Help with Configuring HP2920's, stacking, two stacks, vlans and voip etc

[markm75]

Hopefully this is the right place for this question.. we have a total of 6 hp 2920 switches.... we have an old daisey chained set of gigabit switches for the existing network, where the wiring will need moved over.

For now i started out configuring the 2 member stack on the 2 switches.. i also updated the firmware, so now they have the newer GUI that shows the gauge for cpu usage etc.

To get things going i had a cat6 cable going from the bottom switch in our old stack of switches to one of the two new switches so i could connect and configure from anywhere.

I set up each switch as stacking enabled via the command line (didnt see a gui option).

First issue i ran into.. as soon as i hit enable stacking on the bottom of the 2 new switches and it rebooted, it brought down our existing network for some reason.. exclamation marks by the networking symbol on windows 10 etc.. not sure why?  Any thoughts there?

So i removed the cat 6 going to our switches and everything came back online.. obviously now the only way to configure these is directly from a laptop in the server room.

These switches just had one cable going from stacking module to the other.. i'm going to add another cable, which it appears for 2 switch stacks lets them become a ring, rather than chained.

For the other 4 switches ill stack them via a ring.

My other questions are vlan related.. unsure where to begin on that.. the 4 member stack will be servers + workstations mostly.. they are connected via dac modules for 20gbit throughput to the other 2 member stack.. as well as a 1 gb fiber connection going across to the other one for more redundancy.. those 2 switches will be poe ip office phones and misc equipment like routers, wifi etc. (not sure if i need to do anything with the dac modules, like trunk them for the 20bit or not)

Whats the best way to configure vlans here.. its my understanding there should be multiple vlans.... i've seen it mentioned to have a management vlan (meaning which devices exactly?) would this include servers? then a few others like Voip etc.. doesnt this mean that i must make sure that i'm plugging in only those vlan related items into certain ports.. and how does this work cross stacks.. do i have to recreate all the vlans on both ends, even if say voip doesnt exist on the 4 member stack, since its on the 2...

This is my first dive into anything this complex, so any suggestions would be great, or incite.

Thanks in advance

[parnassus]

Hi!

Just as a starter...first: have you already read the HP 2920 Switch Series stacking Technical white paper?

That's to understad which method of configuring the 2920 Stack you followed (Deterministinc versus Plug-and-Go).

Pretty strange what happened (STP?) when you uplinked one member of your old daisy chain to your new (still to be formed) HP 2920 Stack's member...probably you should have created first the 2920 Stack then uplinked one of its members to your old daisy chain of Switches and not the contrary (before the Stack had formed).

Regarding the trunking between two different Stacks (2 2920 members and 4 2920 members) you could easily aggregate 2 (or more, ports permitting) 10Gbps links together on each side (distributing those two links on both members of the 2 2920 members stack on one side - this side will be "balanced" from the 2 links aggregation's standpoint - and distributing the same links on two random members of the total 4 2920 members stack on the other side, this side will be "unbalanced" from the 2 links aggregation's standpoint) via DAC Cables.

VLAN: it depends on which VLANs you are going to define in which switches...trunks (uplinks) need to permit those VLANs to pass between uplinks' peers (that's valid also between your two separate 2/4 members stacks).

[markm75]

i have it set so the commander is not the first one that is turned on.. i've set priorities for commander and standby.

I have a new issue.. i got the 4 switch stack setup.. i had individual ips set on one or two of the 4 stack switch.. now for some reason, after joining them to the stack group, i cant even connect via the usb cable com port which was working fine before.. pressing enter twice doesnt take me in, just stays blank.. not sure if its because i had previoulsy given it its own ip or not?

Do the ips on the individual switches go away once the stack is set, such that if you type setup and change the ip on a stack member, that sets the ip for the whole stack.. no way to connect to individual switches at that point?

edit: so i guess only the commander ips are the live ones after becoming part of the stacks.. problem is.. i still cant connect to either via the web address, i even tried plugging the laptop into the commander switch, setting a similar manual ip then trying.

I fixed the uplink, but i need to get the dac trunking part configured.. nothing flows from stack set to stack set as of now.. i'm not sure i follow about distributing the dac links amongs the other members of the stack? I assume you mean virtually on this.. any examples of how i link stack to stack via the dacs?

Side note.. common knowledge but, the specific part here is the J9731A module.. i have one in one switch on stack01 (2 member stack) and the other in stack02 (4 member stack).. unsure if this module needs to be in the commander switch on each end or not?

