topic Re: Configuring Redundancy on Layer 3 switches with multiple VLANs in Switching

Configuring Redundancy on Layer 3 switches with multiple VLANs

Ella M — Sat, 10 Dec 2022 17:55:24 GMT

Hey All,

I am looking for some advice on how to configure a redundancy Protocol on Packet tracer for my network and any help is greatly appreciated!

I have been tasked with creating a redundant network which operates between 2 buildings. I have chosen to use layer 3 switches with a trunk connection between, mainly for the convenience of inter-VLAN routing. There are two layer 3 switches within each building with the intent of one being standby and one being active (mirrored within both buildings).

Within the topology the top two layer 3 switches will be active and the two underneath will be standby.

From what I have found HSRP only enables one active device at a time which leads me to think that using this protocol wouldn't work unless there was a way to 'separate' the buildings from the perspective of the protocols.

Does anyone have any ideas on the best way to implement redundancy while accounting for the inter-VLAN requirements between buildings?

Also to note that I need to consider redundancy between the routers, both routers are active severing their side of the building but if one router goes down, the end devices will be required to get to the router within the other building.

Happy to share further information,

Thank you, Ella

Re: Configuring Redundancy on Layer 3 switches with multiple VLANs

MaxShantar — Sun, 11 Dec 2022 15:55:35 GMT

There are a few different ways you could approach this problem....An option you might consider is using the Virtual Router Redundancy Protocol (VRRP) instead of HSRP. VRRP is similar to HSRP, but it provides some additional features and flexibility. For example, VRRP allows you to create a virtual IP address and virtual MAC address that represents a group of routers, rather than just two routers like HSRP. This can be useful if you want to provide redundancy for multiple routers within a building, or if you want to use multiple active routers to distribute traffic among them.

To configure VRRP on your Cisco switches, you would follow a similar process as with HSRP. First, you would enable the VRRP feature using the "feature vrrp" command. Then, you would create a VRRP group for each VLAN that you want to provide redundancy for. For example, if you have VLANs 10 and 20 in each building, you would create two VRRP groups, one for each VLAN.

Here's an example of how you might configure VRRP for VLAN 10 in Building 1:

interface Vlan10 ip address 10.10.10.1/24 vrrp 10 preempt priority 110 ip 10.10.10.100 authentication md5 key-string password

Re: Configuring Redundancy on Layer 3 switches with multiple VLANs

Ella M — Sun, 11 Dec 2022 16:20:37 GMT

Thank you for your reply Max, that's really helpful,

In order to have multiple active layer 3 switches at the same time, is there a command to allow this? Or would it automatically work if I set the same priority for the vlan groups on both active switches?

Thank you

Re: Configuring Redundancy on Layer 3 switches with multiple VLANs

Joseph W. Doherty — Sun, 11 Dec 2022 17:18:59 GMT

". . . rather than just two routers like HSRP."

I thought you could have more than two routers within a HSRP group. Not so? Or are you referring to having multiple HSRP groups within the same L2 domain? (I recall having done both with HSRP - however, possibly PT, as often the case, doesn't support this "real world" feature.)

". . . if you want to use multiple active routers to distribute traffic among them."

You're talking about multiple virtual gateways (within same network), with clients in the same L2 domain, configured to use them? Yea, that's doable (at least "real world", with both VRRP and HSRP (I thought, or perhaps only with HSRPv2?), this is usually a maintenance headache, though. Much, much nicer is Cisco's GLBP configured to use multiple active gateways (possibly not supported in PT).

BTW, to OP, if you do have multiple VLANs, going to same devices, a variant of what @MaxShantar suggests if having different active gateways (i.e. across your devices) per VLAN. Doing this, all the hosts on each VLAN use just one virtual gateway IP, but you can load share across your VLANs.

