MSTP on Access Layer Switches

Hello everyone,
When configuring MST for STP, is there a need to configure it on access layer switches in a collapsed core design? I can find docs to configure the root and secondary root bridges but I don't see anything about configuring access layer switches. In RSTP, you configure it on all switches cooperating in STP and set the root and secondary bridges accordingly. Any help is appreciated.
Regards,
Terence

Hi,
You should configure your access switches for MST as well so you are using the same STP for core and access. The only difference between the core and access is that the core is root and back up root for STP and the access layer is just default (32768).
HTH

Similar Messages

Packets dropped to Access layer switch???

We have a 6509 running in Native IOS that has 2gb port channels connecting to our 7 access layer switches. About a week ago we were working with Remote span vlans and added a remote span from the 6509 to our other core (6513) which is connected via a 20Gbps portchannel. We began to notice that a lot of people were calling in reporting devices as being slow and we noticed that from the 6509 (Which was the root bridge) we were disgarding millions of packets on the transmit side of our access layer switches. We took out the remote span but it appears that we are still disgarding packets. There are no input or output errors on either side. The Remote span VLAN does not exist on the access layer switch's VLAN database. Does anybody have any idea what we should be looking for?

you can use an acl to match the number of packets that come into / out of each of the devices. Simply use two lines in each acl where on the first line you match the packet in question and on the second line you have "permit ip any any" so you don't block any packets. Then simply apply the acl either inbound or outbound on the interface in question. If you want more than one acl on a given device, such as inbound one interfaceand outbound another, be sure to use two different acl numbers.
create the acl's and apply them
ensure there isn't an active call
clear access-list counters on all devices where you configured the acl's so we ensure all of them are set to 0

Bandwidth from Access Layer to Distribution Layer

Folks:
I am currently on Chapter 12 of “CCNP Switching 642-813, Official Certification Guide” ISBN: 978-1-58720-243-8. I am currently not grasping the three layers entirely, and I was hoping someone could offer insight in a different way.
I believe I understand, that switches in the Access-Layer can be layer2 devices (2950, etc), and devices in the Distribution Layer should be Multilayer devices such as Layer-3 switches (3750) and inter-vlan routing takes place at the Distribution layer. But what I do not understand – how does one account for bandwidth and traffic from the Access Layer switches to the Distribution Switches?
Let use a 24 port 2950 switch located at the Access-Layer. If everyone was online and communicating, the total traffic for the switch would be 4.8 Gbps. The latter is due to each port providing 100 Mbps but in Full-Duplex, so (100*2)*24. So, how does an engineer spec out the required uplink ports from the Access Layer to the Distribution?
I am sure this is easy; however, I am not getting the concepts. Any insight is great.

Disclaimer
The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.
Liability Disclaimer
In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.
Posting
As noted by Peter, edge hosts don't generally all concurrently push/pull their full port bandwidth for substained periods. However, host bandwidth usage often varies much by "kind" of host. For example, many server hosts are "busier" than most user hosts, so when designing networks you normally design for lower oversubscription ratios for server hosts than for user hosts. Old rule-of-thumbs ratios suggest oversubscription ratios of about 8:1 to 4:1 for servers, and about 48:1 to 24:1 for users.
Keep in mind that oversubscription ratios can be "skewed" by what the host is doing, i.e. not all server or user hosts have similar bandwidth demands. For example, your primary mail server or primary file server might be much "busier" than other server hosts. Likewise, some user hosts might be much "busier", for example, years ago I supported a LAN segment of CADD (20) workstations which had more traffic on their local LAN than the (2,000 user) corporate backbone.

Creating Vlans at Core layer switches ?

Is there a need to create vlans at core layer switches ? If yes what are the pros and cons for this practice ?
Actually i have seen some networks doing that!

