Solved

L2/L3 Switch configuration

Posted on 2016-08-25
4
116 Views
Last Modified: 2016-09-02
Excluding STP configuration on this Question, as  it has been covered in previous questions.

I need some guidance on what to configure on Access/Distrib/Core Switches in order to get the traffic flowing to and from both sides of the core switches
** For Instance on the Core switches
 I will create VTP domains
Create VLAN interfaces
configure IP default gateway for each Vlan
Configure IP Routing
Access-List
Configure HSRP or VSS or Vcp
Configure Ip-DHCP Helper
etc..


** On Distribution Swicthes
???
???

***On access Switch
assign ports to VLAN
etc..

- on the diagram, each block has access switches connected to Distribution Switches
that 's for Clients as well as Servers..I mean servers are not all in one data center (Room).. I mean there are some servers located in the same physical location as the Clients  

Any help will be very much appreciated

I need just to know what to configure, not the details of the configuration.

Thank you

sw
0
Comment
Question by:jskfan
4 Comments
 
LVL 21

Assisted Solution

by:eeRoot
eeRoot earned 50 total points
Comment Utility
Distribution switches have a simple configuration, they need mgmt IP, VLAN info, and spanning tree settings.

Access layer switches need the same info as the distribution switches, plus the commands for each individual port config.

Servers would usually connect to dedicated data center switches.  These switches would also have the storage connections.
0
 
LVL 18

Assisted Solution

by:Akinsd
Akinsd earned 150 total points
Comment Utility
I will create VTP domains
Create VLAN interfaces
configure IP default gateway for each Vlan
Configure IP Routing
Access-List
Configure HSRP or VSS or Vcp
Configure Ip-DHCP Helper

I just realized that the other switches are distribution switches.
In this case, you want the distribution switch that host the interface vlan to be the root bridge for that vlan
Hence you RPVST is your best bet for your topology. Using the core as roots would make all traffic between vlans go through the core. This would cause increased bandwidth and unnecessary processor burden on the core switches. By making the distribution switches the roots, traffic crossing the core or exiting the network would be the ones that pass through the core.

You can make your core switches VTP server, all other switches should be VTP client.
VLAN Interfaces would be configured on your distribution switches
The IP assigned to the interface vlan is your gateway for each vlan
IP DHCP Helper Address would be configured under the interface vlan you created (on the distribution switch)
IP routing would be configured on both distribution and the core
It is best to configure access list as close to the source as possible - In this case, on the access switches. Depending on traffic you need to block or allow, you may ACLs on distribution and Core as well
Configure your VSS on the Core switches,  HSRP on the distribution switches  for default gateway failover
0
 
LVL 45

Accepted Solution

by:
Craig Beck earned 300 total points
Comment Utility
With a core/dist/access topology you don't want to be using VTP across all of your switches.  In fact, you shouldn't be creating many VLANs at the core at all.  VLANs will be created at the distribution layers, and SVIs will be attached to those VLANs in order to provide L3 functions, but at the access switches you just need VLANs; no SVIs.  VTP is bad.  Don't use it.  Set all of the switches to VTP Transparent mode and manually create VLANs.  The core will be used purely to transit traffic between each distribution zone, so VLANs aren't required there.

Between cores you should decide how they'll function.  Will you use VSS (if they're Cisco) or will they run separately?  If they run separate, will you use L2 links or L3 links between them?  That will dictate which FHRP protocols you could use.  If you use L2 between cores you'd want to use HSRP, while L3 links would require GLBP, for example.  VSS would massively simplify the topology.

From core to distribution you'd want to run pure L3 links.  They could be L3 at individual interfaces if you're not running VSS, or L3 Port-channels if you do VSS, so you can use multichassis-etherchannel (MEC).  Distribution switches should also run VSS where possible, or be stacked, again so you can leverage MEC.  It'll make routing simpler if you use less L3 interfaces.

IP routing should be dynamic.  OSPF is usually the preference in a campus, while you could use EIGRP if it's all Cisco kit.  OSPF would require a good design, so I'd advise the use of totally stubby areas for each distribution block where access switches are connected, and NSSA at the internet distribution block.  Each L3 device should have a Loopback interface configured where OSPF is used and that should be configured as the router-id in the OSPF process for each switch.

SVIs at the distribution layer is where you're going to need to put ACLs and IP helpers.  Also, turn off things like Proxy-ARP on SVIs if you want people to require a default gateway on their devices.

At the dist to access layer, try not to stretch VLANs across switches.  Where an access switch or stack has VLANs for each service, the next stack should have different VLANs for the same services.  That'll help reduce the reliance on STP.  Akinsd is correct in saying that Rapid-STP is what you're after here.  Using L3 between core and distribution cuts out STP completely.

Access switches should have things like BPDU Guard, Loop Guard and Portfast enabled by default.  Also you should use DHCP snooping, Dynamic ARP Inspection and IP Source Guard where possible to mitigate ARP poisoning, rogue DHCP servers, etc.
0
 

Author Closing Comment

by:jskfan
Comment Utility
Thank you Guys!
0

Featured Post

Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

Join & Write a Comment

Problem Description:   Couple of months ago we upgraded the ADSL line at our branch office from Home to Business line. The purpose of transforming the service to have static public IP’s. We were in need for public IP’s to publish our web resour…
Tired of waiting for your show or movie to load?  Are buffering issues a constant problem with your internet connection?  Check this article out to see if these simple adjustments are the solution for you.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now