Collapsed Core / Distribution VLAN Config

Hi Guys,
I was wondering if you could provide me with some insight.
If I have 2 L3 devices in my collapsed core and distribution layer, how do I go about configuring VLANS?
Currently I have 2 Core/Dist Switches both running L3 and 5 Access Switches
I've configured STP and VTP accross the campus and all is working well.
Now, a sh run from core1 shows vlan information including ip address of interface for the vlan etc, but core2 doesn't, it's aware of the VLANs due to VTP but doesn't display any interface information.
If Core1 was to fail, how does my network know how to route?
is this design recommended?

The following is only my opinion:
VTP mode transparent across all devices. Unless you are doing some sort of 802.1x authentication I don't see a need, just headaches.
Make one of the collapsed core members the STP root via the spanning tree prior 0 command for all vlans. Set the other member as a backup with the spanning tree prior 4096 or some other small value for all vlans.
Create a trunk between the collapsed core members trunking all vlans.
Create a trunk from each access switch to each collapsed core member and trunk the appropriate vlans, or all.
Create your layer 3 interfaces for the vlans on the collapsed core members and set up redundancy via HSRP or VRRP.

Similar Messages

Nexus 6001 for small DC as a collapsed core/distribution instead of 4500X

Hi,
I am looking for a switch platform for a small DC that can provide high density 10G and good L3 performance. I was thinking of Nexus 6001 as L3 performance is better thant 5548/5596 and it supports FabricPath. Than I have also looked at the 4500X but I think that it is more a campus switch than a DC switch. Moreover I would like to get rid of Spanning Tree ;-)
My last concern is what is the difference in the buffer capacity (when talking 10G to 1G conversion) when comparing the Nexus 6001 to the CAT4500X?
Thanks in advance,
Regards,
Laurent

Hi,
Any ideas?
Regards,
Laurent

How to span vlans across core layer in core/distribution/access campus design?

Hi,
I studied Cisco Borderless Campus Design Guide 1.0 (http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Campus/Borderless_Campus_Network_1-0/Borderless_Campus_1-0_Design_Guide.html) last week because we plan to redesign our campus backbone to a three tier Core/Distribution/Access Design.
Today we use a collapsed backbone where a lot of vlans are spanned across the backbone because they are needed in different buildings.
Could anybody give me a hint how Cisco recommends to deal with that kind of vlans in the multi-tier design?
In my eyes between core and distribution layer there is only routing functionality and no l2 transport of vlans.
So using the same vlan in different buildings seems not to be supported?
Best Regards,
Thorsten

Thorsten
Just to add to Joseph's post.
It is quite common for a vlan to be spanned when it doesn't actually need to be ie. the network has evolved that way.
Most things do not need L2 adjacency, they can happily use L3. Servers sometimes do but in the campus design your servers are usually located in one site so you don't need to extend vlans to other sites in your campus.
Not suggesting this is the case for you but it may be worth checking whether you really do. (apologies if you already have)
As Joseph mentioned you really want to avoid it if at all possible ie. ideally all connections to the core switches are L3 ie. no need for vlans at all in the core.
If you need to extend a few vlans then you can do this but still route for all other vlans ie. you would configure your distribution to core connections as trunks and then allow the vlans you need to extend plus one other vlan, unique per distribution pair, to route all other vlans. So per site your distribution switches route all vlans except the extended vlans and of they need to route to a vlan in another site they use that unique vlan.
But this is not ideal because you then need to extend certain vlans across the core and because you are using L2 connections STP could come into it although that does depend on your core switch selection eg. 4500/6500 VSS etc. would alleviate this.
There are ways to extend vlans across a L3 network but the solutions available are very much dependant on the kit you use and their capabilities so if you do need multiple vlans in multiple sites but still want to keep a L3 core you may want to investigate some of those before purchasing kit (unless of course you have already purchased it).
What you do really depends on just how many vlans you actually need to extend between sites.
Jon

