server fault tolerance and load balancing on cisco switch

[kokhong.chew]

Is such network setup to provide fault tolerance and load balance for a server farm workable ?

2x stacked 3750s with each separate 2960 connect to it via  trunked port.

The server's 2 NICs to be team and configure for fault tolerance as well as load balance using the NIC configuration utility software. The teamed NICs connect to each separate 2960 switch. No other configuration done on their connected switch ports.

Or anyone ever do a similar setup before ? ? Thanks

[Ganesh Hariharan]

Hi,

Teaming at server end depends how you configure like Active/passive or Active/Active configuration for load balancing.It will work and automatically load balance the traffic coming in each NIC.

As both the NIC are connected to different switches,I will suggest you to configure in Active/Passive mode to have realiable TCP based communication to server.

Hope that clear your query !!

Regards

Ganesh.H

[kokhong.chew]

Well,understand that the fault tolerance mode depends on the type of NIC and whetehr its network configuration utility support.

i been testing out with fault tolerance only as well as fault tolerance with load balancing but the server being inaccessible for quite some time when i did a failover on the stacked 3750 (L2 configured) ie shut down one of the 3750.

However, no such experience when just disconnect one of the teamed ports from the server.

Is it possible the switch configuration ?

[Ganesh Hariharan]

Hi,

For your query  it can be possible that active NIC was connected with that particular switch and when it has gone down STP has taken 50 sec to converge and make the other port of the same zone switch in active fashion.

No in switch ther is no configuration as both the NOC are connected with different switches,it is only achivable at server end only.Yes you can do configuration of bundling if both the NIC are connected with same switch.

Hope that clear your query !!

Regards

Ganesh.H

[kokhong.chew]

portfast enable on the connected port . . .  so STP is disabled . . .

[Ganesh Hariharan]

Port Fast never disables STP in that port it always makes that port into forwading state directly. PortFast immediately transitions the port into STP forwarding mode upon linkup. The port still participates in STP. So if the port is to be a part of the loop, the port eventually transitions into STP blocking mode.

STP Portfast is ideal for ports which connects directly attached devices and certainly not for the ports which connects a hub or a switch. Hence, good to set switchports that directly connect end devices on your Access switch.

BPDU guard is laways recommended with portfast configuration in switches because STP PortFast BPDU guard enhancement allows network designers to       enforce the STP domain borders and keep the active topology predictable. The       devices behind the ports that have STP PortFast enabled are not able to       influence the STP topology. At the reception of BPDUs, the BPDU guard operation       disables the port that has PortFast configured. The BPDU guard transitions the       port into errdisable state

Hope that clear your query !!

Regards

Ganesh.H

[kokhong.chew]

Ganesh thanks for your inputs.

even with BPDU guard and portfast in-place, i ever experienced that user unknowingly connect another switch to that port and somehow loop that switch and bring down the whole network

[Ganesh Hariharan]

Hi,

In my opinion, BPDU Guard control BPDU spoof attack much better than BPDU Filtering. As a matter of fact, BPDU Guard block immediately the port at the reception of BPDUs, whereas BPDU Filtering only disable portfast feature.
The root guard feature partially restricts this type of attack; in fact an attacker will not be the root bridge, but it could take part of the spanning-tree instance.

For these reasons, a good solution to block BPDU spoof attack is to enable BPDU Guard control at all fastethernet ports used to connect laptop/PC/Server, while enable root guard feature on the ports used to connect switches.

Hope that helps out your query !!

Regards

Ganesh.H