Re: Configuring Redundancy on Layer 3 switches with multiple VLANs

Joseph W. Doherty — Sun, 11 Dec 2022 17:40:39 GMT

"I have been tasked with creating a redundant network which operates between 2 buildings."

That can entail much, much more than "configure a redundancy Protocol" (i.e. a FHRP?, e.g. HSRP, VRRP, GLBP).

Since you're using L3 switches, why are you not routing between the buildings?

So, how much redundancy are you really trying to achieve?

Re: Configuring Redundancy on Layer 3 switches with multiple VLANs

Ella M — Sun, 11 Dec 2022 17:59:19 GMT

Hey Joesph,

Thank you for the reply!

For now I'm seeing having a redundancy protocol in place as somewhat of a first step, but I am struggling to know which protocol is most suitable for what I am trying to achieve. HSRP, VRRP and GLBP are certainly all options I am looking into configuring. The level of redundancy I'm looking for is to have 2 devices operating as active and 2 as standby for a failure scenario, to allow the buildings to still communicate.

Routing was my original plan but I faced issues with inter-VLAN routing and unfortunately couldn't get it working, my main issue was being able to ping end-devices within the different buildings due to being in the same subnet. For example if PC1 was in VLAN10 and PC2 was also in VLAN10 (same subnet) but in the other building, having static routes in both directions to the same network wasn't viable and I couldn't find a solution, so decided to use a trunk across.

I'm quite new to networking so there may have been a solution I'm not aware of but found configuring a trunk to be something which worked.

Re: Configuring Redundancy on Layer 3 switches with multiple VLANs

MHM Cisco World — Sun, 11 Dec 2022 18:16:13 GMT

I am with @Joseph W. Doherty option here,
first run PVST
second run HSRP group
Group-A R1 is active for VLAN X
Group-B R2 is active for VLAN Y
Group-A R3 is standby for VLAN X
Group-B R4 is standby for VLAN Y

this give you two active route (different VLAN) and two standby Router.

Re: Configuring Redundancy on Layer 3 switches with multiple VLANs

Joseph W. Doherty — Sun, 11 Dec 2022 22:54:50 GMT

For starters, keep in mind PT often does not offer all the features of the "real" devices. I.e. there are multiple ways we might accomplish your goal, but we may be limited by what PT supports.

From your OP and your post to me, sound like your redundancy requirement is for your local network's gateway.

Unclear why you want to extend VLAN host usage across building when using L3 switches (beyond noting you could not get inter-VLAN routing to work).

Well, if you are going to extend VLANs between buildings, you only need two (yes, just two) L3 switches as you can replace one pair of L2 switches with a pair of L2 switches. (You could also use just a pair of routers, in lieu of the pair of L3 switches.)

With just a pair of L3 devices (and the extra two L2 switches), both L3 devices can be in either building, or one each per building.

With a L3 device per building, good practice would be to not haves same VLAN hosts in more than one building.

Your topology might look like:

B1L3 <routed>B2L3
|trunk| |trunk|
B1L2 <trunk >B2L2

V10 B1
V20 B2

Given the above, any ideas how to configure? (NB: As you're learning, I just don't want to provide a solution. I want to work with you finding the solution.)

Re: Configuring Redundancy on Layer 3 switches with multiple VLANs

Ella M — Mon, 12 Dec 2022 09:07:17 GMT

'Unclear why you want to extend VLAN host usage across building when using L3 switches' - From what I found using SVI's was somewhat the 'nicest' option to use to enable the inter-VLAN routing. Fibre connections were also required so after being unable to configure the routers I had prior to enable this, I extended the trunk across the L3 Switches.

Due to the limitations of PT, I was unable to use a L2 switch connecting the 2 buildings as I couldn't see a L2 switch with fibre modules, so I know having 4, L3 switches which trunk may seem a bit excessive but with that small caveat and the fact I couldn't seem to manipulate the routers I went for that option.

