Stackwise Virtual switch from 10 Gbps to 100 Gbps links

[patoberli]

Hi all

I have a StackWise Virtual setup with two Cat 9500-24Y4C running 16.12.x, where the virtual link currently is built from 4x 10 Gbps links. I would like to switch this now to 100 Gbps links, ideally without any interruption. 

The guide says I can't mix different link speeds 

All the ports used for configuring a StackWise Virtual Link (SVL) must share the same speed. For example, you cannot configure a 10G or a 40G port to form an SVL, simultaneously.

I haven't yet tested the commands, as this is a production network and I don't have a lab to test this. 

Currently I think I would need to power off the second switch, remove the old "stackwise-virtual link 1" from the interfaces and then add it to the new ones and power up the second again? Would that work or will that kill the network because switch2 doesn't know it should use the 100 Gbps interfaces instead of the 10 Gbps ones and thus not form the stack?

Could I maybe create a second domain between the two and add the 100 Gbps links to that one? 

What would be the smoothest way to switch this?

Besides this, I currently don't have a Dual-active detection link between the two switches. If I add this, do I need to reload the whole stack, or would it be enough to first reload one switch, wait until it's running again and then reload the other one, so that I don't get an outage?

Thanks

Patrick

[balaji.bandi]

Personally you do not need 100GB Links between switches, (only business like to waste money and 100GB ports on this).

if you really want to change this links, that is only way you see that mentioned turn off secondary device and reconfigure new ports and turn back to slave device back to form a Stackwise virtual. (make sure you do this in maintenance window)

Adding DAD link not rquired to reboot or any downtime required. you can add any time.

[patoberli]

Thanks, this is very interesting.
In my case I probably need it, because our internal firewalls (active/standby setup) are attached. Each firewall is attached to one of each switch (separated by rooms, for room redundancy), so most traffic must anyway go through switch-1. Might not be the perfect setup I guess, need to reconsider attaching them to distribution switches that are attached to the C9500.
The new firewall makes up to 40 Gbps, although attached by 4x 10 Gbps, but still might consider switching to 100 Gbps. The C9500 attached new switches are with 100 Gbps and the new servers are attached by up to 25 Gbps. So I fear the virtual link might become a bottle neck in very specific scenarios.

[balaji.bandi]

Sure this is your busines case and justfiication we understand the requirement, if the business can able to make decision, go for it.

Let us know how it goes.

[Manoj Reddy]

Hi,

Please help me answering the below questions:

Have gone through your requirement, but i can see this is in Dis switch layer you have the switches that are connected in different rooms for redundant power and for other reasons, but don't it connected Core switch?

If core switch is available, why the firewalls are connected to Dis layer switch?

Also, it's better to enable the DAD and you use the below commands:

interface TwentyFiveGigE XXX
stackwise-virtual dual-active-detection

[Reza Sharifi]

Hi,

So I fear the virtual link might become a bottle neck in very specific scenarios.

The only time you utilize the virtual stack links between the switches a lot is when an access switch is only uplinked to one of the core switches. If all access switches are connected to both switches, which they should be because that is the correct design, you hardly ever use the inter-links between the switches. So, 4x10 gig is plenty of bandwidth for the inter-link.

HTH 

[patoberli]

Thanks. 

In my case the Active/Standby firewalls are currently directly connected to the stack, Active to the Switch1 and Standby to the Switch2. Those are the only devices that aren't attached to both Switches. As I'm now anyway also installing a new firewall, I'm reconsidering this (in the past the idea was to have room outage redundancy, nothing more, also the old firewall only had copper interfaces, so it wasn't possible to connect it to the other room). I just now remembered why I had the old firewall not connected to the other room, the new one only has fiber interfaces though. 

[patoberli]

Just made the DAD link, it seems to require a reboot:

9500R-SWV#show stackwise-virtual dual-active-detection 
In dual-active recovery mode: No
Recovery Reload: Enabled

Dual-Active-Detection Configuration:
-------------------------------------
Switch  Dad port                        Status
------  ------------                    ---------

Distributed Stack DAD Configuration After Reboot:
------------------------------------------------
Switch  Dad port                        Status
------  --------                        ------
1       TwentyFiveGigE1/0/3             down   
2       TwentyFiveGigE2/0/3             down   

[Manoj Reddy]

Hi @patoberli Yes pls reboot the switch to update the changes

Please let us know the update

[patoberli]

I'm right now upgrading the software from 16.12.4 to 17.3.4. I'm using the not supported ISSU command, but it looks like it's working. It did rollback on the first try, because I had two "unkown" command in my configuration:

et-analytics 
vtp interface vlan1234

I've removed them and doing another try just now this moment. So far it looks good.

The Dual-Active link is since the first try online though

[patoberli]

And the interruption less (ISSU) upgrade went fine the second try

[Manoj Reddy]

Ok, everything is fine now and looking for any help, pls let me know @patoberli 

[patoberli]

Regarding the shut down, reconfigure and power on, will the Secondary copy the new configuration from the Primary while booting up? Or will that cause some configuration conflict? 

[Manoj Reddy]

Hi @patoberli 

Good question!!

For DAD link you need to reboot both the switches 

Please do that and let me know the update

[patoberli]

Hi @Manoj Reddy
I've rebooted the switches (while doing the (not supported) ISSU upgrade from 16.12.4 to 17.3.4) and the DAD link is active and working now.
The question is now, what is the best way to swap the stackwise links without causing a configuration mismatch.