Well this is the topology that i'm working on.
we have implemented the 3 layer approach.
1. At access layer: Switches are all L2 (for sure :) )
2. At distribution layer: All switches are L3 are routes for incoming data.
3. At core we have 2 6500 switches. One is configured as L3 and all vlans are created in it. Second is just as regular L2 device.
and ofcourse there are some switch blocks for server farms and the likes.
My issue is
1. why don't we create vlans at distribution layer switches.
2. Why one core switch is acting as L2 and other is acting as L3. What will happen in case of failure to the one acting as L3.
Ps: the second issue just came up in my mind.

Core layer switches IP address for routing

For routing process I add a IP address of each Vlans subnet that active on each Access and Distribution switches (Have a port with that Vlan on the switch) to the corresponding Vlan Interface of them.
Which IP address should I add to the Core switch for routing?
Should I add a IP of each vlan that in the LAN to each vlan interface of Core layer switch?
I want run OSPF routing protocol on the LAN.

Hello Reza,
>> Which IP address should I add to the Core switch for routing?
if you want to implement a L3 routed core every link betweeen core device and a distribution device is a L3 link with its own IP subnet.
For example if you have 16 distribution pairs and two core switches:
10.10.10.0/30 dis11 to core1
10.10.10.4/30 di12 to core2
10.10.10.8/30 dis21 to core1
10.10.10.12/30 di22 to core2
10.10.10.128/30 disF1 to core1
10.10.10.132/30 disF2 to core2
this under the idea to have not a full mesh between core routers and distribution devices
then you need also a L3 link between the two cores (at least one)
Each L3 device should also have a loopback interface to be used as OSPF router-id and for management purposes (telnet and so on)
you can use /32 loopbacks taken from same block for example
10.255.254.1/32 core1
10.255.254.2/32 core2
10.255.254.3/32 dis11
10.255.254.4/32 dis12
to make the routing function the core switches have to talk OSPF on all links to distribution nodes
router ospf 10
router-id 10.255.254.1
network 10.10.10.0 0.0.0.255 area 0
network 10.255.254.1 0.0.0.0 area 0
network area commands work like ACL statements and first statement starts OSPF on each interface whose ip address belongs to 10.10.10/24 space
Second command is used to advertise its own loopback.
router-id command allows to define the OSPF router-id.
Distribution nodes have to advertise client Vlans and to take part in OSPF communication on point to point link.
if you use a L2 access layer design client vlans are served by distribution nodes.
if you use a L3 access layer design the access layer switches take part in OSPF and have to advertise their own client vlans.
Hope to help
Giuseppe

Why access switch has flapping lead another distribution layer switch has root guard blocking and unblocking log

is it misconfiguration in Access Point's access switch or hacker attack from this switch?
many MATM-4-MACFLAP_NOTIF Host 0015.5dc1XXX VLAN 1 is flapping between port 1 and port 2
many MATM-4-MACFLAP_NOTIF Host 0015.5dc2XXX VLAN 1 is flapping between port 1 and port 2
many MATM-4-MACFLAP_NOTIF Host 0015.5dc3XXX VLAN 50 is flapping between port 1 and port 2
many MATM-4-MACFLAP_NOTIF Host 0015.5dc4XXX VLAN 50 is flapping between port 1 and port 2
last time we do not have these switch also meet the same issue about distribution layer switch have many ports down
last time someone mention a switch lost config, but today, i remember that the switch has reloaded and can be login again with radius,
today i do not connect any notebook with this switch and just have configured radius setting for window NPS radius server and then reload, then
i have dinner and come back and after a while, last time's issue happen again.
it seems port channel easy to have problem when abnormal traffic coming from access switch result in down port in distribution layer switch
i wonder whether someone can hack through the switchport access mode port and send some broadcast message

From that output and your description it looks like you have an STP issue as a result of misconfiguration somewhere.
Are your access points connected to switches with ports in access mode or trunk mode?

Is it recommended to use HSRP or multiple default between Core Layer Switch and Customer Edge Router?