Collapsed core network design

I am a consultant, currently a CCNA studying for the CCNP, and I have been mandated to design the network infrastructure for the corporate head office of a mid sized company.
My design is based on a collapsed core network, with 2 x 4900M Switches as the core/distribution and a bunch of 2960S switches for each floor of the building.
While reading the CCNP book, I noticed I had a design 'flaw'... Like the partial diagram below (this is not the actual design), I was planning on linking the two 4900M with a layer 2 etherchannel, and using 1 MST region with 2 instances to split the VLANs between the two core switches.
The CCNP curriculum recommends using a Layer 3 link between the core switches. I'm not sure what the benefit of doing so would or the drawback of using Layer 2 is? Any input would be more than appreciated...
Thanks,
Marc

I understand that it reduces the chances of loops, but spanning tree is still required/running no? I'm going to lab this today and come back with observations or questions if I have any
Thanks for your time,
Marc

Solaris 10 X2100 VLAN config

What are my options for configuring a virtual interface on an x2100 server with Sol10 Because the interface shows up as the type " nge0" I am assuming
that the hardware does not support it per the info below. Is there another alternative or a software workaround ?
-john
The Solaris OS now supports VLANs on the following interface types:
ce
bge
xge
e1000g

Looks like I just had the wrong VLAN config syntax.. and miss read the documentation. this works !
bash-3.00# ifconfig -a
lo0: flags=2001000849<UP,LOOPBACK,RUNNING,MULTICAST,IPv4,VIRTUAL> mtu 8232 index 1
inet 127.0.0.1 netmask ff000000
nge0: flags=1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500 index 2
inet 128.111.207.230 netmask ffffff00 broadcast 128.111.207.255
ether 0:e0:81:5c:d3:6
nge829000: flags=201000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4,CoS> mtu 1500 index 4
inet 10.0.0.62 netmask ffffff00 broadcast 10.0.0.255
ether 0:e0:81:5c:d3:6

4500-X vs 6880-X for Core/Distribution

Hi,
    We are in the process of looking at upgrading our eight year old Cisco network to something newer.
    Currently we have a 6500 for core/distribution with about 40+ 1 gig fibre links running out to access layer switches. (3560 and 3560X)
    The whole design is routed with the links from core/distribtion to access all being layer 3. The intent was to dual attach access layer switches to 6500s in two buildings but this was never actually implemented.
     The new design uses 3650 switches at the access layer, and a recommendation to use the 6880-X for core/distribution. This time around key buildings will be dual attached and I expect we will keep the routed design. 9396PX will be introduced at the datacenter layer.
     It looks to be like the 6880-X is a pretty limited unit. No real path to 40 or 100 gig, no redundant supervisors, just a big box of 10 Gig ports.
     I am assuming the cost on a 6807 chassis is just going to be too high, although 40 G and 100G are either available today or on the roadmap.
     I am trying to figure out why two 4500-X with Enterprise software in VSS mode isn't a better fit. The port count is good at 80 (between the two), it has more bandwidth, features like MACSEC and SGT are on the develpment radar (if not already implemented), and two of these in VSS means I can perform a firmware update with minimal down time.
     I plan to implement ISE in 2015 so having a platform that is going to work with ISE is really important to me.
Thanks
Murray

Wow, amazing that noone answered such a real world question. I had like 2 similar cases within the last 2 months!!!
I normaly really like 4500X, it´s a powefull 1U 10G unit, and I myself am a fan of VSS, so - I agree with you, that should be a first choice! (btw - 6880 also supports VSS)
When to use 6880X? Well, I had a case recently with 45 3750X stacks in the core, so 80 ports in total wouldnt even cover a port-channel per stack, so - I used 6880X. How do I see this switch? As a moderatly priced almost-Nexus alternative for Campus with 10G with a VSS support.
To sum it up - yeah, I´d use 4500X if I were you...
Cheers!