'With a L3 device per building, good practice would be to not haves same VLAN hosts in more than one building' - Originally I was told where the end devices had to be located within the buildings, which is why I was faced with the challenges, but upon reflection I will suggest they relocate some devices so that members of the same VLAN are within the same building.

If all members of the VLANs are within the same building I would assume I would be able to use static routes on the L3 switches and route the packets across L3 ports instead?

so it would look like:

B1L3 <routed>B2L3
|trunk| |trunk|
B1L3 <routed >B2L3

I suppose going back to redundancy, is having 4 L3 devices suitable in your opinion? The main reason to have 2 in each building is so that if one happened to go down, some devices that need to communicate across buildings can.

Again, thank you for you help and advice @Joseph W. Doherty its really appreciated!

Re: Configuring Redundancy on Layer 3 switches with multiple VLANs

Joseph W. Doherty — Mon, 12 Dec 2022 16:20:55 GMT

"From what I found using SVI's was somewhat the 'nicest' option to use to enable the inter-VLAN routing."

Laugh - guess it depends on what defines "nicest".

"Fibre connections were also required so after being unable to configure the routers I had prior to enable this, I extended the trunk across the L3 Switches.

Due to the limitations of PT, I was unable to use a L2 switch connecting the 2 buildings as I couldn't see a L2 switch with fibre modules . . ."

What version of PT are you using? (I'm running the latest [?] PT and it appears to have routers and switches that support fiber.)

"If all members of the VLANs are within the same building I would assume I would be able to use static routes on the L3 switches and route the packets across L3 ports instead?"

Yes, or use a dynamic routing protocol.

BTW, with VLANs per building (and L3 between buildings), you can "reuse" the same VLAN numbers in the different buildings too. (Some might use the same VLAN number to denote the same VLAN purpose per building, e.g. VLAN 10, user data VLAN; or a VLAN number that represents purpose and building, e.g. building 1, user data VLAN 110, building 2, user data VLAN 210, etc.)

"I suppose going back to redundancy, is having 4 L3 devices suitable in your opinion?"

It can be. What I suggested, i.e. just two routers and two switches, would usually be less expensive than 4 L3 switches, and it would show how to both VLAN and/or route between buildings. However, using just two L3 devices requires L2 between buildings.

With four L3 switches, you can also do:

B1L3 <trunk>B2L3
|trunk| |trunk|
B1L3 <trunk>B2L3

And you could avoid any explicit routing configuration.

Also, a variation of what I suggested earlier could be:

B1L3 <trunk>B2L3
|trunk| |trunk|
B1L2 <trunk>B2L2

Chose one of the four, and we can pursue how to configure. I.e. you propose how to configure.

Re: Configuring Redundancy on Layer 3 switches with multiple VLANs

Ella M — Mon, 12 Dec 2022 16:42:32 GMT

Haha maybe nicest wasn't the best word!

Unfortunately I'm using a work laptop at the PT software is limited to 8.1.1 (very frustrating)

I'm not normally one to shy away from routing but I feel as though sticking with:

B1L3 <trunk>B2L3
|trunk| |trunk|
B1L3 <trunk>B2L3

Is going to be the most viable option with the tools I've got and where the end-devices are currently situated, as long as there are no caveats to longer spanning trunks which I'm not aware of! Luckily there is no budget to abide by in the exercise given also (phew) 🙂

So I'm thinking as there are multiple VLANs on each switch, each SVI will need a standby IP going down the HSRP route. Initially I feel the configuration would look like:

interface Vlan10

mac-address 0001.97d0.2201

ip address 172.16.0.30 255.255.255.240

standby 10 ip 172.16.0.28

standby 10 priority .....

standby 10 preempt

I would assume all L3 Switches would have the same standby IP for each VLAN? This standby IP would then become the default gateway for end-devices instead of a gateway of the SVI?

I suppose my main query is going to be, how is it possible to have one active switch and one standby in each building, is there a way to separate the switches into groups?