My client is asking me for following
Client is using Router as edge device. 2 WAN links from different service provider ( each 20 Mbps) are getting terminated on the router. There are internal servers present in the network. Client want to make setup such that even if one wan link fails internet users should be able to access web server. Moreover if the edge router fails there should be secondary edge device so that there is device redundancy ?
As per my understanding, in this scenario we need to do static one - to - one natting(belonging to WAN interface subnet). If we use two routers as Customer edge ans if we connect core layer switch to these two router, is it recommended to use HSRP/VRRP/GLBP or two default route on core switch pointing to two routers with equal ad value. we will also track the wan link with help of ip sla.
which is recommended solution Router redundancy protocol or Default routes.?

Just had another read of this post and some other points have come up.
1) I assumed your secondary link was for redundancy but you talk about terminating both SP links on the same router in your first paragraph.
Did you mean this or are you going to be terminating a link per router ?
2) are you using the second router purely for backup ?
3) something you didn't ask about but is relevant is the IP addressing. Are you using provider independent addressing or does each SP provide you with an address block.
If it is the second then you are going to have an issue with the web server. The problem is which provider's IP do you use for the web server ie.
if you use the primary provider IP then that will be the DNS record on the internet. If the primary router fails then the IP address will change on the secondary router but DNS will still be handing out the primary IP.
If you enter both IPs (primary and secondary) into DNS then you would get load balancing but this means both links will be used and the secondary would not just be backup.
In addition if one of the links fails then DNS does not know this so it will still be handing out the failed address as well as the address that is still up which means some connections will work and some won't.
Jon

Layer 3 to the Access Layer and MPLS Design Considerations

Hi,
We are about to install a new network consisting of Cat 4500s with Sup7E at the Access Layer, with Nexus 7000 at the Distribution and Core layers.
We have 14 floors with at least three 4500s on each floor. Within the office block where the Access Layer and Distribution Layer reside we need to support secure borderless networking using 802.1x to place users from different parts of the business into segregated networks at layer 3.
All switches will have the feature sets to support MPLS/ VRF / OSPF / EIGRP / BGP etc.
We quickly dismissed the idea of using VRF-Lite due to the sheer number of Vlans we would need to managage and maintain, the point to point links alone just to get one additional VRF on each floor required far too many Vlans.
As a result we are now considering deploying MPLS. The obvious benefits include scalability and manageability, the fact that all switch to switch links can now be routed, instead of having to using SVIs.
My query is one of design surrounding MPLS and how this maps to an enterprise network with a routed access layer. Do Cat 4500s become the CEs and take part in MPLS / BGP and Label Distribution, or does the BGP peering and Label Distribution only occur between the Distrubtion - Core - Distrubtion layers, mapping to the PE - P - PE topology in an ISP environment, the access layer simply uses the IGP (OSPF in this case) to learn routes ?
Any help would be greatly appreciated.
Chris.

Hi Andy,
Thanks for your response.
I have been doing a little bit more research it seems the Cat 4500s do not support MPLS!! Nor do Cisco have any plans to support it on this platform. I find this a little rediculous considering the level that Cisco are pitching this platform. With the Sup 7E only VRF Lite is supported, with plans to support EVN (which still uses trunk links for logical separation).
So it looks like we are going to have to go back to the drawing board.
(perhaps we should have gone HP or Juniper!)
Chris.

Calculating oversubscription on access layer

So, the situation is that we have about 240 users (max, no further expansion to this figure) on each floor of a building, spanning across 10 floors. As I understood from the basic calculation, for every 240 users @ 100/1000, I need to deploy 5(48 port stacked switches within each IDF on each floor) (5x48) will share 2x1GigE uplinks(etherchannel) terminated into two different cores with a redundant 2x1G uplink (passive).
Someone tells me that this will result in an oversubscription ratio of 120:1 in the best case scenario when we fully utilize both uplinks in an active/active setup. Is this ratio unacceptable at access layer?
Should I consider dual 10GigE uplinks from the access layer to core, to start with, irrespective?
I currently am working with 1G uplinks and don't see any major hassles. My applications though utilise 3D and CAD drawings but I still feel that 2-4Gig uplink would be more than sufficient for me as I can link aggregate further upto 8Gigs using Cisco Cat 3750E.
Should we go for 10Gig uplink straightway?
Your thoughts!!

