Solved

L2 to EIGRP slow migration?

Posted on 2016-11-01
27
60 Views
Last Modified: 2016-11-26
I have a network of 6 nodes connected via fiber. It is currently a layer2 network. The core switch is doing intervlan routing. To access the Internet, all sites have to go through the core before accessing the Internet via sw2 (see diagram). The STP root is at the core.

What I am trying to do is to figure out if I can slowly enable routed ports and enable EIGRP, two sites per day as they are far apart (~400 miles) from each other. It is quite risky to do it all remotely.

For the test, I enabled EIGRP between sw4 and sw5. I was able to ping the FW from sw4 and sw5. However, when I disabled fa0/2 on sw4, I lost the connection. It looks like there is only one way traffic (which is to go to the core and to the FW) and that will make my production network vulnerable to downtime. If the link between sw4 & core fails, users attached to sw4 cannot access the Internet or any servers attached to sw3.

Any thoughts? Thanks

net diag
0
Comment
Question by:leblanc
  • 13
  • 10
  • 4
27 Comments
 
LVL 1

Expert Comment

by:S C
ID: 41869658
Hi leblanc,

I suggest you overlay your existing connectivity, ie introduce another vlan on each of your trunk ports. Use different vlan number on all switch interlinks (keep them point to point only). Configure layer 3 SVIs and enable eigrp routing across those new interlinks.

That way you can maintain your existing topology intact until you are ready to slowly cutover to layer 3 (at this stage you should have layer 3 links everywhere).

Once you get to the stage where layer 2 is no longer needed start removing obsolete vlans. At the final stage reconfigure all trunks as routed ports reusing earlier created interlinks
1
 
LVL 1

Author Comment

by:leblanc
ID: 41870360
Hi S C,

"introduce another vlan on each of your trunk ports", can you elaborate on this? Thx
0
 
LVL 1

Accepted Solution

by:
S C earned 250 total points
ID: 41870529
For the interlink between sw4 and sw5 create a new vlan, let's say VL201 and add to the trunk only there. Create SVI on either end. Configuration for the first interlink may look like this:

SW4
Vlan201

Int fa0/1
Switchport trunk allowed vlan add 201

Interface vlan 201
Ip address 10.200.200.1 255.255.255.252
no shut

Router eigrp 2
eigrp router-id x.x.x.x
Passive-interface default
No passive-interface vlan 201
Network 10.200.200.0 0.0.0.255
No auto-summary

SW5
Vlan201

Int fa0/1
Switchport trunk allow vlan add 201

Interface vlan 201
Ip address 10.200.200.2 255.255.255.252
no shut

Router eigrp 2
eigrp router-id x.x.x.x
Passive-interface default
No passive-interface vlan 201
Network 10.200.200.0 0.0.0.255
No auto-summary

Repeat on all interlinks using different vlans and subnets.
1
 
LVL 26

Assisted Solution

by:Predrag Jovic
Predrag Jovic earned 250 total points
ID: 41870664
This is good suggestion as the first step in transition.
At the final stage reconfigure all trunks as routed ports reusing earlier created interlinks
However, I would not do this. I would leave it as a trunk everywhere and the reason would be a little bit different design:

Int fa0/1
   switchport trunk allow vlan add 201
   switchport trunk native vlan 201

And when other VLANs are not needed (core design is moved from L2 to L3 topology):

Int fa0/1
   switchport trunk allow vlan 201

This way, end result would be trunks everywhere, but only native VLAN would be allowed on trunks.
So, it would be equivalent of L3 links. Gain here would be - if VRFs are needed (or temporary VLAN between two location for whatever the reason) you can always add VLAN and use it for VRF on existing trunks with no downtime at all.
0
 
LVL 1

Author Comment

by:leblanc
ID: 41870863
S C

ok so instead of having a routed port now, I will create a SVI 201 (for example) with /30 on sw4 and sw5. I will allow that VLAN 201 on my exiting trunk. So that way I have EIGRP routing as well as the existing layer 2 traffic.

