Solved: Re: Trunking between separate buildings with same vlan numbering

Steve Coady · ‎12-03-2013

Hello

I have (2) warehouses physically next to each other.

Each warehouse has it's own WAN link

My Vlan design is the same across all my sites where each site has (Vlan 10 - 15) using a site specific subnet ip scheme.

I am now going to run a fiber link between my (2) warehouses and can create a trunk between the sites.

I am pretty sure of the answer but I think I am going to have to re-vlan one of the warehouses so I can add each sites vlans to the trunk.

That seems like a mid-major overhaul to one of the sites

Does anyone have any experience with this type of design and provide some guidance on steps to follow?

sMc

Jon Marshall · ‎12-03-2013

Steve

You will indeed have to renumber your vlans if you make it a L2 trunk. So the question is, does it have to be a trunk ?

This depends on a few things -

1) are the switches that connect to each other via the fibre link L3 capable or not ? ** see note below

2) do you need the same vlan or more specifically the same IP subnet in both sites ? If you have devices in each site that need L2 asdjacency then you can only use a trunk but it sounds like you don't as these sites haven't been connected before.

So it basically comes down to either renumbering vlans or using a routed link.

** the actual switches that connect via fibre can still be L2 only. But you need something that is routing the vlans within each building. So a routed link could actually be a dedicated vlan that is run between the 2 sites and then you terminate that vlan on each L3 switch within each building.

Hope that makes sense, feel free to query more.

Jon

View solution in original post

Jon Marshall · ‎12-03-2013

Steve

Are you stating I can create a routeed interface on each L3 switch using any ip address not currently used on my network and then add static on each L3 switch pointing to the other sides Vlans across the new ip?

If the fibre is being connected into the L3 switches and you do not need the same IP subnet at each site then yes that would be the easiest way by far. You can either use static routes or run a routing protocol between the switches.

Jon

View solution in original post

Jon Marshall · ‎12-03-2013

Steve

You will indeed have to renumber your vlans if you make it a L2 trunk. So the question is, does it have to be a trunk ?

This depends on a few things -

1) are the switches that connect to each other via the fibre link L3 capable or not ? ** see note below

2) do you need the same vlan or more specifically the same IP subnet in both sites ? If you have devices in each site that need L2 asdjacency then you can only use a trunk but it sounds like you don't as these sites haven't been connected before.

So it basically comes down to either renumbering vlans or using a routed link.

** the actual switches that connect via fibre can still be L2 only. But you need something that is routing the vlans within each building. So a routed link could actually be a dedicated vlan that is run between the 2 sites and then you terminate that vlan on each L3 switch within each building.

Hope that makes sense, feel free to query more.

Jon

Steve Coady · ‎12-03-2013

Jon

Thank you for the reply

As it is now, I have a L3 switch where the vlans are created at each site.

The L3 switch connects to a 29xx router which advertises those subnet across my private cloud so all my other sites have visability.

Are you stating I can create a routeed interface on each L3 switch using any ip address not currently used on my network and then add static on each L3 switch pointing to the other sides Vlans across the new ip?

"ip route (other side vlan(s) via new routed int"

sMc

Jon Marshall · ‎12-03-2013

Steve

Are you stating I can create a routeed interface on each L3 switch using any ip address not currently used on my network and then add static on each L3 switch pointing to the other sides Vlans across the new ip?

If the fibre is being connected into the L3 switches and you do not need the same IP subnet at each site then yes that would be the easiest way by far. You can either use static routes or run a routing protocol between the switches.

Jon

jdiaz · ‎12-09-2013

I have a very similar setup, however, I do need the same IP's on both switches (Layer 2).

Here is my setup on each 3750 catalyst

config vlan dot1q tag native vlan enabled (both switches). I've revlan'd the other switch (HOU) so that the Atlanta subnets have their own vlan, and the HOU subnets have their own. There is no vlan\subnet overlap. All vlans exist on both switches. Both 3750 are the same ios version. Cdp NEI output shoows that the switches can see each other. I just cannot ping from one switch to the other. SH LOG displays no errors. Here is my setup. I hope youguys can see something that I am not. If I had any hair, I'd be pulling it out by now. Thanks for any help you may be able to provide.

