Configuring Active / Active load balance

[tcmckay]

I have two 100 meg dedicated data links the connect corporate to our colo. I would like to configure them to be active/active and allow traffic to load balance between them. I am connecting a Cat 3850 stack to 2x nexus 9k. The links go from the Cat stack to each of the 9K's. 

[Hector Gustavo Serrano Gutierrez]

Yes, you can do this with simple Routing (static routes or a dynamic routing protocol) but we cannot go deep without more details about the specifics of this scenario. A draft of your current topology with some relevant IP addressing and configs is a good start.

[tcmckay]

[cid:41f858c7-ff27-456f-8d50-69275fd1c198]
My topology pictures didn't come through. The basics are that I have 2 nexus 9K's at our DC. They are configured in a vpc domain. Each of those switches connects with a single dedicated link back to our HQ. At HQ there is a 3850 stack. The two links from DC switches connect into the stack but different switches. I hope this helps.

HQCore
ip route 0.0.0.0 0.0.0.0 10.10.10.1
ip route 0.0.0.0 0.0.0.0 10.10.11.1 10

interface GigabitEthernet1/1/1
description UPL-CL1GB-CORP-TO-IMDC
switchport access vlan 600
speed nonegotiate

interface GigabitEthernet3/1/1
description UPL-L31GB-CORP-TO-IMDC
switchport access vlan 601
switchport mode access
speed nonegotiate

interface Vlan600
description CL1GB
ip address 10.10.10.12 255.255.255.0

interface Vlan601
description L31GB
ip address 10.10.11.12 255.255.255.0

DC1
ip route 10.12.0.0/16 10.10.10.12 (Networks at HQ)
ip route 10.12.0.0/16 10.10.11.12

interface Ethernet1/42
description e1/42-CL1GB-CORP
switchport
switchport access vlan 600
speed 1000
duplex full
no negotiate auto

interface Vlan600
description CLMESpan
no shutdown
vrf member saas
no ip redirects
ip address 10.10.10.4/28
no ipv6 redirects
ip router eigrp DC
hsrp version 2
hsrp 600
preempt
priority 220
timers 1 3
ip 10.10.10.1

interface Vlan601
description L3ME
no shutdown
vrf member saas
no ip redirects
ip address 10.10.11.4/28
no ipv6 redirects
hsrp version 2
hsrp 601
timers 1 3
ip 10.10.11.1

router eigrp DC
autonomous number 20


DC2
ip route 10.12.0.0/16 10.10.10.12 (Networks at HQ)
ip route 10.12.0.0/16 10.10.11.12

interface Ethernet1/42
description e1/42-L3-CORP
switchport
switchport access vlan 601
speed 1000
duplex full


interface Vlan600
description CLMESpan
no shutdown
vrf member saas
no ip redirects
ip address 10.10.10.5/28
no ipv6 redirects
hsrp version 2
hsrp 600
timers 1 3
ip 10.210.10.1

interface Vlan601
description L3ME
no shutdown
vrf member saas
no ip redirects
ip address 10.10.11.5/28
no ipv6 redirects
ip router eigrp DC
hsrp version 2
hsrp 601
preempt
priority 220
ip 10.10.11.1



Let me know if you need other configs. Both links are 1 gb.

[Hector Gustavo Serrano Gutierrez]

You can bundle your interfaces into a Port-Channel (LACP) on the Cat3850 side and as a vPC (LACP) on both of your Nexus. With that modification, you can keep using those static routes and due to the nature of that change, both links will be on a single vlan, like vlan 600. Load balance will happen in the Port-Channel hash.

My personal choice is to make both ports Layer 3 point-to-point links instead and modify the static routes to point to the new next-hop IPs.

Additionally, Instead of Static Routes, you should consider a dynamic Routing Protocol like EIGRP to advertise reachability between the networks in your DC and HQs.

Any of those changes would require a maintenance window since will introduce downtime.

[Hector Gustavo Serrano Gutierrez]

In case you have with the Port-Channel approach (LACP), here the configuration guides for vPC on the Nexus and Etherchannel on the Catalyst3850.

Virtual PortChannel Quick Configuration Guide

Layer 2/3 Configuration Guide, Cisco IOS XE Release 3SE (Catalyst 3850 Switches)
Chapter: Configuring EtherChannels

[tcmckay]

I have been testing this solution and it seems to work but I only have access to VIRL for my test and things that work in there don't always work in production. The static routes that are in use come from previous engineers and I have not yet removed them. I do have EIGRP running and it is advertising on both ends.

I will further test your suggestions and let you know how it goes.

[Hector Gustavo Serrano Gutierrez]

You may not be able to configure vPC on your Nexus in VIRL.

However, the Layer 3 point-to-point links should work properly on VIRL for you to test.

Regards.

[tcmckay]

I am able to configure vPC in VIRL which is nice to see how the changes will affect the current network. When I configured the static ip point-to-point links I couldn't get the traffic to use both paths. Further to this if I shut the port on one side the other side never failed over. I have EIGRP running and could do a sh ip route xxx.xxx.xxx and I could see when the one route was removed from the routing table but traffic still would not go up the other path.

[Hector Gustavo Serrano Gutierrez]

Should be a matter of looking at “show ip route x.x.x.x” where x.x.x.x is the destination. Make sure there is only one path when you shutdown the other and there a two when both links are up.