Sinkhole routing rfc1918 on the core/distribution switch (6500)

Hi guys,
I am planning on getting rid of packets going to unrouted nonexistent rfc1918 networks in our DC environment going into internet facing firewall from our core/distribution switch via default route. I am thinking on setting a bunch of rfc1918 static routes to Null0 on the core/distro switches so they will kill all the packets destined to unused rfc1918 networks into Null0. Wondering if that would be a good solution to this.
Thanks!

I am not sure quite what you have in mind when you talk about a bunch of rfc1918 static routes. I could see doing a route for 10.0.0.0 range, for 172.16.0.0 range, and for 192.168.0.0 range. Is 3 a bunch? If you had more in mind what would they be?
If you do static routes to Null0 for the summarized spaces then it would allow routing to any private addresses used inside your network to work since they should have more specific entries in your routing table and it would discard traffic with destination addresses in private address space. Be aware that if you have any site to site VPN tunnels from the firewall or any address translations on the firewall that use private addresses that your plan may very well have negative consequences for them.
HTH
Rick

Config view for VLAN config is not supported

Hi folks,
I have the following error when I try to view the VLAN config from RME->ConfigManagement->Version Tree.
"Config view for VLAN config is not supported"
I didn't found any information over the RME and Campus documentation.
Anybody know what kind of error I'm issuing
Thanks and Regards.
Leonardo

Hi Pablo,
The VLAN.dat file cannot be used to be deployed via CiscoWorks, but it can be done manually:
http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_resource_manager_essentials/4.3/user/guide/config.html#wp1311740
The problem with viewing the VLAN.dat contents in the config viewer or change audit reports is also mentioned in the link below:
http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_resource_manager_essentials/4.3/user/guide/chgaud.html#wp1060886
Look for the "Details" row and there you will see the following:
VLAN configurations cannot be compared because they are in binary format. In this case, the Details link will not be available and will be shown as NA.
Hope this helps!

1250AP VLAN config

I am trying to configure VLANs on my 1250 autonomous AP. I have the sub-interfaces setup but still cannot connect to the LAN. I use 432 for my native vlan and then want to assign clients to vlan 543. Being a security guy, I do not use vlan 1, nor do I trunk vlan 1. Here's a snippet of my config, so tell me what I am missing. All interfaces are showing up-up.
Thanks.
int d0
no ip add
int d0.432
encap dot1q 432 native
bridge-group 1
int d0.543
encap dot1q 543
bridge-group 2
int g0
no ip add
int g0.432
encap dot1q 432 native
bridge-group 1
int g0.543
encap dot1q 543
bridge-group 2

I'd prefer to not post the entire config as it would take a lot of editing. :-)
Both statements are there, and there is no issue with the SSID config. I'm just trying to get a connection to my RADIUS server, which the AP cannot connect to. I am not able to ping the server from the AP, so it has something to do with the vlan config, but I don't know where. The switch where the AP is connected is trunking and allows all vlans (at this point) except for 1.
This is a head scratcher. :-)

Private Vlan config

I have a question regarding private Vlan config. I have a DMZ switch where I need to be able for a particuilar server to communicate to the reset of the servers on port 8686 and deny the rest of the communications between them. I have this server on a poremiscuios mode and the other servers on isolated ports.For security reason how can apply this access list? on which vlan? I am running IOS on the switch connecting these servers. Thanks for your help

the port is that the server(10.3.1.50. 255.255.0.0) that need to talk to all server is attached to:
interface GigabitEthernet1/0/18
description DZ1WEBSD001
switchport private-vlan host-association 50 51
switchport mode private-vlan promiscuous
speed 100
duplex full
no mdix auto
The subnet is 10.3.1.0 255.255.0.0
Basically the 10.3.1.50 need to talk to all servers on this subnet on port 8686 and deny evrything else
Thanks

Vlan database vs vlan config, rpr-plus...

