Solved

Configuring L3 switch

Posted on 2013-12-19
12
441 Views
Last Modified: 2013-12-27
We have an existing Cisco SG300-28 switch in L3 mode. Because we needed more ports, we are buying another switch -- same exact model.

I will be trunking them together, and allowing some of our ESXi server to do NIC Teaming across both switches.

Question:
How do I configure the VLAN IPs on the 2nd switch?

For example, below is the list of IPs and associated VLANs on switch 1:
VLAN 1000 - 10.10.0.1 (255.255.255.0)
VLAN 1020 - 10.20.0.1 (255.255.255.0)
VLAN 1030 - 10.30.0.1 (255.255.255.0)
VLAN 2       - 10.0.15.249 (255.255.255.248) -- connects to main firewall/router LAN port.
 

On switch 2, what IP/subnet mask should I assign to the above mentioned VLANs.

**NOTE: Only Switch 1 connects to the firewall. This means that any traffic on switch 2 that is headed outside our network (internet), needs to go through Switch 1 in order to hit the firewall.
0
Comment
Question by:pzozulka
  • 6
  • 5
12 Comments
 
LVL 50

Assisted Solution

by:Don Johnston
Don Johnston earned 50 total points
Comment Utility
I will be trunking them together, and allowing some of our ESXi server to do NIC Teaming across both switches.
You can't do that. The teamed links have to go to the same switch.
On switch 2, what IP/subnet mask should I assign to the above mentioned VLANs.
I wouldn't assign IP addresses for the VLANs on the second switch (except one for management of the switch).
0
 
LVL 11

Expert Comment

by:Miftaul
Comment Utility
You dont need to assign IP address to the VLANs on the second switch. You can assign another free IP for the management VLAN only for remote management purpose.

But if you want to assign IPs for some reason or the other.

VLAN 1000 - 10.10.0.2 (255.255.255.0) or any other unused IP
VLAN 1020 - 10.20.0.2 (255.255.255.0) or any other unused IP
VLAN 1030 - 10.30.0.2 (255.255.255.0) or any other unused IP

Create Trunk between the two switches and EtherChannel bundling if you want.

It will work fine.
0
 
LVL 8

Author Comment

by:pzozulka
Comment Utility
donjohnston: I don't believe this is true because we are already doing the NIC Team (Route based on the originating virtual port ID) to two separate switches (same models) in one of our other offices. Not to confuse with LACP -- just static trunking on ProCurve switches. If this was true, and you can only Team NIC to a single switch, then if that switch was to die, there would be no redundancy.

Here are example configs from the two ProCurve switches in our other office (5304xl)

Switch 1:
interface A14 
   name "MDF-C02-A14" 
   flow-control 
   unknown-vlans Disable 
   no lacp
exit
interface B14 
   flow-control 
   unknown-vlans Disable 
   no lacp
exit
interface C14 
   name "MDF-C02-C14" 
   flow-control 
   unknown-vlans Disable 
   no lacp
exit
interface C16 
   name "MDF-C02-C16" 
   flow-control 
   no lacp
exit
trunk A14,B14,C14,C16 Trk1 Trunk 
vlan 1001 
   name "ESX VMotion" 
   ip address 10.0.128.21 255.255.255.248 
   tagged A10,B1,C10-C11 
   exit 
vlan 1002 
   name "IP Storage" 
   untagged A7,B12,B15,Trk5-Trk6 
   ip address 10.0.128.61 255.255.255.224 
   tagged A1-A2,A8,B13,C8 
   exit 
ip route 0.0.0.0 0.0.0.0 10.0.15.254

Open in new window


Switch 2:
interface A14 
   flow-control 
   unknown-vlans Disable 
   no lacp
exit
interface B4 
   unknown-vlans Disable 
exit
interface B14 
   flow-control 
   unknown-vlans Disable 
   no lacp
exit
interface C14 
   flow-control 
   unknown-vlans Disable 
   no lacp
exit
interface C16 
   flow-control 
   no lacp
exit
trunk A14,B14,C14,C16 Trk1 Trunk
ip default-gateway 10.0.156.253
vlan 1001 
   name "ESX VMotion" 
   ip address 10.0.128.22 255.255.255.248 
   tagged A1,A4-A5,B1 
   exit 
vlan 1002 
   name "IP Storage" 
   untagged Trk6-Trk7 
   ip address 10.0.128.62 255.255.255.224 
   tagged C8,C10-C13 
   exit 
ip route 0.0.0.0 0.0.0.0 10.0.15.254 

Open in new window


I want to pretty much create the same setup with the Cisco switch, but I'm not that familiar with Cisco. As you can see Switch 2 is the one that's connected to the main firewall (10.0.15.254) on port B4, and on each switch, all VLANs have IP assignments.

Lastly, the two switches are trunked together on ports A14, B14, C14, C16. Looks like it's a static trunk (not LACP -- which I believe is EtherChannel in Cisco terms).

I trust these configs because they work well and were created by our senior network engineers. So I'm a bit confused why both of you said I don't need to assign IPs to the VLANs on the second switch.
0
 
LVL 11

Accepted Solution

by:
Miftaul earned 450 total points
Comment Utility
A VLAN IP (aka SVI interface) gives Layer3 reachablity to a switch. Its not required for communication between switches or to your servers as switches works in Layer2 and doesn't bother Layer3.

