Issue with going to Layer3 between 6509s?

[jselman]

I have been asked to enable Layer 3 on a 2gig port-channel between 6509's that are loaded with identical Virtual Lans on both switches. One 6509 hosts these Virtual Lans as the active router in HSRP and as the root bridge. The other is the secondary root bridge and the standby router in HSRP. From each core, I have about 14 single separate user VLAN's trunked via layer 2 gige connections to a stack of 3550's in the closet in redundant uplink configuration. It is very stable. We are currently running PVST+, trunking all the VLAN's between the two cores but only one to the closet stack. Spanning tree is doing a wonderful job of splitting the stack in half, but what will happen when I enable Layer 3 between cores over the old trunked channel?

I am concerned that if I lose a link between members of the 3550 stack I will now have two active routers one on each core thereby causing duplicate active gateways and causing network instability for that VLAN.

[dgahm]

Your concern is correct, if you really want to go layer 3 between the 6509s, you should also go layer 3 from the 6509s to the access 3550s. You will need a 3550 code upgrade (2 switches per closet) from SMI to EMI, which is about $1000 per switch. The two EMI switches would run HSRP for the VLANs in that closet. With this topology you will have great fault tolerance with almost no dependence on spanning tree.

[jselman]

Thanks - If I have 34 switches it is 1000 x 34? This should be an IOS upgrade only right? Also should I maintain Layer 2 between the stack members and only put IP addresses on the gigE links to the cores? HSRP virtual gateways will still be configured on the cores and should still match the settings for root and secondary bridges? Ports previously assigned to a VLAN that was previously trunked to the closet stacks will now be have be re-assigned to VLAN1?

Is all this really worth the effort? Since I am currently only allowing one VLAN over the Layer 2 trunks to the closet, is this a problem with relying on spanning-tree to keep the stack loop-free? I plan to further secure loop introduction by placing BPDU guard on all the access ports in the stack.

[Darren Ramsey]

Anytime you span VLANs across closets or multiple 3550's, you should have a L2 connection between you DLSW, which in your case is your 6509. I wouldn't spend money on an EMI image for the 3550. If you are running newer IOS, then consider switching from HSRP to GLBP, running RSTP, keeping subnet boundaries per closet or per switch, and adding a L3 between 6509's. Hence you end up utilizing both uplinks and have a loop free design. You still want RSTP as a safety net. This Cisco WP should explain in more detail. Pages 42, 46, and 51 seem to be applicable to your design.

http://www.cisco.com/application/pdf/en/us/guest/netsol/ns432/c649/cdccont_0900aecd801a8a2d.pdf