We have Catalysts 6500's that we are migrating to native ios mode, and have noticed in the docs (http://www.cisco.com/en/US/customer/products/hw/switches/ps708/products_configuration_guide_chapter09186a00800da705.html#wp1095579) that vlan configurations made from the vlan database mode are NOT replicated throught rpr-plus.
While configuration of vlans through the global config mode isn't really a problem for future configs, we haven't found a way to easiliy convert vlan database configs to vlan-config...
Is there such a way besides clearing vlan.dat and starting over?
Also, after doing a clean config of vlans through vlan-config, there doesn't seem to be much (any?) diffrence either in the global config or the presence of the vlan.dat. Is the config supposed to look any diffrent when issued as vlan-config?
TIA

check out the following link on configuring vlans :
http://www.cisco.com/en/US/products/hw/switches/ps708/products_configuration_guide_chapter09186a008007e711.html#wp1020848

New VLAN config on Cisco router

We are in the process of rolling out VOIP with new Cisco router
configurations. When the VLAN config is changed on the router it can no
longer ping the server. The router config is setup with secondary IP info
so that we don't have to go thru the process of changing IP config on the
NW 6.5 SP 6 servers.
Has anyone seen this issue? Do I need to bind new VLAN ti IP NICs? Any
other thoughts?
Thanks for any help received,
Todd W Carter

On 6/5/2007 Todd W Carter wrote:
> We are in the process of rolling out VOIP with new Cisco router
> configurations. When the VLAN config is changed on the router it can no
> longer ping the server. The router config is setup with secondary IP info so
> that we don't have to go thru the process of changing IP config on the NW 6.5
> SP 6 servers.
>
> Has anyone seen this issue? Do I need to bind new VLAN ti IP NICs? Any other
> thoughts?
When pinging from the router, the packets will be source from its primary
ip address. If the server's subnet is part of the secondary IP address on the
router, you must use an extended ping in the router for it to work.
However, I recommend implementing router-in-a-stick instead of secondary IP
addressing when creating multiple VLANs.
On the router, you can create sub-interfaces under the LAN interface and deploy
dot1q trunking. At the switch-port, configure dot1q trunking as well and the
router
will route between VLANs while providing a better design.
This is outside of the scope of this forum so I recommend posting in the Cisco
forums at http://forum.cisco.com/eforum/servlet/NetProf?page=main
Thanks !
Edison Ortiz
(Routing & Switching, CCIE # 17943)

LMS 4: VLAN config fetch failing for all devices

LMS 4.0.1, standalone on W2K8 R2, new install
Vlan config fetch is failing for all devices. If I attempt to put a vlan.dat file in tftpboot and then manually copy a vlan.dat file from a device, the following is returned:
TFTP: error code 2 received - 16739
%Error opening tftp://server_name/vlan.dat (Permission denied)
The Windows application logs ont the server log this:
Log Name:      Application
Source:        CRMtftp
Date:          6/15/2011 2:07:49 PM
Event ID:      3
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      server_name
Description:
GetEffectiveRightsFromAcl failed: Overlapped I/O operation is in progress.
(997)
I tried restarting crmtftp, but no luck. Any ideas what may be causing this?
-Jeff

I have the same issue with a freshly installed 4.2 version now:
Log Name:      Application
Source:        CRMtftp
Date:          2/24/2012 12:30:50 PM
Event ID:      3
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      srvwienlms.nts.local
Description:
GetNamedSecurityInfo failed failed: The operation completed successfully.
(0)
I will also open a TAC case, lets see if we still have to stick with a3.x TFTP binary...
br.herwig

Ask the Expert: Hierarchical Network Design, Includes Core, Distribution, and Access

