Solved

Configuring L3 switch

Posted on 2013-12-19
12
446 Views
Last Modified: 2013-12-27
We have an existing Cisco SG300-28 switch in L3 mode. Because we needed more ports, we are buying another switch -- same exact model.

I will be trunking them together, and allowing some of our ESXi server to do NIC Teaming across both switches.

Question:
How do I configure the VLAN IPs on the 2nd switch?

For example, below is the list of IPs and associated VLANs on switch 1:
VLAN 1000 - 10.10.0.1 (255.255.255.0)
VLAN 1020 - 10.20.0.1 (255.255.255.0)
VLAN 1030 - 10.30.0.1 (255.255.255.0)
VLAN 2       - 10.0.15.249 (255.255.255.248) -- connects to main firewall/router LAN port.
 

On switch 2, what IP/subnet mask should I assign to the above mentioned VLANs.

**NOTE: Only Switch 1 connects to the firewall. This means that any traffic on switch 2 that is headed outside our network (internet), needs to go through Switch 1 in order to hit the firewall.
0
Comment
Question by:pzozulka
  • 6
  • 5
12 Comments
 
LVL 50

Assisted Solution

by:Don Johnston
Don Johnston earned 50 total points
ID: 39730946
I will be trunking them together, and allowing some of our ESXi server to do NIC Teaming across both switches.
You can't do that. The teamed links have to go to the same switch.
On switch 2, what IP/subnet mask should I assign to the above mentioned VLANs.
I wouldn't assign IP addresses for the VLANs on the second switch (except one for management of the switch).
0
 
LVL 11

Expert Comment

by:Miftaul
ID: 39731643
You dont need to assign IP address to the VLANs on the second switch. You can assign another free IP for the management VLAN only for remote management purpose.

But if you want to assign IPs for some reason or the other.

VLAN 1000 - 10.10.0.2 (255.255.255.0) or any other unused IP
VLAN 1020 - 10.20.0.2 (255.255.255.0) or any other unused IP
VLAN 1030 - 10.30.0.2 (255.255.255.0) or any other unused IP

Create Trunk between the two switches and EtherChannel bundling if you want.

It will work fine.
0
 
LVL 8

Author Comment

by:pzozulka
ID: 39732224
donjohnston: I don't believe this is true because we are already doing the NIC Team (Route based on the originating virtual port ID) to two separate switches (same models) in one of our other offices. Not to confuse with LACP -- just static trunking on ProCurve switches. If this was true, and you can only Team NIC to a single switch, then if that switch was to die, there would be no redundancy.

Here are example configs from the two ProCurve switches in our other office (5304xl)

Switch 1:
interface A14 
   name "MDF-C02-A14" 
   flow-control 
   unknown-vlans Disable 
   no lacp
exit
interface B14 
   flow-control 
   unknown-vlans Disable 
   no lacp
exit
interface C14 
   name "MDF-C02-C14" 
   flow-control 
   unknown-vlans Disable 
   no lacp
exit
interface C16 
   name "MDF-C02-C16" 
   flow-control 
   no lacp
exit
trunk A14,B14,C14,C16 Trk1 Trunk 
vlan 1001 
   name "ESX VMotion" 
   ip address 10.0.128.21 255.255.255.248 
   tagged A10,B1,C10-C11 
   exit 
vlan 1002 
   name "IP Storage" 
   untagged A7,B12,B15,Trk5-Trk6 
   ip address 10.0.128.61 255.255.255.224 
   tagged A1-A2,A8,B13,C8 
   exit 
ip route 0.0.0.0 0.0.0.0 10.0.15.254

Open in new window


Switch 2:
interface A14 
   flow-control 
   unknown-vlans Disable 
   no lacp
exit
interface B4 
   unknown-vlans Disable 
exit
interface B14 
   flow-control 
   unknown-vlans Disable 
   no lacp
exit
interface C14 
   flow-control 
   unknown-vlans Disable 
   no lacp
exit
interface C16 
   flow-control 
   no lacp
exit
trunk A14,B14,C14,C16 Trk1 Trunk
ip default-gateway 10.0.156.253
vlan 1001 
   name "ESX VMotion" 
   ip address 10.0.128.22 255.255.255.248 
   tagged A1,A4-A5,B1 
   exit 
vlan 1002 
   name "IP Storage" 
   untagged Trk6-Trk7 
   ip address 10.0.128.62 255.255.255.224 
   tagged C8,C10-C13 
   exit 
ip route 0.0.0.0 0.0.0.0 10.0.15.254 

Open in new window


I want to pretty much create the same setup with the Cisco switch, but I'm not that familiar with Cisco. As you can see Switch 2 is the one that's connected to the main firewall (10.0.15.254) on port B4, and on each switch, all VLANs have IP assignments.

Lastly, the two switches are trunked together on ports A14, B14, C14, C16. Looks like it's a static trunk (not LACP -- which I believe is EtherChannel in Cisco terms).

I trust these configs because they work well and were created by our senior network engineers. So I'm a bit confused why both of you said I don't need to assign IPs to the VLANs on the second switch.
0
Portable, direct connect server access

The ATEN CV211 connects a laptop directly to any server allowing you instant access to perform data maintenance and local operations, for quick troubleshooting, updating, service and repair.

 
LVL 11

Accepted Solution

by:
Miftaul earned 450 total points
ID: 39732264
A VLAN IP (aka SVI interface) gives Layer3 reachablity to a switch. Its not required for communication between switches or to your servers as switches works in Layer2 and doesn't bother Layer3.

