Cisco Switch Design for a Small Datacenter

I have to put together a quick design for a small datacenter.  Below you will see a diagram of my network so far.  As far as switching goes, I have two Cisco 3550-12Gs configured with HSRP, these are my distribution switches.  I have two domains, domain1 and domain2, both domains are on their own vlan.  I am trunking the uplink ports on all switches to the distribution switches.  At the moment I have this setup in a lab and everything is working.  I just want to make sure that I have HSRP, VTP, and STP configured correctly before I go changing this in production.  I will attach my configurations of the distribution switches so you can see my HSRP config.  As far as VTP goes, the Core Switch and the Distribution Switches are VTP Servers, and all other switches are VTP Clients.  All Switches are on the same VTP Domain and have the same password.  As far as Spanning-Tree goes, I have done nothing, all STP settings are default.  Please have look and let me know what you think.  Any suggestions for improving this setup would be appreciated. Thanks.
Network DiagramDistribution-Switch-1.txt
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Partly your questions have been answered in post

If you use HSRP you have to be aware that with the two paths to the firewall and the router you can end up in asymmetric routing situations. Therefore it is crucial that you set the spanning tree in a way like we have described it in the previous post. Spanning tree without conciously set root bridge is not a recommended practice, especially not for data centers.

My personal preference for VTP is transparent mode on all switches. With transparent mode you don't have any risk of having issues with the VTP revision number. Also all VLAN information is directly in the config file so replacing a defective switch is just copy/paste. I agree that if one of the servers is alive when replacing the other one you are fine as well. But for my part I like to read all configuration information in one file instead of config file and vlan database.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
denver218Author Commented:
Thanks.  That is what I am concerned about.  Since the 3550-12Gs are in HSRP how to do I configure Spanning Tree so I don't have to worry about asymmetric routing.  I know we talked about it in the other post a little, but I'm still a little unsure.  Do I just need to add the following on the 3550-12Gs like we talked about in the other post?

Primary 3550-12G

spanning-tree vlan 20 root secondary
spanning-tree vlan 40 root secondary
spanning-tree vlan 50 root primary

Secondary 3550-12G

spanning-tree vlan 20 root primary
spanning-tree vlan 40 root primary
spanning-tree vlan 50 root secondary

Do I need to make any spanning-tree changes on the 3550 that sits behind the firewall that these 3550-12Gs go to?  Thanks.
Set the spanning tree root for each VLAN (don't forget VLAN 1) to the switch that has the lower HSRP priority. Set the secondary root to the switch that has highest HSRP priority.

>Do I need to make any spanning-tree changes on the 3550 that sits behind the firewall that these 3550-12Gs go to?
No, since you have set the root bridges for all VLAN this switch will adapt to the spanning tree as well.
Price Your IT Services for Profit

Managed service contracts are great - when they're making you money. Yes, you’re getting paid monthly, but is it actually profitable? Learn to calculate your hourly overhead burden so you can master your IT services pricing strategy.

denver218Author Commented:
Thanks mar1458, I set the spanning tree root for each vlan in my test lab, it brought everything down for a few seconds, then everything came back up again.  I appreciate all your help.  I have downtime schedules tomorrow night to do all this in production at the datacenter.  Is there anything you else you feel I should look at in regards to switching?  If not I'll close the case and award points.  Thanks.
In my opinion it would be worth having a look at Rapid Spanning Tree. I don't know if the 3550 with your sorftware support it, but with your small network it might bring down recalculation times a whole lot. Try if you can set RSTP on all switches and do some unplugging while running pings across your test network.
denver218Author Commented:
Thanks.  I was reading a little bit about RSTP.  To enable RSTP, do I just enter the following on each switch?

spanning-tree mode rapid-pvst
Sounds good to me, however you have to test if it works with the 3550s and your current software version.
denver218Author Commented:
Last question.  I have not configured RSTP yet, but just for testing I unplugged one of the 3550-12Gs.  When I did this I lost about 6 pings before traffic started passing again.  Is this normal with HSRP?
It's not HSRP that takes so long, it's spanning tree. STP is very old and takes its time to converge. It can take up to 50 seconds until traffic flows again. That's why it suggested RSTP.
denver218Author Commented:
Thanks.  If I give a server in vlan 40 ( for example the default gateway of vlan 5 (  I can still pass traffic without issues.  Is there something I can do so this doesn't happen?
Yes, there is. But why would you want to do that?

Actually your system recognizes that the default gateway does not belong to its own subnet and it sends out an ARP for the destination address that it wants to reach. The switch sees the ARP and recognizes that somebody is sending out ARPs for systems that do not belong to the VLAN the ARP is being sent out. The switch then replies to the ARP by sending its own MAC address together with the destination IP address and that's why it all works.

You can disable it by using

no ip proxy-arp

on the VLAN interface in which you have the system with the wrong default gateway. For testing purposes don't forget to remove the ARP entry out of the PCs cache (arp -d probably).
denver218Author Commented:
Thanks for all your help mat1458.  I had scheduled downtime at the datacenter last night, and it went very smooth due to your help.  I appreciate your time.
You're very welcome. Good luck with your change.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Switches / Hubs

From novice to tech pro — start learning today.