You really need to look at your traffic endpoints to determine what the possible bottlenecks are. If most of your users are only going to a couple of servers, then it's likely the bottleneck will be the server links, not you access uplinks.
With that in mind, a 10 gig link works better than channeled gig links. First, you don't have the problem of multiple flows using the same saturated gig link of a bundle while others are not being used. Second, you don't need to concern yourself that the correct channel hash method is being used.
Although 10 gig ports are more expensive than gig ports, if you factor in the possible need for additional cable runs and the cost of multiple gig modules, 10 gig might becomes less expensive sooner then you might expect.
You note you don't have any problems with gig uplinks today. Assuming your moving users from 10/100 to 10/100/1000 and they will be using 1000, unlikely performance will be any worse, but possible it won't improve much either.
PS:
Deja-vu - reminds me of moving from 10 to 100 Mbps for users and 100 to gig for uplinks

6500 or 4500 for the access layer

I would like to get some input as to the best switch to use at the access layer. I am considering both the 6500 with a Supervisor 32 and the 4500 with a Supervisor 5. I am using the Sup 720 in the data center so staying with a single platform is appealing although the 4500 clearly appears to out perform the Sup 32.
Does anyone have experience with the Supervisor 32? Any feedback would be much appreciated.

Go with the 6500 with the Sup32. Cisco has a bundle with a chassis, Sup32, and a Fan for the reduced price.
Few reasons the Sup32 is a better choice.. (engage your Local Cisco account team for a overview to compare architectures)
Same Layer2 engine as the Sup720. This means you will receive the same Layer2 performance as the Sup720 would using classic line cards
Modular IOS and the Same IOS as your core. This allows you to only have to test and maintain one code for the network
Can upgrade to a Sup720 later if your needs change. (or the next version line cards as well without replacing chassis)
higher density POE support in the 6500 chassis.
Many more features are supported in Hardware on the Sup32 due to the PFC3B.
Control Plane Policing. Hardware policiers
Service module support
Dont let PPS fool you on the spec sheets. Look at the architecture as a whole. The Sup V on the 4500 is a shared memory architecture and has a limited "punt path". The Sup32 has a 1Gbs punt path and the SupV is under 250k pps. The Sup V also does not have a dedicated L2 engine like the Sup32 does (PFC3B vs asic)
Your profile also lists you as with a financial firm. With multicast in the equation, the 6500 is always the best bet. The Multicast features/policers support in hardware to insure reliability and low latency switching is a perfect fit for the Sup32/Sup720.
With the Sup32 you can have the same reliability you have in the core. Also, the 6500 bundle cost comes to roughly the same cost as the 4500.

Core (4500x vss) with Access HP switch spanning tree

Hello Friends,
i need your support to guide me for this type of topology network in-order to avoid loops...
like
2 4500X series switch configure as a VSS working as core switch
in access layer i have HP switches which are connected with 1G fiber uplinks to each other (cascaded) and back to these Core switch for Vlan forwarding.
i need help to configure spanning tree for such topology and avoid loops.
Topology is in attached..

Hi,
you mean to say, connect each HP switch back to core (VSS) with 2 uplinks and configure as a ether-channel?
Yes, exactly.
actually that is not possible because the lack of fiber cable between the cabinets (core to access) are not much cores.
How could it not be possible? According to your drawing in your current design ASW-HP1 and ASW-HP3 both connect to the core VSS, core anyway. So it is just a matter of connecting ASW-HP2 to the core.
Of course you want 2 uplinks from each HP.
HTH

