RRPP and VRRP - Layer 3

[Arthis]

Hi,

I'm working on a migration (change) from Cisco to HP switches.
(see attachment

Q1 : Can VRRP (and VRRP isolation) work with a ring RRPP ?

Q2:  I was told that on the RRPP (Layer 2), we can have a Layer 3 (OSPF routing protocol) running.
So on each site, we'll have static routes towards the IP address of the firewall  and static route redistribution into OSPF.

How is it possible, given RRPP is a Layer 2 protocol and 802.1q must be configured on the interfaces ?

Q3: In such a topology, what's the best place to configure the Master Node ?  Data Center or small site (HP 5500, top of the diagram ) ?

thanks

Herve

[manuel.bitzi]

First: I think this is a bad design and RRP is the wrong choice. Why not using IRF over the two DC? Or VLAN 10, 20 over the DC and new VLAN30 for the remotesite and disabling STP?

But back to your questions:

A1: yes: RRPP (layer 2) and VRRP (layer 3) are independent. If VRRP is configured on the vlan interface

A2: Dont really unterstand your question, but should be same as A1

A3: DC with most traffic to it.

[Arthis]

Thanks a lot Manuel,

Using IRF over the two DC makes a beautiful network topology but, to my mind, is not the best solution because the ten broadcast domains (vlan 10 to 20) are not limited to each DC.
Many broadcasts will use the MAN for nothing.

For question 2, I will use a protected routing vlan on the RRPP ring by configuring IS-IS or OSPF on an Interface VLAN.

[Alan-WJ]

Using VRRP is really just overkill the RRPP ring should recover on a failure if you have dual rings.  You need to decide whcih switch will be master and which will be transit. Really it does not matter as the RRPP will be on it's on vlan in terms of control frames. OSPF STP all of those protocols run on top of the ring itself. So it should work just fine. You can import the static routes etc into the OSPF tables, in terms of dot1.x you don't apply that on the RRPP ports anyway

[Peter_Debruyne]

Hi,

I would first consider you to describe your traffic flows:

* is the primary dc the only active dc or do you expect online hosts in the secondary dc ?

* do you realize and accept that there will be sub-optimal traffic paths from the remote site to the server side (e.g. primary path is active to primary dc, in case a server is running in secondary dc, traffic will pass primary dc first, then to secondary dc). For me this would not be an major issue, just a matter of realizing this is happening.

The best design would be an active-active L2 topology (trill/spb), but that is too early to discuss with current hw/sw.

Given the fact you have 2 dcs and 1 remote site, I would propose a simple alternate design.

* make a link-agg bridge-aggregation group between dc1-dc2, which will always be active. Allow the vlans to pass the bagg, so you still have transparant vlans between 2 dcs.

* from the remote site, use smart-link to make link to dc1 active, with link to dc2 as standby

 this eliminates any kind of "protocol" on the backbone (no protocol at all on 10500, just the 5500 detecting a link-down, then putting the other interface in forwarding)

* configure ethernet oam on the wan links, to enhance the link-down detection time

* L3 redundancy between IRF units is still based on VRRP, so configuring VRRP on each of the dc1/dc2 sides and blocking the vrrp hellos is a simple alternative to active/active gw functions.

Best regards,Peter