Connecting Switches Using ECMP

[sandsfoot]

Hello

After some advise for the best way to connect switches together over an encrypted link.

We have two sites.  Each site has a Catalyst 9300 three node stack.

Between the sites are encryption devices - due to the implementation, these must be used.

We are looking at the best ways to configure the connections.  I was wondering if ECMP with static routes was best or EIGRP?  However, I was unsure what health checking could be used to ensure the a link was up, or is this a function of ECMP?  We are looking at ways to ensure connectivity if one link fails.

I have attached a simple diagram of our setup.

Thanks in advance!

[balaji.bandi]

personally i would go with IGP Protocol, EIGRP or OSPF

You can use BFD here

https://www.cisco.com/c/en/us/td/docs/ios/12_0s/feature/guide/fs_bfd.html#wp1053447

[MHM Cisco World]

Can you check if

Etherchannel l3 is support it better than ecmp.

[Richard Burts]

There is much that we do not know about this situation and that might impact the advice that we would give. Based on the drawing I do not understand how EtherChannel would work. There is some device (not clear if router or switch) that connects to 2 encryptor devices. The encryptor devices have an inside IP and an outside IP so clearly there is layer 3 forwarding going on. It appears that they want to detect failures in the encrypted domain. How would EtherChannel help to do that?

Based on the drawing I would suggest that a dynamic routing protocol would be the better way to accomplish the objective. But it is not clear whether the encryptor devices would support that. Since the subnets change along the path trying to run a protocol like OSPF or EIGRP between sites would not work (since peers would not be on a common subnet). Perhaps something like BGP (which does not require peers being on a common subnet) might be an alternative?

[Joseph W. Doherty]

I too, agree with Rick, from you diagram and description, Etherchannel doesn't appear possible.  Etherchannel requires the two endpoints to be L2 neighbors.  BTW, some overlay technologies can make this appear to be the case, unknown whether your environment can.

If you can get Etherchannel to work, it might be actually more difficult to achieve good load balancing vs. L3 ECMP.  So, let's assume we're limited to L3 solutions.

As Rick notes, IGPs, generally need to connect across a "shared" network.  As he also notes, BGP can (logically) connect non shared network routers, but doing so still requires some form of transit routing.

You can also use static routes, or an IGP, across "invisible" transit hops, if something provides an overlay, such as some kind of tunneling protocol, etc.

"I was wondering if ECMP with static routes was best or EIGRP?"

Either could provide ECMP, although EIGRP can also do unequal.

Of course, for ECMP to work, both 9300s need to know of the routes on the far side of the other 9300, and consider them "equal" cost.  Also, of course (again), with EIGRP you have the option of using unequal cost routes too (although often it's recommended not to use this feature).

An issue of using static routes, vs. a dynamic routing protocol, such as EIGRP, you need to deal with the situation, if something "breaks" across/within the transit path, it must also "break" routing along the path.  Static routing, by default, only "breaks" if the interface drops.  To deal with issue, the usual approach is to use some form of an SLA feature tied to static routing.  (Generally, the only reason to use such an approach, rather than dynamic routing, is when you cannot run [for administrative or technical reasons] the same dynamic routing protocol between connecting L3 hops.)

So, like Rick, ECMP using a dynamic routing protocol, is, perhaps, your "better" approach.

Also, personally, when you need to start managing more than just a few static routes and/or need to do so for more than just a few devices, I find maintaining a network, with a routing protocol, easier than using static routing.  (Laugh, for me, about the only static route I generally maintain, is the one for a default route, and even for that, in many routing protocols I push that into the dynamic routing protocol.)

[mlund]

Hi

Maybe not an option, but have you considered MAC SEC instead of the external devices.

Then you could use etherchannel or ecmp with ospf/eigrp

/Mikael