Thanks 

[markm75]

So it would appear, if i disconnect the second dac cable from each module and leave only 1 in, then i can connect to web interfaces of either commander.. if i plug in the second they become unresponsive/dont ping

[parnassus]

Do both 2920's Stacks work OK when the uplink between them is down/disconnected? just to understand that both 2920's Stacks are OK.

IMHO you can create a Port Trunking (with load sharing method: Dynamic = LACP) on Stack "A" and on Stack "B", on both sides - for the Port Trunk created - assign two SFP+ interfaces (those you want to connect each others with a pair of DAC Cables) as member of each Port Trunk. Once done this configuration, physically connect the DAC Cables pairs between the two Aruba 2920 switches (on Stack "A" and on Stack "B") where those two J9731A Modules are installed...at that point you should end up with a 2 (10GbE) members' LACP Port Trunk between Stack "A" and "B"...that means, in your case, a 20Gbps logical redundant and load balanced link between your two Stacks.

[markm75]

---

@parnassus wrote:

Do both 2920's Stacks work OK when the uplink between them is down/disconnected? just to understand that both 2920's Stacks are OK.

IMHO you can create a Port Trunking (with load sharing method: Dynamic = LACP) on Stack "A" and on Stack "B", on both sides - for the Port Trunk created - assign two SFP+ interfaces (those you want to connect each others with a pair of DAC Cables) as member of each Port Trunk. Once done this configuration, physically connect the DAC Cables pairs between the two Aruba 2920 switches (on Stack "A" and on Stack "B") where those two J9731A Modules are installed...at that point you should end up with a 2 (10GbE) members' LACP Port Trunk between Stack "A" and "B"...that means, in your case, a 20Gbps logical redundant and load balanced link between your two Stacks.

---

They work fine as long as either none or only one dac connected.. i think the second cable causes broadcast storms.. so they need to be trunked first.. 

Issue i have now, is that i thought i read that i should have spanning tree enabled.. so i tried that.. i went and enabled spanning tree on the 2 switch stack A.. immediately after the reboot i cant connect to either stack now (only 1 dac between them).... and stack A in fact wont fully boot up (i dont think).. i get solid green lights across it.. not sure what i did wrong if anything... i ended up pulling the power on stack A and will re visit in the morning and see if i can at least get the commander to boot..

Was spannning tree a bad idea for some reason?

[markm75]

I connected a cable and can see the error associated with the solid green lights.. basically says bad code in flash, could not open image file.. flash memory needs reprogramming..

All i can think of is that i removed the update file from one of the two spots (primary, secondary), thinking this would speed boot up time, and i think it needs there to be an update firmware file, otherwise it cant boot and gets stuck on green?

If so, how do i remedy this? (dont think was related to spanning tree being toggled on, though it "greended" both of the two switches in this 2 switch stack)

[markm75]

I reuploaded the .swi firmware image by using hyper terminal after much digging and the do command on the cli.. it rebooted fine.. now doing the same to the other switch and i think it will be working again.

So its back to making sure Spanning Tree is set correctly (i guess turned off for uplink ports, which i need to figure out how).. and then to do the trunking of the dac's

[markm75]

I did confirm that "STP" is blocking the uplink port which sends traffic to / from the old set of switches.

[parnassus]

I'm starting to suspect, re-reading your last four posts, that you never expressly told that you performed backplane stacking respectively on your Aruba 2920 4-members and 2-members groups? aren't you?

I mean: are you using Stacking Modules and Stacking Cables within, respectively, on all your Aruba 2920 4-members and 2-members separated groups or what (just uplinking them with DACs)?

[markm75]

---

@parnassus wrote:

I'm starting to suspect, re-reading your last four posts, that you never expressly told that you performed backplane stacking respectively on your Aruba 2920 4-members and 2-members groups? aren't you?

I mean: are you using Stacking Modules and Stacking Cables within, respectively, on all your Aruba 2920 4-members and 2-members separated groups or what (just uplinking them with DACs)?

---

Yeah, i guess i assumed when speaking about stacked, it was assumed using stacking modules.

The stacking cables connect the 4 switch group and then in the 2 switch (ring).. i have the dac module in one switch on the 4 stack switchA and then another module in stackB.. connected with two dac 10gbit cables in each (for up to 20 total bandwidth).

I now need to figure out the syntax to trunk the two on each stack.. as well as setting up STP on the other stack (assume a different priority needs set).. after all that on to figuring out vlans etc.

[markm75]

I configured the trunking in the GUI on both stacks.. there was a choice of active or passive lacp, but it wouldnt let me set stack01 to active and the other stack to passive.. threw an error.. i assume just on the type i need lacp, but not passive or active.  I also got spanning tree set and set the one stack to prioirty 1 and the other one to 0.