Predrag
So as your next step suggestion, leave the trunk along and prune all VLANs, except vlan 201 from the trunk. Correct?
0
 
LVL 26

Assisted Solution

by:Predrag Jovic
Predrag Jovic earned 250 total points
ID: 41870882
Int fa0/1

   switchport trunk allow vlan 201
Will do exactly that - allow only VLAN 201 on trunk.
You have a lot of work until that point of network redesign is reached.
For example: configure IP addresses per each location and use new default gateway on location (on distribution or core device). Choose IP addresses carefully so you can easily summarize IP address range for each location.
 :)
0
 
LVL 1

Author Comment

by:leblanc
ID: 41870899
I will try that. You guys got some really good tips.Thx
Also, it is ok to use 10.200.200.x/30 for all the interlinks. Correct?
0
 
LVL 26

Expert Comment

by:Predrag Jovic
ID: 41870900
Yes.
0
 
LVL 26

Expert Comment

by:Predrag Jovic
ID: 41870934
Also, current Core device is the only one that can keep original IP address scheme, but also think about changing them to IP address range that can easily be summarized.
0
 
LVL 1

Author Comment

by:leblanc
ID: 41870936
So for each interlink, I have to pick a different vlan. In other words, if I have vlan201 betweeen sw4 and sw5, then I will have vlan202 between sw5 and sw1. Correct?
0
 
LVL 26

Expert Comment

by:Predrag Jovic
ID: 41870937
Yes. That's how you get point-to-point links.
0
 
LVL 1

Expert Comment

by:S C
ID: 41871111
Watch out on below command, it prunes all your other vlans from the trunk! You don't want this done immediately as it would breaks your existing connectivity (add keyword is very important).

Int fa0/1
   switchport trunk allow vlan 201
0
 
LVL 1

Author Comment

by:leblanc
ID: 41871192
Yes. I did that command after I configured the network 10.0.0.0 0.255.255.255 in eigrp process for all switches. Thx
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 26

Expert Comment

by:Predrag Jovic
ID: 41871524
It is not over yet, fun starts here - not to break the network down (my favorite). :)

Configure loopback on every device and advertise it to into EIGRP (not mandatory, but highly recommended).
Core should advertise all networks into EIGRP.
Next steps will temporary break internet in any scenario and should be done either from locations, or issued from the flash (script it).
 - static default route from core should be removed
 - link between SW2 and FW becomes point-to-point
 - SW2 advertise default route into EIGRP
(order of operations can be changed and actual scenario can vary, carefully plan this part it can cut you off of the network)
On SW2 and Core issue reload in X (at least 20) before starting with any of this (the only protection that you really have since you can't be in SW and Core location at once (or maybe you can?)), and have fun. :)

When this is done EIGRP basic package is over - locations are ready to be moved to new IP address ranges (and next part starts with DHCP team).
0
 
LVL 1

Author Comment

by:leblanc
ID: 41872195
I am physically at the core. I can telnet to sw4 and perform the change. I did this in Packet Tracer and there was no disconnect.

I prefer not to make all the changes in one day. So can I just start enable eigrp routing between sw4 and sw5 and let it run for a few days then move to sw5 and sw1 and so on. I will make the core and sw2 last. If I do it that way, I will initiate the network 10.0.0.0 command in eigrp. Will that work?
0
 
LVL 26

Assisted Solution

by:Predrag Jovic
Predrag Jovic earned 250 total points
ID: 41872248
Yes, it will work (you will not really use EIGRP at all in the first days). :)

If you advertise default route into EIGRP prior to remove static route from Core it will replace default route fast, however you still need to change link between SW2 and FW.

I don't know full topology and all details. With knowing all details maybe downtime can be avoided completely , however it is very unlikely, but it may be possible. If you have two different exit points to internet  (on different location) for sure it can be done without downtime.
0
 
LVL 1

Author Comment

by:leblanc
ID: 41872493
Currently everything is at layer 2 with the DG to the core.
Yes. sw2 and the fw will need to be a pt-to-pt. I can afford downtime to the Internet during the change. Thx
0
 
LVL 1

Author Comment

by:leblanc
ID: 41872704
I think the pt to pt interlink cannot be a trunk as I cannot  use ip helper-address for DHCP on the trunk. Any work around? Thx
0
 
LVL 26

Assisted Solution

by:Predrag Jovic
Predrag Jovic earned 250 total points
ID: 41872722
Currently you have interVLAN routing on Core switch. After redesign you should have interface VLAN for every VLAN on every location (you can keep the same VLAN numbers and names with new IP addresses). L2 ends on distribution or core device. All VLANs are terminated locally. On each interface VLAN that needs DHCP you will configure ip helper address.
On interlink between SW2 and FW you can use L3 link or trunk, whatever you prefer.
0
 
LVL 1

Author Comment

by:leblanc
ID: 41872816
That's right. Why didn't I think of that?
I will remove the SVI 40 from the core and add ip helper-address in svi 40 on sw4. Thx
0
 