Its only when Switch SVI requires IP address is
1. To remotely logon to the switch for management purpose.
2. If you are doing routing in the switch, say using Switch as default gateway.

In your case, its not required. It will work just fine, because you are adding the second switch for redundancy or additional layer2 ports, and you don't require additional Layer3 functionality on the second switch.

(In Cisco, the etherchannel is done mostly using LACP but there is a Cisco proprietary protocol called PAgP as well.)
0
 
LVL 8

Author Comment

by:pzozulka
ID: 39732301
Thanks, that's what I thought as well, because in my experience, only when you add an IP address to a VLAN does it become reachable from other VLANs, which pretty much confirms what you just said.

I think it can be a benefit to be able to ping the storage VLAN devices from our management network for diagnostic purposes, but I see what you're saying in terms of functionality that L3 is not needed in our case.

Which brings me to my last question in the original post in regard to VLAN 2. This is the VLAN that contains the port on Switch 1 that connects to the firewall -- and in turn, to the outside world.

What config do I need to make on Switch 2, for all network traffic on swtich 2 headed to the outside world to know that to get to the outside world (firewall), the traffic needs to first go through switch 1.
0
 
LVL 11

Assisted Solution

by:Miftaul
Miftaul earned 450 total points
ID: 39732321
"I think it can be a benefit to be able to ping the storage VLAN devices from our management network for diagnostic purposes, but I see what you're saying in terms of functionality that L3 is not needed in our case."

If you want to reach one vlan from the other, then there has to have some intervlan routing between the VLANs which is obviously a Layer3 business. Unfortunately when you enable interVLAN routing, it is enabled for all the VLANs, and you need to use ACLs to limit communication between unneeded VLANs


"Which brings me to my last question in the original post in regard to VLAN 2. This is the VLAN that contains the port on Switch 1 that connects to the firewall -- and in turn, to the outside world.

What config do I need to make on Switch 2, for all network traffic on swtich 2 headed to the outside world to know that to get to the outside world (firewall), the traffic needs to first go through switch 1."

You need to make sure all the VLANs are identical between both the switches either by manually creating them or implementing VTP.
Also you need to make sure all the VLANs are allowed on the trunk configuration between the switches.
Thats all.
0
 
LVL 11

Expert Comment

by:Miftaul
ID: 39732339
for all network traffic on swtich 2 headed to the outside world to know that to get to the outside world (firewall), the traffic needs to first go through switch 1.

No matter how many switches stack a VLAN traverses, its basic principal is it extends the broadcast traffic to the switching fabric.  Your traffic to external network will be broadcasted with in the VLAN throughout both the switches, and due to proxy arp, the default gateway will  respond with its MAC address for the traffic destined to unknown network, The devices will then build the frame for the traffic to outside world using the mac address of the default gateway. Once the gateway receives the frame, it will do its job of forwarding that.
0
 
LVL 8

Author Comment

by:pzozulka
ID: 39742105
I just read your last comment. Does that mean the default gateway on Switch 1 has to be 10.0.15.254 (router's IP), and same on Switch 2?

My other options is: Since Switch 1 is the one that connects directly to the router, have its default gateway be 10.0.15.254, and Switch 2's default gateway point to Switch 1.
0
 
LVL 11

Expert Comment

by:Miftaul
ID: 39742134
To the basics, why exactly we need a default gateway in a switch. A switch being a layer2 device, doesn't have any Layer3 intelligence. When we give an IP to any Switch SVI interface and want to manage the switch remotely, the IP traffic will reach the switch, but the return traffic will not come back because the switch doesn't know where to forward traffic. Thats where the default-gateway comes into play, if the switch doesn't know where to forward traffic, it forwards them to default gateway.

Query - I just read your last comment. Does that mean the default gateway on Switch 1 has to be 10.0.15.254 (router's IP), and same on Switch 2?

To answer your question, yes, the default gateway on both the switches should be the Router IP 10.0.15.254

Query - My other options is: Since Switch 1 is the one that connects directly to the router, have its default gateway be 10.0.15.254, and Switch 2's default gateway point to Switch 1.

Don't do this. Even if you do, as I said switches doesn't have Layer3 intelligence, so Switch2 will forward the return management traffic to Switch1 and again switch1 will forward that to the router. This doesn't make any sense, does it.
0
 
LVL 8

Author Comment

by:pzozulka
ID: 39742160
Both switches are set to L3 mode. Does that change any of what you said in this case?
0
 
LVL 11

Expert Comment

by:Miftaul
ID: 39742183
No, its the same.

Set the default gateway to both switches to the router ip.
0
 
LVL 8

Author Comment

by:pzozulka
ID: 39742247
Thanks much.
0

Featured Post

Free Tool: Postgres Monitoring System

A PHP and Perl based system to collect and display usage statistics from PostgreSQL databases.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Cant browse or ping a particular URL 2 53
access vs trunk with voice vlan 2 68
ospf neighbors not coming up 6 69
Install additional HP switch 1 50
I see many questions here on Experts Exchange regarding switch port configurations and trunks. This article is meant for beginners in the subject to help to get basic knowledge about Virtual Local Area Network (VLAN (http://en.wikipedia.org/wiki/Vir…
This tutorial will go through the steps required to write a script that will back up the configuration settings of a HP-ProCurve switch. You will need to get the following things to follow this tutorial: Telnet Scripting Tool e.g. TST10.exe …

685 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question