Welcome to the Cisco® Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about hierarchical network design.
Recommending a network topology is required for meeting a customer's corporate network design needs in their business and technical goals and often consists of many interrelated components. The hierarchical design made this easier like "divide and conquer" the job and develop the design in layers.
Network design experts have developed the hierarchical network design model to help to develop a topology in discrete layers. Each layer can be focused on specific functions, to select the right systems and features for the layer.
A typical hierarchical topology is
A core layer of high-end routers and switches that are optimized for availability and performance.
A distribution layer of routers and switches that implement policies.
An access layer that connects users via lower-end switches and wireless access points.
Ahmad Manzoor is a Senior Pre-Sales Engineer at AGCN, Pakistan. He has more than 10 years of experience in first-rate management, commercial and technical skills in the field of data communication and services lifecycle—from solution design through sales pitch, designing RFPs, architecture, and solution—all with the goal toward winning projects (creating win/win situations) of obsolete solutions. Ahmad also has vast experience in designing end-to-end data centers, from building infrastructure design to data communication and network Infrastructure design. He has worked for several large companies in Pakistan and United Arab Emirates markets; for example, National Engineer, WATEEN Telecom, Emircom, Infotech, Global Solutions, NETS International, Al-Aberah, and AGCN, also known as Getronics, Pakistan.
Remember to use the rating system to let Ahmad know if he has given you an adequate response.
Because of the volume expected during this event, Ahmad might not be able to answer every question. Remember that you can continue the conversation in the Solutions and Architectures under the sub-community Data Center & Virtualization, shortly after the event. This event lasts through August 15, 2014. Visit this forum often to view responses to your questions and the questions of other Cisco Support Community members.