6500 access layer QoS

I have 6506E Sup32 PFC3B 12.2(18)SXE device at the access layer of the network and would like to implement QoS (for access ports) for Voice, Video.
I suppose that untrusted microflow policing is best for me. But documents say that such kind functionality works for L3 MSFC routed traffic. For PFC3b I can use "mls qos bridged" for bridged traffic on specified vlans. Does it really work for input service policy on access ports for traffic from user ports (if I use this command on user's int VLAN)?
Distribution and core layers of my networks are MPLS based.
Config:
interface FastEthernet2/1
switchport
switchport access vlan 10
switchport mode access
switchport voice vlan 30
no ip address
spanning-tree portfast
service-policy input IPPHONE+VIDEO
interface Vlan30 ! also for Vlan 30
ip vrf forwarding VOICE
ip address 10.168.8.254 255.255.255.0
ip helper-address 10.168.2.33
ip helper-address 10.168.2.34
ip pim sparse-dense-mode
mls qos bridged
policy-map IPPHONE+VIDEO
class VOICE
police flow mask src-only 320000 8000 conform-action set-dscp-transmit ef exceed-action drop
class VIDEO-INTERACTIVE
police flow mask src-only 2400000 8000 conform-action set-dscp-transmit af41 exceed-action drop
class CALL-SIGNALING
police flow mask src-only 32000 8000 conform-action set-dscp-transmit cs3 exceed-action policed-dscp-transmit
class class-default
police flow mask src-only 5000000 8000 conform-action transmit exceed-action policed-dscp-transmit

This URL should help you:
http://www.cisco.com/en/US/products/hw/switches/ps700/products_tech_note09186a00801c8c4b.shtml

Access Layer Routing

Hello everyone,
We're running on a collapsed core network design and I'm looking to move routing down to the access layer. I've attached a sample diagram of a small portion of the overall network to give you an idea of how things are connected. Currently, all routing, ACLs, multicast, etc. is being handled in the core. I would like to move as much of this down to the access layer as possible. The problem I'm faced with is our phone system (non-Cisco). We have two PBXs that are not running in an HA configuration and are in their own VLANs with routing between them. We have phones that are registered to both PBXs that are physically located throughout our campus. I'm afraid that if I move routing down to the access layer, I'm gonna lose communications between the phones and the VoIP system since traditional routing won't allow me to have the same subnet in two different locations for the same infrastructure. The only thing I can think of is possibly establishing EIGRP neighbors for the phone network and then NAT'ing the phones behind their gateway. Can someone shed some light on some real-world workable solutions?
Thanks!
TLock

I have just typed out probably the longest answer I have ever done and this stupid website just errored on me and I lost it :-)
So basically you make the uplinks trunks and for each access switch you need two new vlans unique to that switch ie. you cannot reuse these vlans on other access switches.
You then emulate point to point links using SVIs to peer on instead of L3 routed links.
On the trunk link you only allow the new vlans + the VOIP vlan eg. access switch connects to core1 and core2. New vlans are 3 & 4.
Create new vlans on access switch and vlan 3 on core 1, vlan 4 on core 2 plus the corresponding SVIs. You only need two useable IPs per vlan. So -
uplink to core 1 -> allowed vlans = vlan 3 + VOIP vlan
uplink to core2 -> allowed vlans = vlan 4 + VOIP vlan
Then you peer with a dynamic routing protocol between access switch and the core switches using the SVI IPs.
All vlans (except the VOIP vlan) are routed locally and for remote subnets they use the new vlans as transit.
Key thing is to only allow the vlans that need to be allowed on the trunk links and basically you have emulated using point to point links but using SVIs.
The main downside is you need two new vlans per access switch. This means a lot of new vlans on the core where you may hit STP issues if you are running a variant of PVST. Note I'm assuming all core switches will be L3 interconnected so STP isn't doing anything except for the VOIP vlan but it should still be running.
The VOIP vlan would have to be routed in the core. Which means if you want HSRP for it you need to run separate L2 links between the switches (in addition to the L3 links). The L2 links would be access ports in the VOIP vlan.
Finally, and this applies even if you had L3 routed links ie. you didn't need to span the VOIP vlan across multiple switches, you are not necessarily going to get the best use of your uplinks because you have three core switches eg.
ESW02 connects to CSW01 and CSW02
ESW05 connects to CSW02 and CSW03
that means for subnets on ESW05, ESW02 is always going to see CSW02 as the best path because it is a shorter number of hops away.
You could play with the metric to influence this but it is not ideal ie. if you only had two core switches this would not be a problem and each access switch would see equal cost paths.
But I suspect you cannot simply go down to two core switches.
Let me know what you think ie. queries, doubts, just don't like the idea :-)
Jon

