Solved

Cisco Switch Design for a Small Datacenter

Posted on 2012-03-19
13
657 Views
Last Modified: 2012-03-22
I have to put together a quick design for a small datacenter.  Below you will see a diagram of my network so far.  As far as switching goes, I have two Cisco 3550-12Gs configured with HSRP, these are my distribution switches.  I have two domains, domain1 and domain2, both domains are on their own vlan.  I am trunking the uplink ports on all switches to the distribution switches.  At the moment I have this setup in a lab and everything is working.  I just want to make sure that I have HSRP, VTP, and STP configured correctly before I go changing this in production.  I will attach my configurations of the distribution switches so you can see my HSRP config.  As far as VTP goes, the Core Switch and the Distribution Switches are VTP Servers, and all other switches are VTP Clients.  All Switches are on the same VTP Domain and have the same password.  As far as Spanning-Tree goes, I have done nothing, all STP settings are default.  Please have look and let me know what you think.  Any suggestions for improving this setup would be appreciated. Thanks.
Network DiagramDistribution-Switch-1.txt
Distribution-Switch-2.txt
0
Comment
Question by:denver218
  • 7
  • 6
13 Comments
 
LVL 10

Accepted Solution

by:
mat1458 earned 500 total points
ID: 37739567
Partly your questions have been answered in post http://www.experts-exchange.com/Hardware/Networking_Hardware/Switches/Q_27628088.html.

If you use HSRP you have to be aware that with the two paths to the firewall and the router you can end up in asymmetric routing situations. Therefore it is crucial that you set the spanning tree in a way like we have described it in the previous post. Spanning tree without conciously set root bridge is not a recommended practice, especially not for data centers.

My personal preference for VTP is transparent mode on all switches. With transparent mode you don't have any risk of having issues with the VTP revision number. Also all VLAN information is directly in the config file so replacing a defective switch is just copy/paste. I agree that if one of the servers is alive when replacing the other one you are fine as well. But for my part I like to read all configuration information in one file instead of config file and vlan database.
0
 
LVL 4

Author Comment

by:denver218
ID: 37740238
Thanks.  That is what I am concerned about.  Since the 3550-12Gs are in HSRP how to do I configure Spanning Tree so I don't have to worry about asymmetric routing.  I know we talked about it in the other post a little, but I'm still a little unsure.  Do I just need to add the following on the 3550-12Gs like we talked about in the other post?

Primary 3550-12G

spanning-tree vlan 20 root secondary
spanning-tree vlan 40 root secondary
spanning-tree vlan 50 root primary

Secondary 3550-12G

spanning-tree vlan 20 root primary
spanning-tree vlan 40 root primary
spanning-tree vlan 50 root secondary

Do I need to make any spanning-tree changes on the 3550 that sits behind the firewall that these 3550-12Gs go to?  Thanks.
0
 
LVL 10

Expert Comment

by:mat1458
ID: 37740769
Set the spanning tree root for each VLAN (don't forget VLAN 1) to the switch that has the lower HSRP priority. Set the secondary root to the switch that has highest HSRP priority.

>Do I need to make any spanning-tree changes on the 3550 that sits behind the firewall that these 3550-12Gs go to?
No, since you have set the root bridges for all VLAN this switch will adapt to the spanning tree as well.
0
 
LVL 4

Author Comment

by:denver218
ID: 37743657
Thanks mar1458, I set the spanning tree root for each vlan in my test lab, it brought everything down for a few seconds, then everything came back up again.  I appreciate all your help.  I have downtime schedules tomorrow night to do all this in production at the datacenter.  Is there anything you else you feel I should look at in regards to switching?  If not I'll close the case and award points.  Thanks.
0
 
LVL 10

Expert Comment

by:mat1458
ID: 37743846
In my opinion it would be worth having a look at Rapid Spanning Tree. I don't know if the 3550 with your sorftware support it, but with your small network it might bring down recalculation times a whole lot. Try if you can set RSTP on all switches and do some unplugging while running pings across your test network.
0
 
LVL 4

Author Comment

by:denver218
ID: 37744293
Thanks.  I was reading a little bit about RSTP.  To enable RSTP, do I just enter the following on each switch?

spanning-tree mode rapid-pvst
0
What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

 
LVL 10

Expert Comment

by:mat1458
ID: 37745928
Sounds good to me, however you have to test if it works with the 3550s and your current software version.
0
 
LVL 4

Author Comment

by:denver218
ID: 37747294
Last question.  I have not configured RSTP yet, but just for testing I unplugged one of the 3550-12Gs.  When I did this I lost about 6 pings before traffic started passing again.  Is this normal with HSRP?
0
 
LVL 10

Expert Comment

by:mat1458
ID: 37748423
It's not HSRP that takes so long, it's spanning tree. STP is very old and takes its time to converge. It can take up to 50 seconds until traffic flows again. That's why it suggested RSTP.
0
 
LVL 4

Author Comment

by:denver218
ID: 37750397
Thanks.  If I give a server in vlan 40 (10.4.0.0/16) for example the default gateway of vlan 5 (10.5.0.1)  I can still pass traffic without issues.  Is there something I can do so this doesn't happen?
0
 
LVL 10

Expert Comment

by:mat1458
ID: 37751170
Yes, there is. But why would you want to do that?

Actually your system recognizes that the default gateway does not belong to its own subnet and it sends out an ARP for the destination address that it wants to reach. The switch sees the ARP and recognizes that somebody is sending out ARPs for systems that do not belong to the VLAN the ARP is being sent out. The switch then replies to the ARP by sending its own MAC address together with the destination IP address and that's why it all works.

You can disable it by using

no ip proxy-arp

on the VLAN interface in which you have the system with the wrong default gateway. For testing purposes don't forget to remove the ARP entry out of the PCs cache (arp -d probably).
0
 
LVL 4

Author Closing Comment

by:denver218
ID: 37752061
Thanks for all your help mat1458.  I had scheduled downtime at the datacenter last night, and it went very smooth due to your help.  I appreciate your time.
0
 
LVL 10

Expert Comment

by:mat1458
ID: 37752742
You're very welcome. Good luck with your change.
0

Featured Post

Highfive + Dolby Voice = No More Audio Complaints!

Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

Join & Write a Comment

Suggested Solutions

The Cisco RV042 router is a popular small network interfacing device that is often used as an internet gateway. Network administrators need to get at the management interface to make settings, change passwords, etc. This access is generally done usi…
Introduction This article explores the design of a cache system that can improve the performance of a web site or web application.  The assumption is that the web site has many more “read” operations than “write” operations (this is commonly the ca…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now