Thank you

Re: Configuring Redundancy on Layer 3 switches with multiple VLANs

Joseph W. Doherty — Mon, 12 Dec 2022 17:13:51 GMT

You shouldn't (usually/normally) need to configure interface MACs.

Let's suppose we have VLAN 10 usage in building 1 and VLAN 20 usage in building 2.

For VLAN 10, decide what the virtual gateway IP will be (often the first or last host IP of the network address block).

Ditto for VLAN 20.

Using HSRP, the "standby # IP" will be the (virtual) gateway IP which all the network hosts will use.

For our purposes, unless you have a need for it, likely no need to configure other HSRP options.

Each SVI on each VLAN will have its own "real" (and unique) host IP out of that VLAN's address block.

You've correctly configured, in your last posting, HSRP on an SVI.

So, how many SVIs do you need to define, and what devices do you need to define them on?

For the SVIs, how many need HSRP, and what device SVI need what HSRP config.

"I would assume all L3 Switches would have the same standby IP for each VLAN?"

Correct.

"This standby IP would then become the default gateway for end-devices instead of a gateway of the SVI?"

Correct.

"I suppose my main query is going to be, how is it possible to have one active switch and one standby in each building, is there a way to separate the switches into groups?"

How possible? Yes, that's your question, i.e. how. (Hint: yes, can an active and standby in each building.)

Separate (HSRP) groups? Yes, possible, but do you yet understand how and where you need different groups?

Re: Configuring Redundancy on Layer 3 switches with multiple VLANs

Ella M — Mon, 12 Dec 2022 17:29:41 GMT

At current I've got 10 SVIs on each switch, as I have 10 VLANs overall. On each switch, the SVI for that particular VLAN has a different IP address from the VLAN address block i.e one switch has 172.16.0.44, another has 172.16.0.45, another has 172.16.0.46, all for VLAN 10. I have then replicated the same for each VLAN on all 4 switches. Now that I have typed out what I have done it seems slightly excessive, I suppose my main thinking was that if one switch went down then at least there were 3 other default-gateways for the devices to use, split across both buildings. Might be a better way to do that?

From what I have gathered, each SVI needs HSRP configured. Depending on if the switch was active or standby would dictate the priority that gets configured.

I do think my understanding is a bit fuzzy, from my current knowledge the only thing I can think of that dictates if a switch is active or standby is the priority. As I would like to have 2 active, if I gave these the same priority then the mac address to decide which single device is active. So unclear as to how I can have 2 active at once 🙂

Re: Configuring Redundancy on Layer 3 switches with multiple VLANs

MHM Cisco World — Mon, 12 Dec 2022 17:40:54 GMT

I see the topology in your original post I will check.

Re: Configuring Redundancy on Layer 3 switches with multiple VLANs

Joseph W. Doherty — Mon, 12 Dec 2022 23:21:30 GMT

Since you chose the "trunk" between all your L3 switches, to avoid explicit routing configuring, yes all VLANs will need to be defined on all your switches, and every switch will need a SVI for each VLAN. I.e. 10 VLANs times 4 switches, you'll have 40 SVIs. (NB: if you did do explicit routing, your number of SVIs would likely half.)

You need all these SVIs as you will only have implicit routing.

Regarding virtual gateways, you only need two per VLAN. You could define four per VLAN, but assuming VLAN usage is per building, the extra standbys don't provide any benefit. I.e. your two virtual gateways will be on the two L3 switches in the building using those VLANs. (If both L3 switches fail in the same building, the building VLANs will be lost - no path to the other building's L3 switches.)

Yes, priority determines, when HSRP first comes up, which device becomes the active gateway. The preempt option allows a higher priority gateway, as it comes on-line, after initial HSRP activation, to take over from an active gateway.

For your purposes, you will only need to consider which device you want to be the active gateway, if you're trying to load share traffic and/or one of your L3 switches is more powerful than the other. Otherwise, it shouldn't matter much (well beyond having active gateway also be the root for STP - due to not routing).