LVL 1

Author Comment

by:leblanc
ID: 41873187
I have the following situation:
- When I configured the pt-to-pt vlan with 10.200.200.0/30 between core and sw4, I was able to ping 10.10.100.254 from sw4.
- When I configured the pt-to-pt vlan with 172.16.250.0/30 between core and sw4, I was not able to ping 10.10.100.254 from sw4. I see that there is a route to the core as the last resort but I am not sure why I could not ping 10.10.100.254? Any thoughts?
0
 
LVL 1

Assisted Solution

by:S C
S C earned 250 total points
ID: 41873270
Is the 172.16.x.x network in the routing table from 10.10.100.254 perspective. Check th source ip of the ping packet from SW4?

Based on your earlier message you've added to eigrp 10.x.x.x only. Why 172.x.x.x now? Have you tried adding network statement for that new range?
0
 
LVL 1

Author Comment

by:leblanc
ID: 41873292
Arrgg... I forgot a static route 172.16.0.0/16 from my fw pointed back to the internal network. Good catch S C. Thx
0
 
LVL 1

Author Comment

by:leblanc
ID: 41873380
I created the interlinks /30 pt-to-pt for all sites without downtime.
I consoled in sw2 and redistribute my default route 10.10.100.254 into eigrp.
I removed all the default routes from all other switches. They now see sw2 as the way to get to the fw.
I had a continuous ping from core to 10.10.100.254 and on sw2, I configured the trunk to allow only vlan254 between sw2 and sw3. My pings from the core then failed. I am still troubleshooting the issue but any thoughts will be appreciated. Thx


net diag
0
 
LVL 26

Expert Comment

by:Predrag Jovic
ID: 41873413
And now we are having fun (and reason for downtime). :)
I configured the trunk to allow only vlan254 between sw2 and sw3
You removed VLAN 100 from link, and fw is in located in vlan 100. There are several  ways to resolve this, for example:
- Remove vlan 100 from core (core it trying to resolve 10.10.100.254 by broadcast and can't resolve it since VLAN 100 is broken. For core it is directly connected network - 10.10.100.0/24).
- On SW2 add vlan 100 (if removed) and interface VLAN 100 with IP address 10.10.100.253 (maybe change subnet mask on both devices to /30?)
- Then you need to advertise default route from SW2 (and, of course, have default route (or network) on SW2)

Don't know how you advertise default route currently, but if you configured core to advertise default route - that need to be removed.
That's part of link become p-t-p between SW2 and FW. Network with the same/overlapping IP address range must be removed from CORE, or link between FW and SW2 must be placed in  a new subnet to be reachable from core. Rule - you can't have discontiguous networks. You can have the same VLAN names and numbers everywhere (it is locally significant information) as long as IP address ranges are unique.
0
 
LVL 1

Author Comment

by:leblanc
ID: 41878025
It seems to be working. I redistributed the default static route to EIGRP from sw2 and removed all the static route from other switches. I also pruned other VLANs and only the pt-to-pt VLANs are allowed on the trunk. I did all of that from the telnet from the core.

Now, I checked my EIGRP (sh ip eigrp topology) and I was expecting 2 routes for each interface. But only a couple of them has it. Each of the other routes have 1 successor. Does it sound right? Thx
0
 
LVL 26

Assisted Solution

by:Predrag Jovic
Predrag Jovic earned 250 total points
ID: 41878142
That is expected behavior. Only the best route is placed into routing table and by default only equal cost routes are placed in routing table. If you want you want you can change variance to have more routes placed in routing table. By default variance is 1 and that means that only best routes with equal cost paths will be placed in routing table. If you change variance to be higher there should be few more routes placed in routing table. Think about shape of network - it is a circle, by default only networks from the opposite side of circle (depending on number of nodes) have a chance to have two routes with equal cost and those will be in that case placed in routing table. You can change variance and more routes will be placed in routing and topology table. EIGRP is the only protocol that can do unequal cost path load balancing.

router eigrp x
 variance 4
0

Featured Post

Highfive + Dolby Voice = No More Audio Complaints!

Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

Join & Write a Comment

Suggested Solutions

Load balancing is the method of dividing the total amount of work performed by one computer between two or more computers. Its aim is to get more work done in the same amount of time, ensuring that all the users get served faster.
Don’t let your business fall victim to the coming apocalypse – use our Survival Guide for the Fax Apocalypse to identify the risks and signs of zombie fax activities at your business.
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now