And on the subject of VLANS..

I have  50 : Management, 100 Servers, 150 Workstations-LAN and 200 VOIP set manually in the gui (where 50 is the ID).. I assume these are typical vlan names, but i'm on clear aside from VOIP where the advantage is to setting vlans here.

Also unclear on where tagging vs untagged should come in.. the one switch in the 2 switch stack is definitely entirely voip connections (i assume this could be untagged?), for the rest, wouldnt i need to know exactly which ports are which before assigning tagged ports.. that is.. i've not migrated wiring yet... i was trying to get the vlans setup then do the full re-wiring in a week over two days basically.

I also assume ill need to set the vlan names and ids identically on both stacks ? (would the voip vlan even exist on the 4 switch stack that doesnt have voip connections at all)?

[parnassus]

---

@markm75 wrote:

I configured the trunking in the GUI on both stacks.. there was a choice of active or passive lacp, but it wouldnt let me set stack01 to active and the other stack to passive.. threw an error.. i assume just on the type i need lacp, but not passive or active.  I also got spanning tree set and set the one stack to prioirty 1 and the other one to 0.

 Creating a Port Trunk with members interfaces the interfaces on which you have (not yet) to attach DAC Cables should be simple (I suggest you to set LACP Active on both sides for each created Port Trunk Group).

Then you can attach both DAC Cables on both ends, not before.

And on the subject of VLANS..

I have  50 : Management, 100 Servers, 150 Workstations-LAN and 200 VOIP set manually in the gui (where 50 is the ID).. I assume these are typical vlan names, but i'm on clear aside from VOIP where the advantage is to setting vlans here.

Also unclear on where tagging vs untagged should come in.. the one switch in the 2 switch stack is definitely entirely voip connections (i assume this could be untagged?), for the rest, wouldnt i need to know exactly which ports are which before assigning tagged ports.. that is.. i've not migrated wiring yet... i was trying to get the vlans setup then do the full re-wiring in a week over two days basically.

I also assume ill need to set the vlan names and ids identically on both stacks ? (would the voip vlan even exist on the 4 switch stack that doesnt have voip connections at all)?

---

VLAN IDs must be the same, VLANs Descriptions and Names are (string) labels only (those labes help you identifiyng and associating VLAN IDs with their purposes).

VLANs basic purposes: broadcast segmentation and attached Hosts isolation...so it's a matter of understanding what you want to achive and what are the Switches involved (keep in mind that a Stack is seen as one big logical Switch...so its configuration is one and just one).

[markm75]

---

@parnassus wrote:

---

@markm75 wrote:

I configured the trunking in the GUI on both stacks.. there was a choice of active or passive lacp, but it wouldnt let me set stack01 to active and the other stack to passive.. threw an error.. i assume just on the type i need lacp, but not passive or active.  I also got spanning tree set and set the one stack to prioirty 1 and the other one to 0.

 Creating a Port Trunk with members interfaces the interfaces on which you have (not yet) to attach DAC Cables should be simple (I suggest you to set LACP Active on both sides for each created Port Trunk Group).

Then you can attach both DAC Cables on both ends, not before.

And on the subject of VLANS..

I have  50 : Management, 100 Servers, 150 Workstations-LAN and 200 VOIP set manually in the gui (where 50 is the ID).. I assume these are typical vlan names, but i'm on clear aside from VOIP where the advantage is to setting vlans here.

Also unclear on where tagging vs untagged should come in.. the one switch in the 2 switch stack is definitely entirely voip connections (i assume this could be untagged?), for the rest, wouldnt i need to know exactly which ports are which before assigning tagged ports.. that is.. i've not migrated wiring yet... i was trying to get the vlans setup then do the full re-wiring in a week over two days basically.

I also assume ill need to set the vlan names and ids identically on both stacks ? (would the voip vlan even exist on the 4 switch stack that doesnt have voip connections at all)?

---

VLAN IDs must be the same, VLANs Descriptions and Names are (string) labels only (those labes help you identifiyng and associating VLAN IDs with their purposes).

VLANs basic purposes: broadcast segmentation and attached Hosts isolation...so it's a matter of understanding what you want to achive and what are the Switches involved (keep in mind that a Stack is seen as one big logical Switch...so its configuration is one and just one).

---

A few questions based on this ..

Would it make more sense to migrate the connections from the old switch, make sure everything talks, then enable the VLANs for the 3 or 4 groups i think ill create?