With HSRP, in the later variant, you can have more than one active gateway, within the same VLAN (one of the places that HSRP group is important), but each uses its own virtual IP, which creates the issue how you manage host usage across different virtual gateway IPs. (As note earlier, Cisco's GLBP can low share across devices using just one virtual IP, but HSRP cannot.)

Re: Configuring Redundancy on Layer 3 switches with multiple VLANs

Ella M — Tue, 13 Dec 2022 11:20:41 GMT

Hey,

Are the virtual gateways different to the SVI IP addresses?

At the moment the top left L3 switch is my root bridge and is also the switch which the end devices in B1 are using as its default-gateway with the SVI addresses. This is mirrored in B2 with the top right L3 switch being the root bridge and using SVIs as default gateways.

Would HSRP work on a per VLAN basis? So rather than having one active one standby per building (which is the way I was viewing it) would it be one active one standby per VLAN? and if so how would the L3 switches differentiate between which two are configured to be active and which two are configured to be standby?

Sorry for so many questions I'm just trying to get my head around how it will work!

Thank you

Re: Configuring Redundancy on Layer 3 switches with multiple VLANs

Joseph W. Doherty — Tue, 13 Dec 2022 16:08:50 GMT

"Are the virtual gateways different to the SVI IP addresses?"

For HSRP and GLBP, yes! (For VRRP, it's a bit more complicated.)

When using a FHRP, hosts use the virtual gateway IP.

"Would HSRP work on a per VLAN basis?"

Yes, ditto for GLBP and VRRP. (Remember, it's a virtual gateway IP, i.e. would an SVI IP be used on other SVIs? No, neither for FHRP IPs.)

"So rather than having one active one standby per building (which is the way I was viewing it) would it be one active one standby per VLAN?"

Latter is correct, i.e. per VLAN.

"and if so how would the L3 switches differentiate between which two are configured to be active and which two are configured to be standby?"

In same VLAN? Group number, and different/unique virtual IPs per VLAN. (Doing this is a more "advanced" usage of using HSRP, allows virtual gateway IPs for load sharing [much as can be done with non-virtual IPs]. As Cisco's GLBP, much less need for this "advanced" HSRP feature [which, at one time, one only available on higher-end Cisco routers].)

"Sorry for so many questions I'm just trying to get my head around how it will work!"

Nothing to apologize for; forums are about learning.

I hadn't realized you thought a single HSRP virtual IP would be used across VLANs. Thinking that, easy to understand some of your confusion.

Re: Configuring Redundancy on Layer 3 switches with multiple VLANs

Ella M — Tue, 13 Dec 2022 16:34:32 GMT

I see! Thank you,

B1L3 <trunk>B2L3
|trunk| |trunk|
B1L3 <trunk>B2L3

Using 2 VLANS as an example...

Would configuration look something like:

B1L3 (ACTIVE)

interface Vlan10

ip address 172.16.0.43 255.255.255.240

standby 10 ip 172.16.0.42

standby 10 priority 150

standby 10 preempt

interface Vlan20

ip address 172.16.0.59 255.255.255.240

standby 20 ip 172.16.0.58

standby 20 priority 150

standby 20 preempt

B1L3 (STANDBY)

interface Vlan10

ip address 172.16.0.44 255.255.255.240

standby 10 ip 172.16.0.42

standby 10 priority 100

standby 10 preempt

interface Vlan20

ip address 172.16.0.60 255.255.255.240

standby 20 ip 172.16.0.58

standby 20 priority 100

standby 20 preempt

B2L3 (ACTIVE)

interface Vlan10

ip address 172.16.0.45 255.255.255.240

standby 10 ip 172.16.0.41

standby 10 priority 150

standby 10 preempt

interface Vlan20

ip address 172.16.0.61 255.255.255.240

standby 20 ip 172.16.0.57

standby 20 priority 150

standby 20 preempt

B2L3 (STANDBY)

