Config of redundant network

[Vincent Fortier_6]

Hi all,

I have a new project to put the network in redundancy.

What we have decided to use is:

2x HP 5300xl switchs on floor A
2x HP 5300xl switchs on floor B

I have a fiber between switch A1 and B1 and also between A2 and B2.

I have a ethernet (gigabit) between A1 and A2 and between B1 and B2.

What I was thinking is use XRRP between A1 and A2 to have router redundancy (the internet firewalls are on the A floor) and use also XRRP between B1 and B2 to have router redundancy for the workstations on floor B.

Should I activate RSTP to block the path that is not used?

Am I missing anything on my design?

[Kell van Daal]

An assumption, please correct me if I'm wrong, but this is how I read it.

Floor A and floor B both have different subnets, and no subnet is available on both floors? So in other words, you do not have any VLAN that spans floor A and floor B?

If this the case you do not need RSTP to block paths, because you won't create a layer 2 loop.
For your redudancy between the switches, you can use OSPF, RIP or even static routes.

PS. You can still use RSTP to avoid creating loops, but it isn't a nessecity in your situation.

[Vincent Fortier_6]

I have 1 subnet that might be on both floors but I can change that design so that it does not happen.

I also created VLANs (1 to 14) on all the switches so that I don't mistakenly assign the same vlan number to different uses.

You seem to specify to use OSPF. Will that provide me router redundancy?

Example: Switch B1 and B2 will be redundant in a way that 10.10.1.1 will be answered by the 2 switches to direct the traffic and if either switch fails, the flow will continue on the other switch.

[Vincent Fortier_6]

One more thing to add:

One vlan is shared by all switches: the default vlan.

So all my switches can talk to each other on it (ip range is 10.10.1.0-255)

[Kell van Daal]

OSPF in itself will not provide you router (gateway) redundancy for your end nodes, that part will do XRRP for you.
OSPF is a routing protocol, and will provide you with redudancy in regard to for example link failures. It will do in layer 3 what RSTP does for you in layer 2 (not completely accurate, but I guess this clarifies it enough without going in detail).

If it easy for you to change the design that no subnets will be shared by both floors (including the default VLAN), and if you are comfortable with implementing OSPF (Your design is easy, so the implementation would be easy also), then using XRRP and OSPF would be the easiest way to get "complete" redudancy while allowing all links between the switches to be used.

The only other way to get all links to be active at the same time, would be to implement MSTP (Multiple Instance Spanning Tree), and imo that implementation would be more difficult in your setup.

I've let my paint skills run loose and made a little drawing to clear it up how I would implement it. (I still assume some things, so it could be that my suggestion wouldn't completely fit your setup)

Little explanation for the drawing:
The links between A1 and B1 would be in a seperate VLAN, with only the ports that connect the switches in that VLAN.
Same for A2 and B2.
OSPF would be running (likely your firewalls are also capable of OSPF, so they can be incorporated in the OSPF area).
VLAN's on each floor have to be reachable from both switches on that VLAN (if every VLAN is only needed on one switch, what good would XRRP do?).
So to balance the traffic a bit across the floor A<->B links, for some VLAN's the 1 switch on that floor would be default gateway, for the remaining VLAN's switch 2 on that floor would be default gateway.
XRRP would run between two switches on each floor, for all VLAN's on that floor.

[Vincent Fortier_6]

Wow... great answer.

I did a little drawing of what I understood.

So do I just need 1 OSPF area?

And the switch inter-link between the floors will be on different vlans?

I have servers that will be connected to both switches on the same floor using the software from HP, this design should go as far as I see.

I'll try that setup tomorrow night and see what it gives, I just need to verify that my firewalls understand ospf also (they are netscreen 50 and will be install in a Active/Passive mode...)

[Kell van Daal]

Indeed, you only need one OSPF area.

Also regarding the inter switch links between the floor you are right. Link A1-B1 is in a different VLAN as A2-B2.

Couple of notes though.
In a previous post you said you created 14 VLAN's. That means you will be using 14 IP subnets also (or VLAN's that don't need to be routed)?
In that case you can configure XRRP to provide router redundancy for each of those subnets. Since the switches configured with XRRP can backup eachother, you can alternate the default gateway switch for each VLAN/subnet. That way you will load balance the traffic on the switch links A1-B1 and A2-B2.

Also to verify. The ip-adresses you used in your drawing seem to be in the same subnet (not nessecarily, but then the subnets wouldn't allow for many end node ip's, 6 on each floor to be exact). If they really are/need to be in the same subnet, then OSPF won't help you (even more, the setup won't work at all :P). So can you confirm if those ip adresses are
1) a typo
2) part of small subnets and indeed planned that way
3) needed to be in the same subnet, and thus in the same broadcast domain, and thus in the same VLAN

ps. Your paint skills are better than mine :(

[Vincent Fortier_6]

For the IP part, each VLAN has a range of 255.255.255.0 (which gives me 14 ranges of 255 adresses, which should be enough...)

I have vlans spanning 2 switches (on the same floor)

The main IP of the switches are all in the same vlan/same ip range.

BTW, I used visio and just copied/pasted the results :)

Thanks a lot for your help.

[Kell van Daal]

Okay, roger that.

What is the purpose of the "main" ip's for each switch? Because in the current setup, they won't be able to communicate with eachother. A1 can with A2 and B1 can with B2. But not eg A1 -> B1.
If the only purpose is management, consider using ip-adresses that you will place on the VLAN's anyway.
The problem with all 4 switches having ip addresses in the same subnet is the fact that they will need to be in the same broadcast domain/VLAN. Meaning a VLAN would span both floors. You could still do without RSTP in this case, if you would connect the VLAN through only one of the interfloor links, but that's not a pretty solution. It would lead to strange results if a link breaks for example.

[Vincent Fortier_6]

Great, I will change a bit my design and remove the default vlan from it.

I think I'm all set for it thanks to you!

Vincent