In either case, those all need to talk to each other, but I assume ill either have to map out what ports on the switch will be for which VLans or do it after i move all the wiring from the old switches to these 2 new stacks.

IE: the voice portion needs to communicate to at least the server Vlan.. i would assume the same on mangement, though i'm unclear what i'd use for managment vlan members (maybe just my gateway and vpn devices, so two total ports), which need to talk to the other vlans as well.

[markm75]

back tracking to the recommendation to set the trunk to active.. 

If i use the gui and try to use the pull down and set it to active.. it throws an error:

"dynamic LACP can not be activated on a manual trunk port"

What does the active setting do exactly, if i could get it to stick, that the current one does not?

[markm75]

So i guess a key piece of info that was missing from mind at least when planning all this was that each vlan cant be on the same subnet as we have things now?

That is, we have the 255.255.248.0 mask on 172.16.x for all our devices in our network, along with a gateway / router which is our sonicwall gateway.. dhcp is spit out from our windows domain to all devices or manually set.

Its my current understanding that i'd probably need to configure various subnets for each of the vlans..

Currently I have these listed as vlans:

Default_vlan
Management (which i think would be default_vlan, i'd just rename)
Servers
Workstations-LAN
Wifi
VOIP

It sounds as if the management vlan would be "untagged" for the ports for the wifi access points and sonicwall interface etc.. while the Wifi vlan would be what spits out ip addresses to wifi devices?

In either case, many of these need to talk to each other, which is why i thought they could just exist on the same set of ips/subnet originally.. like VOIP needs to talk to servers minimally and of course servers need to talk to workstations.  I'm assuming there is some command that sets that option. 

Its also my understanding that for stack1 i'd somehow have it set as the default gateway for that stack.. and for stack2 its ip would be the default gateway for that stack (and not our sonicwall router).

Either way its a big mess.. not sure i can implement this in a days time which is what i have to work with (starting migration of old wires mid day in a day or so).. i'll probably end up just migrating the wires and figuring this out later.

Biggest concerns are how the devices would get fresh ips (usually a shutdown / restart needed), so many pcs would be in limbo at first.. and also if it creates headaches for everything communicating in general windows wise.  Sounds like it adds big security but may create major headaches, at first.

[parnassus]

Hello @markm75, sorry for delay in answering...I saw your latest posts but was busy enough since Monday (HPE Discover 2017 Madrid!) and hadn't time to answer in time for all your questions/doubts.

I generally try to solve a problem at time...so back to the oldest I was able to recognize: actually, have you still issues with Port Trunking between your two Aruba 2920's fabric stacks or were you able to manage them?

Supposing you still have some issue can you share the outputs of show lacp and show trunk commands (eventually you can add the show lldp info remote-device too to gather more detail about the peer trunked device) issued on both Aruba stacks?

Generally setting up a IEEE 802.3ad (LACP) Port Trunking on HP ProCurve/Aruba should be simple (starting from a default configuration):

1. choose if you are going to deploy Non Protocol Port Trunking (trunk) or Protocol based Port Trunking (lacp) specifically IEEE 802.3ad LACP).
2. choose if you are going to configure Protocol based Port Trunking (lacp) as active or passive.
3. choose which members ports you will include in the Port Trunk logical port.

So, assuming you want to setup a LACP Port Trunking (active on both ends) between your two stacks you should issue this single simple command: interface n m lacp active (where here n and m represent the interface numbers you are planning to add as member ports). Nothing more, nothing less.

I've the strong suspect you didn't started from a default port configuration with regard to Port Trunk's members ports...

Then we can discuss about VLANs.

[markm75]

---

@parnassus wrote:

Hello @markm75, sorry for delay in answering...I saw your latest posts but was busy enough since Monday (HPE Discover 2017 Madrid!) and hadn't time to answer in time for all your questions/doubts.

I generally try to solve a problem at time...so back to the oldest I was able to recognize: actually, have you still issues with Port Trunking between your two Aruba 2920's fabric stacks or were you able to manage them?

Supposing you still have some issue can you share the outputs of show lacp and show trunk commands (eventually you can add the show lldp info remote-device too to gather more detail about the peer trunked device) issued on both Aruba stacks?

Generally setting up a IEEE 802.3ad (LACP) Port Trunking on HP ProCurve/Aruba should be simple (starting from a default configuration):

1. choose if you are going to deploy Non Protocol Port Trunking (trunk) or Protocol based Port Trunking (lacp) specifically IEEE 802.3ad LACP).
2. choose if you are going to configure Protocol based Port Trunking (lacp) as active or passive.
3. choose which members ports you will include in the Port Trunk logical port.

