Go Premium for a chance to win a PS4. Enter to Win


L2/L3 Switch configuration

Posted on 2016-08-25
Medium Priority
Last Modified: 2016-09-02
Excluding STP configuration on this Question, as  it has been covered in previous questions.

I need some guidance on what to configure on Access/Distrib/Core Switches in order to get the traffic flowing to and from both sides of the core switches
** For Instance on the Core switches
 I will create VTP domains
Create VLAN interfaces
configure IP default gateway for each Vlan
Configure IP Routing
Configure HSRP or VSS or Vcp
Configure Ip-DHCP Helper

** On Distribution Swicthes

***On access Switch
assign ports to VLAN

- on the diagram, each block has access switches connected to Distribution Switches
that 's for Clients as well as Servers..I mean servers are not all in one data center (Room).. I mean there are some servers located in the same physical location as the Clients  

Any help will be very much appreciated

I need just to know what to configure, not the details of the configuration.

Thank you

Question by:jskfan
LVL 22

Assisted Solution

eeRoot earned 200 total points
ID: 41771035
Distribution switches have a simple configuration, they need mgmt IP, VLAN info, and spanning tree settings.

Access layer switches need the same info as the distribution switches, plus the commands for each individual port config.

Servers would usually connect to dedicated data center switches.  These switches would also have the storage connections.
LVL 18

Assisted Solution

Akinsd earned 600 total points
ID: 41771042
I will create VTP domains
Create VLAN interfaces
configure IP default gateway for each Vlan
Configure IP Routing
Configure HSRP or VSS or Vcp
Configure Ip-DHCP Helper

I just realized that the other switches are distribution switches.
In this case, you want the distribution switch that host the interface vlan to be the root bridge for that vlan
Hence you RPVST is your best bet for your topology. Using the core as roots would make all traffic between vlans go through the core. This would cause increased bandwidth and unnecessary processor burden on the core switches. By making the distribution switches the roots, traffic crossing the core or exiting the network would be the ones that pass through the core.

You can make your core switches VTP server, all other switches should be VTP client.
VLAN Interfaces would be configured on your distribution switches
The IP assigned to the interface vlan is your gateway for each vlan
IP DHCP Helper Address would be configured under the interface vlan you created (on the distribution switch)
IP routing would be configured on both distribution and the core
It is best to configure access list as close to the source as possible - In this case, on the access switches. Depending on traffic you need to block or allow, you may ACLs on distribution and Core as well
Configure your VSS on the Core switches,  HSRP on the distribution switches  for default gateway failover
LVL 47

Accepted Solution

Craig Beck earned 1200 total points
ID: 41771137
With a core/dist/access topology you don't want to be using VTP across all of your switches.  In fact, you shouldn't be creating many VLANs at the core at all.  VLANs will be created at the distribution layers, and SVIs will be attached to those VLANs in order to provide L3 functions, but at the access switches you just need VLANs; no SVIs.  VTP is bad.  Don't use it.  Set all of the switches to VTP Transparent mode and manually create VLANs.  The core will be used purely to transit traffic between each distribution zone, so VLANs aren't required there.

Between cores you should decide how they'll function.  Will you use VSS (if they're Cisco) or will they run separately?  If they run separate, will you use L2 links or L3 links between them?  That will dictate which FHRP protocols you could use.  If you use L2 between cores you'd want to use HSRP, while L3 links would require GLBP, for example.  VSS would massively simplify the topology.

From core to distribution you'd want to run pure L3 links.  They could be L3 at individual interfaces if you're not running VSS, or L3 Port-channels if you do VSS, so you can use multichassis-etherchannel (MEC).  Distribution switches should also run VSS where possible, or be stacked, again so you can leverage MEC.  It'll make routing simpler if you use less L3 interfaces.

IP routing should be dynamic.  OSPF is usually the preference in a campus, while you could use EIGRP if it's all Cisco kit.  OSPF would require a good design, so I'd advise the use of totally stubby areas for each distribution block where access switches are connected, and NSSA at the internet distribution block.  Each L3 device should have a Loopback interface configured where OSPF is used and that should be configured as the router-id in the OSPF process for each switch.

SVIs at the distribution layer is where you're going to need to put ACLs and IP helpers.  Also, turn off things like Proxy-ARP on SVIs if you want people to require a default gateway on their devices.

At the dist to access layer, try not to stretch VLANs across switches.  Where an access switch or stack has VLANs for each service, the next stack should have different VLANs for the same services.  That'll help reduce the reliance on STP.  Akinsd is correct in saying that Rapid-STP is what you're after here.  Using L3 between core and distribution cuts out STP completely.

Access switches should have things like BPDU Guard, Loop Guard and Portfast enabled by default.  Also you should use DHCP snooping, Dynamic ARP Inspection and IP Source Guard where possible to mitigate ARP poisoning, rogue DHCP servers, etc.

Author Closing Comment

ID: 41782027
Thank you Guys!

Featured Post

Identify and Prevent Potential Cyber-threats

Become the white hat who helps safeguard our interconnected world. Transform your career future by earning your MS in Cybersecurity. WGU’s MSCSIA degree program was designed in collaboration with national intelligence organizations and IT industry leaders.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

You deserve ‘straight talk’ from your cloud provider about your risk, your costs, security, uptime and the processes that are in place to protect your mission-critical applications.
As managed cloud service providers, we often get asked to intervene when cloud deployments go awry. Attracted by apparent ease-of-use, flexibility and low computing costs, companies quickly adopt leading public cloud platforms such as Amazon Web Ser…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …

963 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question