interface Vlan10

ip address 172.16.0.46 255.255.255.240

standby 10 ip 172.16.0.41

standby 10 priority 100

standby 10 preempt

interface Vlan20

ip address 172.16.0.62 255.255.255.240

standby 20 ip 172.16.0.57

standby 20 priority 100

standby 20 preempt

Re: Configuring Redundancy on Layer 3 switches with multiple VLANs

Joseph W. Doherty — Tue, 13 Dec 2022 17:14:08 GMT

You're getting close!

The active is per VLAN - i.e. only one should have the highest priority.

You can have all four L3 switches be members of the HSRP group (not needed, all of each VLAN's hosts are same building - we'll come back to that), but if you have more that two, and you want a particular router to be the standby, its priority would be less than the desired active, but greater than any other routers for that group. It would also should have preempt (as would the preferred active).

When you don't care about one HSRP member being better (or worst) than another you don't need to assign priority (which has a default value). If you don't care that one HSRP member always trying to be better than what's currently the situation, as that HSRP joins an active group, you don't need to use preempt.

In your topology, do you benefit from having more than two HSRP members? Try "what if".

Consider (same) VLAN hosts can be in both building vs. all (same) VLAN hosts are only in one building.

Then "fail" a L3 switch with currently active HSRP gateway. Secondary takes over, all good (regardless), right? Even regardless of VLAN hosts locations and/or which building secondary is in relative to the original active L3 switch, right?

Then "fail" the L3 switch that was secondary, now active. Again, assuming all VLAN hosts one building vs. two and/or the newly failed secondary in the same building or the other building. What's good or bad now? Do we benefit from having another HSRP member, in all situations, or just some? If some situations do not need another (3rd) HSRP member, is that something we can "control"?

If you can work out the prior "what ifs", you're well on you way toward designing networks that meet particular requirements.

Below, I believe, would support VLAN 10 with its hosts only in building 1 and VLAN 20 with its hosts only in building 2. Can you see why?

B1L3 (ACTIVE)

interface Vlan10
ip address 172.16.0.43 255.255.255.240
standby 10 ip 172.16.0.42
standby 10 priority 150
standby 10 preempt

interface Vlan20
ip address 172.16.0.59 255.255.255.240

B1L3 (STANDBY)

interface Vlan10
ip address 172.16.0.44 255.255.255.240
standby 10 ip 172.16.0.42

interface Vlan20
ip address 172.16.0.60 255.255.255.240

B2L3 (ACTIVE)

interface Vlan10
ip address 172.16.0.45 255.255.255.240

interface Vlan20
ip address 172.16.0.61 255.255.255.240
standby 20 ip 172.16.0.57
standby 20 priority 150
standby 20 preempt

B2L3 (STANDBY)

interface Vlan10
ip address 172.16.0.46 255.255.255.240

interface Vlan20
ip address 172.16.0.62 255.255.255.240
standby 20 ip 172.16.0.57

Re: Configuring Redundancy on Layer 3 switches with multiple VLANs

Ella M — Tue, 13 Dec 2022 18:46:56 GMT

Hmmm interesting,

When you say the active is per VLAN, are you referring to an active switch on a per VLAN basis? so a device that is active for VLAN 10 may be standby for VLAN 20 for example?

Also HSRP members, are they the devices themselves or the VLANs? If they are the devices then within my topology I would benefit from having two members due to the fact that that there needs to be two devices active at any one time for the network to function.

If VLANs were in the same building then I can see how two could be sufficient as you have configured the standby IPs for VLAN 10 with the priority for the active, then mirrored this to represent VLAN 20 on the other side. So that configuration certainly makes sense to me in terms how active and standby will be elected.

I think I start to get the wrong end of the stick when the VLANs are within the different buildings haha

Thank you