So, assuming you want to setup a LACP Port Trunking (active on both ends) between your two stacks you should issue this single simple command: interface n m lacp active (where here n and m represent the interface numbers you are planning to add as member ports). Nothing more, nothing less.

I've the strong suspect you didn't started from a default port configuration with regard to Port Trunk's members ports...

Then we can discuss about VLANs.

---

Well, i had the issue where if, in the gui, i tried to enable active it would fail with ""dynamic LACP can not be activated on a manual trunk port"

I'm not sure i understand the difference between lacp and regular trunking (and active/passive).. which is best to use.. i assumed active and lacp.. 

I did start from default, but used the gui to configure the trunk.. i disconnected the cables.. enabled them on the first stack, then repeated on second and connected cables (?)

Here are the commands

Stack1:

show lacp

LACP Trunk Port LACP Admin Oper
Port Enabled Group Status Partner Status Key Key
----- ------- ------- ------- ------- ------- ------ ------
2/A1 Active Trk1 Up Yes Success 0 210
2/A2 Active Trk1 Up Yes Success 0 210

show trunk:

Load Balancing Method: L3-based (default)

Port | Name Type | Group Type
------ + -------------------------------- ---------- + ----- --------
2/A1 | Stack01DACTrunkA1 SFP+SR | Trk1 LACP
2/A2 | Stack01DACTrunkA2 SFP+SR | Trk1 LACP

LLDP Remote Devices Information

LocalPort | ChassisId PortId PortDescr SysName
--------- + ------------------ ------------------ --------- ------------------
2/A1 | d0 bf 9c cf 56 c9 205 4/A1 HP4Member-Stack02
2/A2 | d0 bf 9c cf 56 c9 206 4/A2 HP4Member-Stack02

stack2:

show lacp

LACP Trunk Port LACP Admin Oper
Port Enabled Group Status Partner Status Key Key
----- ------- ------- ------- ------- ------- ------ ------
4/A1 Active Trk1 Up Yes Success 0 210
4/A2 Active Trk1 Up Yes Success 0 210

show trunk:

Load Balancing Method: L3-based (default)

Port | Name Type | Group Type
------ + -------------------------------- ---------- + ----- --------
4/A1 | Stack02DACTrunkA1 SFP+SR | Trk1 LACP
4/A2 | Stack02DACTrunkA2 SFP+SR | Trk1 LACP

LLDP Remote Devices Information

LocalPort | ChassisId PortId PortDescr SysName
--------- + ------------------ ------------------ --------- ------------------
4/31 | a0 b3 cc 4c 21 70 a0 b3 cc 4c 21 70
4/A1 | 70 10 6f 3d b5 cb 101 2/A1 HP2MEMB-stack01
4/A2 | 70 10 6f 3d b5 cb 102 2/A2 HP2MEMB-stack01

 edit:  the show trunks seem to show "active", but is this lacp active.. if so maybe i'm good to go.

Vlan wise, i'm holding off on that till after all wires are migrated (today), in the future, i feel thats a bigger mess than just getting things working at default + trunking

[parnassus]

Hi,

those outputs look good.

On Stack 1:

                          LACP
      LACP    Trunk   Port             LACP   Admin  Oper
Port  Enabled Group   Status  Partner Status  Key    Key
----- ------- ------- ------- ------- ------- ------ ------
2/A1  Active  Trk1    Up      Yes     Success 0      210
2/A2  Active  Trk1    Up      Yes     Success 0      210

Immediately Trk1 naming for Port Trunking means that you configured a Static LACP Port Trunking made of A1 and A2 interfaces of Stack 1's Member n°2.

The LACP Enabled parameter reports both 2/A1 and 2/A2 physical interfaces as Active, it just means that those ports automatically send LACP protocol packets.

Trunk Group reports Trkx (and not Dynx), it means that you used Static LACP instead of Dynamic LACP. (this also explains why you see it on the output of show trunk), LACP Status parameter reports Success, LACP Partner reports Yes so, in the end, you are pretty much good with regard to your Stack 1 <--> Stack 2 ports trunking.

The same can be said about Trk1 (with member ports 4/A1 and 4/A2) defined on your Stack 2's Member n°4:

                          LACP
      LACP    Trunk   Port             LACP   Admin  Oper
Port  Enabled Group   Status  Partner Status  Key    Key
----- ------- ------- ------- ------- ------- ------ ------
4/A1  Active  Trk1    Up      Yes     Success 0      210
4/A2  Active  Trk1    Up      Yes     Success 0      210