CSS placement for new design

[mschnabe]

For a new web server load balancing design, I need to load balance 4 web servers to start with and more in the future. Should I place the CSS in a DMZ and run a one arm config or have the web servers direct attached to the CSS in the DMZ and run another back office network thru separate nics. I was going to use a 11501 to start with and hopefully move to a pair running ASR/VIP

thanks in advance

[Gilles Dufour]

The 501 has 1 Gig interface and 8 Fastethernet.

If you plan to have more than 8 servers, you will need to use another L2 switch.

Since the CSS does not support etherchannel, you will have to chose which interface to connect to the switch - FastE or GigE ?

Personally, if you need more than 8 servers, I would recommend a 11503 or 11506.

If you will have less than 8, I would suggest to use the FastE to connect the servers directly to the CSS

and the GigE to go to the firewall.

Make the CSS the default gateway for the servers.

No need of 2nd Nic on the servers.

Not sure why you think you need it.

Regards,

Gilles.

[d.parks]

While the CSS does not support etherchannel, it does support 801.1q trunking. If your L2 switch supports trunking, I'd recommend trunking two VLAN's across the gigabit port on the CSS (one "ingress" and one for your server network) Have the servers use the CSS as their L3 gateway.

This will not require you to source NAT the client traffic since it is not a true one-arm configuration (even though you'd just be using one port)

At the point that you add the second CSS, failover will be pretty straightforward to setup since you won't have to worry about servers that are physically connected to the CSS.

[Gilles Dufour]

it is a good point.

When adding the 2nd CSS it is easier to have the servers already attached to a separate L2 switch.

This would be the best choice.

Gilles.

[richard.troman]

Hi,

I may be out of date here, but when you add a second CSS, if you want resilience you will have think carefully. I don't think some of the resilience options work over the GB interfaces.

Otherwise i agree

[Gilles Dufour]

what do you mean by resilience ?

Are you talking about statefull failover ?

This works over gigabit.

I don't think there is a single feature that does not work over gig.

If you know one, please let us know.

[so at least I can verify].

Thanks,

Gilles.