded based upon the Layer 2 information only. So, I am sure thats why you are allowed to add additional addresses, it like adding a secondary.

Brdige mode works very well and is more scalable than routed mode, good choice.

harbor235 ;}

Sorry guys .... silly question .... how can you tell that the CSS is on BRIDGE or ROUTE mode ....????

I was never able to get a straight up answer on that either....  From what I understand, if you only have one VLAN and then you're in Bridged mode, but if you have two or more VLANs then you're in Routed mode.

harbor235, I missed your comment yesterday, didn't get the notification about a new post.
 
So you're saying that it IS possible to use the CSS in L2 bridged mode without regard to L3 addressing and have it do its magic for multiple IP subnets?

If your in bridge mode then you have "bridge state enable" (default) for an interface configured. You can also issue the "show bridging status" command or the "show bridge" command. You should be ID'd as the root bridge, CSS uses MAC address 01-00-0c-cc-cc-cd.

You still need to assign IP addresses to active circuits, which are logical interfaces and are used to connect directly to the CSS.

The difference is that in routed mode you are routing statically or dynamically to get the traffic to pass through the CSS. Bridge mode you are participating in spanning tree,  there is also a L2 design piece consideration that enables the traffic to flow through the CSS, without it traffic can flow around the CSS.

harbor235 ;}

...and the award for the most cryptic answer goes to... harbor235!  :)

I am not sure why you view the answer as cryptic, which part are you having trouble with?

I gave ways to verify if you are in bridge mode
I stated that regardless of mode you still need to assign IP addresses to circuits
I  stated the routed mode can use static or dynamic protocols to route traffic between interfaces
I stated that bridge mode requires spannning tree design consideration to get L2 traffic to flow
   through the CSS
I gave you the MAC address that the CSS uses to verify if it is root bridge if in bridge mode

Did you run the commands I gave you and look at the output?

The piece of hardware you are trying to configure requires advanced networking knowledge, I am not sure how I can make it simplier. What part am I being unclear on?

harbor235 ;}

I know this is thing is very complex, I said that in my first post.  I've never been stumped so much by any networking device before.  That's why I'm here :)

The part I thought was unclear/vague was "L2 design piece consideration".  Not exactly informative, I thought.  But you're right, I don't know enough about layer 2 and STP.

However, when I'm answering a specific question for someone about IP routing for example, I won't just say that they have L3 design considerations to look at to make it work.  Unless I'm trying to get a consulting deal out of it :)

The question about how to tell what mode you're in was posted by someone else.  However, there is no command "show bridging status" or "show bridge", perhaps I have a newer OS version than you're used to, not sure.  There is only "show bridge status", output below.  The MAC is also much different than your example, but does seem to belong to the CSS.  I couldn't find how to view the MAC of each interface, but "show chassis" does return a "base" MAC address that is just one digit lower than the Root.

Also, in the L2 switch that the CSS and servers connect to:
  CST Root MAC Address : 001794-5eb705
  CST Root Priority           : 32768
  CST Root Path Cost      : 200000
  CST Root Port               : 2
So it does seem that the other switch is treating the CSS as the Root.  (Btw, why is the CSS using two extra octets for its L2 addresses?)

This is all working just fine.  Where I run into trouble is when I try to implement another subnet into the mix.  I lose connectivity as soon as I enter an IP address from another subnet into the VLAN1 circuit.  That's why I asked if that's even possible and I couldn't make out from your answer if it is or not.

Thanks for all your assistance thus far...

-Peter

CSS11501# sho bridge status
 
VLAN1 STP State:        Enabled
 
VLAN1:   Root Max Age:  6  Root Hello Time:  1  Root Fwd Delay:  4
Designated Root: 80-00-00-17-94-5e-b7-05
Bridge ID:       80-00-00-17-94-5e-b7-05
                                                                 Root Port Desg
Port       State    Designated Bridge       Designated Root      Cost Cost Port
----       ----- ----------------------- ----------------------- ---- ---- ----
e1          Fwd  80-00-00-17-94-5e-b7-05 80-00-00-17-94-5e-b7-05    0   19 8001
e5          Fwd  80-00-00-17-94-5e-b7-05 80-00-00-17-94-5e-b7-05    0   19 8005
 
 
 
CSS11501# sho chassis
Configuration for CSS11501 J0:
 
Product Name:    CSS11501 J0        SW Version:        08.20.3.03
Serial Number:   JMX1027K0XP        Base Mac Address:  00-17-94-5e-b7-04
                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:

I luv doing this , it keeps me current and reinforces my knowledge so no problem here.

The L2 consideration is that you need distinct inside and outside vlans and the CSS must be root so that traffic flows through the CSS to get to the upstream. The CSS passes BPDUs from the inside and outside networks essentially merging them into one vlan.  To get the traffic to flow through the CSS The CSS must be root for merged vlan, otherwise, the inside device would arp for the upstream and be L2 forwarded directly to the port residing on the same vlan.

The problem with your question is that you asked to get load balancing working and then we moved to L3 and L2 design issues, from my perspective you  are asking multiple questions. So I said L2 considerations because we could be discussing that topic for a very long time. There are less people that really understand L2 relative to L3 so I did not want to get into too far.

The question on how to tell if you are in layer 2 mode was posted by me in my second post, i was unclear which mode you were in initially, believe me it's hard sitting here trying to flush out all the necessary info required. I mistakenly typed show bridging status instead of show bridge status.

Upon some reading the docs do say the CSS uses the MAC I stated when using dot1q trunks and the MACs you see when not using dot1q

http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/css11500series/v7.30/configuration/routing/guide/Span.html#wp1016011

Another question "So it does seem that the other switch is treating the CSS as the Root.  (Btw, why is the CSS using two extra octets for its L2 addresses?)" If the CSS uses extra octets for vlan tagging, dot1q

If you are adding additional subnets then you need to add additional outside interfaces as well. How are you trying to add teh new subnet and how does it difgfer from the other?

harbor235 ;}