Its only when Switch SVI requires IP address is
1. To remotely logon to the switch for management purpose.
2. If you are doing routing in the switch, say using Switch as default gateway.

In your case, its not required. It will work just fine, because you are adding the second switch for redundancy or additional layer2 ports, and you don't require additional Layer3 functionality on the second switch.

(In Cisco, the etherchannel is done mostly using LACP but there is a Cisco proprietary protocol called PAgP as well.)
0
 
LVL 8

Author Comment

by:pzozulka
Comment Utility
Thanks, that's what I thought as well, because in my experience, only when you add an IP address to a VLAN does it become reachable from other VLANs, which pretty much confirms what you just said.

I think it can be a benefit to be able to ping the storage VLAN devices from our management network for diagnostic purposes, but I see what you're saying in terms of functionality that L3 is not needed in our case.

Which brings me to my last question in the original post in regard to VLAN 2. This is the VLAN that contains the port on Switch 1 that connects to the firewall -- and in turn, to the outside world.

What config do I need to make on Switch 2, for all network traffic on swtich 2 headed to the outside world to know that to get to the outside world (firewall), the traffic needs to first go through switch 1.
0
 
LVL 11

Assisted Solution

by:Miftaul
Miftaul earned 450 total points
Comment Utility
"I think it can be a benefit to be able to ping the storage VLAN devices from our management network for diagnostic purposes, but I see what you're saying in terms of functionality that L3 is not needed in our case."

If you want to reach one vlan from the other, then there has to have some intervlan routing between the VLANs which is obviously a Layer3 business. Unfortunately when you enable interVLAN routing, it is enabled for all the VLANs, and you need to use ACLs to limit communication between unneeded VLANs


"Which brings me to my last question in the original post in regard to VLAN 2. This is the VLAN that contains the port on Switch 1 that connects to the firewall -- and in turn, to the outside world.

What config do I need to make on Switch 2, for all network traffic on swtich 2 headed to the outside world to know that to get to the outside world (firewall), the traffic needs to first go through switch 1."

You need to make sure all the VLANs are identical between both the switches either by manually creating them or implementing VTP.
Also you need to make sure all the VLANs are allowed on the trunk configuration between the switches.
Thats all.
0
How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

 
LVL 11

Expert Comment

by:Miftaul
Comment Utility
for all network traffic on swtich 2 headed to the outside world to know that to get to the outside world (firewall), the traffic needs to first go through switch 1.

No matter how many switches stack a VLAN traverses, its basic principal is it extends the broadcast traffic to the switching fabric.  Your traffic to external network will be broadcasted with in the VLAN throughout both the switches, and due to proxy arp, the default gateway will  respond with its MAC address for the traffic destined to unknown network, The devices will then build the frame for the traffic to outside world using the mac address of the default gateway. Once the gateway receives the frame, it will do its job of forwarding that.
0
 
LVL 8

Author Comment

by:pzozulka
Comment Utility
I just read your last comment. Does that mean the default gateway on Switch 1 has to be 10.0.15.254 (router's IP), and same on Switch 2?

My other options is: Since Switch 1 is the one that connects directly to the router, have its default gateway be 10.0.15.254, and Switch 2's default gateway point to Switch 1.
0
 
LVL 11

Expert Comment

by:Miftaul
Comment Utility
To the basics, why exactly we need a default gateway in a switch. A switch being a layer2 device, doesn't have any Layer3 intelligence. When we give an IP to any Switch SVI interface and want to manage the switch remotely, the IP traffic will reach the switch, but the return traffic will not come back because the switch doesn't know where to forward traffic. Thats where the default-gateway comes into play, if the switch doesn't know where to forward traffic, it forwards them to default gateway.

Query - I just read your last comment. Does that mean the default gateway on Switch 1 has to be 10.0.15.254 (router's IP), and same on Switch 2?

To answer your question, yes, the default gateway on both the switches should be the Router IP 10.0.15.254

Query - My other options is: Since Switch 1 is the one that connects directly to the router, have its default gateway be 10.0.15.254, and Switch 2's default gateway point to Switch 1.

Don't do this. Even if you do, as I said switches doesn't have Layer3 intelligence, so Switch2 will forward the return management traffic to Switch1 and again switch1 will forward that to the router. This doesn't make any sense, does it.
0
 
LVL 8

Author Comment

by:pzozulka
Comment Utility
Both switches are set to L3 mode. Does that change any of what you said in this case?
0
 
LVL 11

Expert Comment

by:Miftaul
Comment Utility
No, its the same.

Set the default gateway to both switches to the router ip.
0
 
LVL 8

Author Comment

by:pzozulka
Comment Utility
Thanks much.
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

The worst thing when starting a new job is when the previous Network Administrator left behind no documentation. How do you get into the devices? If you've been in this situation or just accidently mistyped your password, this article will hopefully…
I see many questions here on Experts Exchange regarding switch port configurations and trunks. This article is meant for beginners in the subject to help to get basic knowledge about Virtual Local Area Network (VLAN (http://en.wikipedia.org/wiki/Vir…
Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…
This video explains how to create simple products associated to Magento configurable product and offers fast way of their generation with Store Manager for Magento tool.

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now