Connection of LC/APC fiber patch cords to Cisco Catalyst 6500 $ Cisco Access 3750 Switches

I have an LC/APC fiber patch cord infrastructure and I want to connect it to Cisco Catalyst 6500 & Cisco Access 3750 Switches. what type of transceiver should be used?
I read a note on Cisco website stating the following for Cisco SFP+ transceivers:
Note: "Only connections with patch cords with PC or UPC connectors are supported. Patch cords with APC connectors are not supported. All cables and cable assemblies used must be compliant with the standards specified in the standards section"

Thank you, but my question is that I have a single mode fiber patch cord with LC/APC connector while cisco stating a note that only use LC/PC or LC/UPC type of connectors with SFP+ transceiver.
So what type of transceiver should I use to connect LC/APC patch cord to cisco switches? Is there another type or SFP+ still can be used?

Object services - manual implementation of database access layer

Hello,
this is my first time with object services. I read a lot but can't find the information which I really need to implement my requirements.
I have build a persistent class, clicked to "persistence", mapped my persistent attributes. I want to use a table-like attribute in my class, which contains references to another class. I added this attribute manually to the attribute list in the class builder. Consequently, GET and SET methods were generated automatically. Then I changed the generator settings by activating "manual implementation of database access layer".
So, my first notice is - If I choose manual implementation a call of create_persistent-method will not work. Nothing will be inserted into the mapped data base table.
Can anybody give me a example which shows how I can implement the database access layer manually? What do I have to do to write object attributes into data base table?
Which methods do I have to enhance?
Thanks a lot for any help in advance!
Anne

Thanks for your answer, but I would not be sure if you really got my problem.
I really really read much stuff (including SAP help, sappress "object services in ABAP" by Assig, Fobbe, Niemitz, sappress "abap objects" by keller), I googled a lot. But I couldn't find detailed information about this manual implementation of database access which you can activate in persistence settings.
This is the only extract out of SAP Help regarding this topic:
"If you prefer to carry out a manual implementation of the database access layer, select to change the generator settings and select the field of the same name. In this case you can implement your own database read routines, through which you can redefine the generated SET and GET methods for access to the database. This is particularly recommended if you want to improve performance by providing these routines with their own buffer mechanism. "
And some information about so calles Structure mapping which means the same idea in my opinion
"Structure Mapping
In this case, you map ABAP Dictionary structures, rather than database tables or database views to persistent objects. The application developer must therefore program the type of persistent data storage in the appropriate methods of the class actor.
You will need to map a structure (or structures) if you want a persistent object to contain table-like attributes. Database tables can only have flat structures, which prevents your mapping the object to a table in this case. You must still use structure mapping, even if you want to store the data in a different form u2013 such as in a file on the application server."
I used the debugger to get the idea of the SAVE method. But I couldn't find the difference between manual and automatic implementation in the code.
I tried to use implicit enhancement, but was not successful. Right now I am trying to redefine the SAVE method of the interface IF_OS_CA_SERVICE. But I can't believe that I have to implement the whole attribute-table-mapping on my own now. That can't be the idea of object service and their manual implementation. In my opinion it must be possible to use predefined algorithm to map business key etc. to corresponding table fields and to implement own ideas just for those table-like attributes..
Or am I totally wrong with this thoughts?
Thanks in advance!!
Anne

MSTP on Access Layer Switches

Similar Messages

Maybe you are looking for