HP 5920: block a VLAN from traversing IRF link

[Biite]

Hi there,

I'm configuring a HP 3PAR with iSCSI connected to 2 HP 5920 switches connected with an IRF link.

Is it possible to block a VLAN (in this case the iSCSI VLAN) from traversing the IRF link?

Regards,

Martien

[paulgear]

Hi Martien,

Why do you want to do this?  An important benefit of IRF is that dual-connected hosts can use an LACP connection that is split across switches and it appears as if they were connected to a single switch (sometimes called MLAG - multi-switch link aggregation).  So you would be eliminating this benefit by blocking a VLAN from crossing the IRF.  (I don't actually think it's possible to do that, anyway.)

[Anonymous · Accepted solution]

Hello,

the idea of using IRF is that multiple switches become one logical device. However if you don't want that VLAN traffic crosses the IRF link the solution is simple: Just put ports on one switch in that VLAN and the traffic will never pass the IRF link.

Cheers,

      Thomas

[Biite]

Hi,

I understand the thought behind IRF, but I'm not a 'switch guy' :). I'm just wondering, as I am using ISCSI, which does not support LACP. My NIC's and my storage connections are divided over the two switches for availability. If the load becomes higher on the ISCSI vlan, it might saturate the single 10Gb link, as the storage has 4 10Gb links and my servers have 2 NICs. ISCSI on VMware sees ALL 8 ISCSI paths ans WILL use them, so 50% of the traffic will cross this IRF link.

This is the background of my question, any thoughts?

Regards,
Martien

[paulgear]

Hi  Martien,

iSCSI is an application that works above layer 4; LACP works at layer 2.  So iSCSI won't really know anything about LACP.  It's just a matter of whether your storage array supports it.

If you don't want iSCSI traffic traversing the IRF links, the solution sugested by Thomas is the best one: set up your storage array so that it offers one iSCSI path over one VLAN, and another path over the other VLAN, then set up those VLANs so that they are only contained within a single member of the IRF stack.

Most of the time, people want their iSCSI to be able to saturate their 10 GbE links.  So the generic way around this is to have separate NICs for frontend and storage traffic.

[Biite]

Thanks guys for the help to clear up this 'issue'.

I'll setup using Thomas'  suggestion, that the easiest way and actually the only way it is supported.

Martien

[Apachez-]

Regarding the original question the point of using IRF is that the devices will behave as a single physical unit (and by that you can for example use etherchannel where you connect one cable to one box and the other cable to the other box - something that usually isnt available when you do regular stacking).

In order to block a certain VLAN from "traversing" your IRF link you can simply block that vlan in the physical interface which the VLAN will arrive at by using the "permit vlan" command.

For example:

trunk permit vlan 100, 200-299

If a tagged (802.1Q) packet with vlan lets say 300 would arrive that would just be dropped by the interface the packet arrived at (and by that not "traversing" your IRF).