Dear Leo,
We are discussing the following without any product line, discussing the concept of hierarchical design, which will help you to take decision which model is better for you Two Layer or Three Layer hierarchical model.
Two-Layer Hierarchy
In many networks, you need only two layers to fulfill all of the layer functions—core and aggregation
Only one zone exists within the core, and many zones are in the aggregation layer. Examine each of the layer functions to see where it occurs in a two-layer design:
Traffic forwarding—Ideally, all interzone traffic forwarding occurs in the core. Traffic flows from each zone within the aggregation layer up the hierarchy into the network core and then back down the hierarchy into other aggregation zones.
Aggregation—Aggregation occurs along the core/aggregation layer border, allowing only interzone traffic to pass between the aggregation and core layers. This also provides an edge for traffic engineering services to be deployed along.
Routing policy—Routing policy is deployed along the edge of the core and the aggregation layers, generally as routes are advertised from the aggregation layer into the core.
User attachment—User devices and servers are attached to zones within the aggregation layer. This separation of end devices into the aggregation permits the separation of traffic between traffic through a link and traffic to a link, or device. Typically, it is best not to mix transit and destination traffic in the same area of the network.
Controlling traffic admittance—Traffic admittance control always occurs where user and server devices are attached to the network, which is in the aggregation layer. You can also place traffic admittance controls at the aggregation points exiting from the aggregation layer into the core of the network, but this is not common.
You can see, then, how dividing the network into layers enables you to make each layer specialized and to hide information between the layers. For instance, the traffic admittance policy implemented along the edge of the aggregation layer is entirely hidden from the network core.
You also use the core/aggregation layer edge to hide information about the topology of routing zones from each other, through summarization. Each zone within the aggregation layer should have minimal routing information, possibly just how to make it to the network core through a default route, and no information about the topology of the network core. At the same time, the zones within the aggregation layer should summarize their reachability information into as few routing advertisements as possible at their edge with the core and hide their topology information from the network core.
Three-Layer Hierarchy
A three-layer hierarchy divides these same responsibilities through zones in three vertical network layers,
Traffic Forwarding—As with a two-layer hierarchy, all interzone traffic within a three- layer hierarchy should flow up the hierarchy, through the layers, and back down the hierarchy.
Aggregation—A three-layer hierarchy has two aggregation points:
At the edge of the access layer going into the distribution layer
At the edge of the distribution layer going into the core
At the edge of the access layer, you aggregate traffic in two places: within each access zone and flowing into the distribution layer. In the same way, you aggregate interzone traffic at the distribution layer and traffic leaving the distribution layer toward the network core. The distribution layer and core are ideal places to deploy traffic engineering within a network.
Routing policy—The routing policy is deployed within the distribution layer in a three- layer design and along the distribution/core edge. You can also deploy routing policies along the access/distribution edge, particularly route and topology summarization, to hide information from other zones that are attached to the same distribution layer zone.
User attachment—User devices and servers are attached to zones within the access layer. This separation of end devices into the access layer permits the separation of traffic between traffic through a link and traffic to a link, or device. Typically, you do not want to mix transit and destination traffic in the same area of the network.
Controlling traffic admittance—Traffic admittance control always occurs where user and server devices are attached to the network, which is in the access layer. You can also place traffic admittance controls at the aggregation points along the aggregation/core edge.
As you can see, the concepts that are applied to two- and three-layer designs are similar, but you have more application points in a three-layer design.
Now the confusion takes place in our minds where do we use Two Layer and where the Three layer hierarchical model.
Now we are discussing that How Many Layers to Use in Network Design?
Which network design is better: two layers or three layers? As with almost all things in network design, it all depends. Examine some of the following factors involved in deciding whether to build a two- or three-layer network:
Network geography—Networks that cover a smaller geographic space, such as a single campus or a small number of interconnected campuses, tend to work well as two-layer designs. Networks spanning large geographic areas, such as a country, continent, or even the entire globe, often work better as three layer designs.
Network topology depth—Networks with a compressed, or flattened, topology tend to work better as two-layer hierarchies. For instance, service provider networks cover large geographic areas, but reducing number of hops through the network is critical in providing the services they sell; therefore, they are often built on a two-layer design. Networks with substantial depth in their topologies, however, tend to work better as three-layer designs.
Network topology design—Highly meshed networks, with many requirements for interzone traffic flows, tend to work better as two-layer designs. Simplifying the hierarchy to two levels tends to focus the design elements into meshier zones. Networks that focus traffic flows on well-placed distributed resources, or centralized resources, such as a network with a large number of remote sites connecting to a number of centralized Data Centers, tend to work better as three-layer designs.
Policy implementation—If policies of a network tend to focus on traffic engineering, two-layer designs tend to work better. Networks that attempt to limit access to resources attached to the network and other types of policies tend to work better as three-layer designs.
Again, however, these are simple rules of thumb. No definitive way exists to decide whether a network should have two or three layers. Likewise, you cannot point to a single factor and say, “Because of this, the network we are working on should have three layers instead of two.”
I hope that this helps you to understand the purposes of Two Layer & Three layer Hierarchical Model.
Best regards,
Ahmad Manzoor

Vlan config issues

I have a 6509 with a vlan 105 configure. I have also added a vlan 100. vlan 100 and 105 work for internal routing. vlan 105 workstation can get to the internet. however any vlan 100 workstation can not access the internet. A tracert from a workstation on vlan 100 stops at the 6509. attached is the 6509 config, i have included IP just because they already have changed.
any ideas? Does the port connecting to my firewall have to allow all vlan traffic? if so how do i do this.
thanks,

Hi,
Please provide more information on setup( other devices, connectivity diagram) to have a clear idea, so that we can help you.
From the config provided, i could see the following default route
ip route 0.0.0.0 0.0.0.0 10.175.105.3
What is 10.175.105.3 ? Is this your firewall / WAN router??
Also what is the need for this static route.?
ip route 10.175.100.0 255.255.255.0 10.175.105.3
10.175.100.0/24 is the subnet for vlan 100, which a directly connected network on this switch. Hence you dont need that route. Remove that route.
Finally whatever device is 10.175.105.3, please add a route in that device for vlan 100 so that traffic can reach vlan 100.
The route that you should add in 10.175.105.3 is
ip route 10.175.100.0 255.255.255.0 10.175.105.1.
Hope this helps.
-VJ

Collapsed Core / Distribution VLAN Config

Similar Messages

Maybe you are looking for