ATL HOU

| |

| <---------- ISP Fiber Line ---------> | 10.2.0.0/24

| |

Layer-3 Switch 1 -- Cisco3750 --------- Cisco3750 -- Layer-3 Switch 2

| | | .1 .2 | | |

| vLAN 172 | | vLAN 772 |

| 172.16.1.0/24| | 172.16.2.0/24|

| | | |

vLAN 192 vLAN 10 vLAN 41 vLAN 112

192.168.40.0/24 10.11.1.0/24 192.168.41.0/24 10.11.2.0/24

ATL

Current configuration : 147 bytes

!

interface GigabitEthernet2/0/51

switchport access vlan 999

switchport trunk encapsulation dot1q

switchport mode trunk

speed nonegotiate

end

garfield#

garfield#sh int gi 2/0/51 trunk

Port Mode Encapsulation Status Native vlan

Gi2/0/51 on 802.1q trunking 1

Port Vlans allowed on trunk

Gi2/0/51 1-4094

Port Vlans allowed and active in management domain

Gi2/0/51 1,5,10,41,70,72,110,112,172,192,222,310,722,999

Port Vlans in spanning tree forwarding state and not pruned

Gi2/0/51 1,5,10,41,70,72,110,112,172,192,222,310,722,999

garfield#

garfield#sh int gi 2/0/51 switchport

Name: Gi2/0/51

Switchport: Enabled

Administrative Mode: trunk

Operational Mode: trunk

Administrative Trunking Encapsulation: dot1q

Operational Trunking Encapsulation: dot1q

Negotiation of Trunking: On

Access Mode VLAN: 999 (VLAN0999)

Trunking Native Mode VLAN: 1 (default)

Administrative Native VLAN tagging: enabled

Voice VLAN: none

Administrative private-vlan host-association: none

Administrative private-vlan mapping: none

Administrative private-vlan trunk native VLAN: none

Administrative private-vlan trunk Native VLAN tagging: enabled

Administrative private-vlan trunk encapsulation: dot1q

Administrative private-vlan trunk normal VLANs: none

Administrative private-vlan trunk associations: none

Administrative private-vlan trunk mappings: none

Operational private-vlan: none

Trunking VLANs Enabled: ALL

Pruning VLANs Enabled: 2-1001

Capture Mode Disabled

Capture VLANs Allowed: ALL

Protected: false

Unknown unicast blocked: disabled

Unknown multicast blocked: disabled

Appliance trust: none

garfield#

garfield#sh int gi 2/0/51

GigabitEthernet2/0/51 is up, line protocol is up (connected)

Hardware is Gigabit Ethernet, address is 0016.474b.9d33 (bia 0016.474b.9d33)

MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,

reliability 255/255, txload 1/255, rxload 1/255

Encapsulation ARPA, loopback not set

Keepalive not set

Full-duplex, 1000Mb/s, link type is force-up, media type is 1000BaseLX SFP

input flow-control is off, output flow-control is unsupported

ARP type: ARPA, ARP Timeout 04:00:00

Last input 00:00:25, output 00:00:01, output hang never

Last clearing of "show interface" counters 6d06h

Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0

Queueing strategy: fifo

Output queue: 0/0 (size/max)

5 minute input rate 27000 bits/sec, 6 packets/sec

5 minute output rate 161000 bits/sec, 108 packets/sec

31752 packets input, 16744384 bytes, 0 no buffer

Received 31108 broadcasts (8965 multicasts)

0 runts, 0 giants, 0 throttles

0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored

0 watchdog, 8965 multicast, 0 pause input

0 input packets with dribble condition detected

534385 packets output, 111431661 bytes, 0 underruns

0 output errors, 0 collisions, 0 interface resets

0 babbles, 0 late collision, 0 deferred

0 lost carrier, 0 no carrier, 0 PAUSE output

0 output buffer failures, 0 output buffers swapped out

garfield#

HOU

Building configuration...

Current configuration : 147 bytes

!

interface GigabitEthernet2/0/51

switchport access vlan 999

switchport trunk encapsulation dot1q

switchport mode trunk

speed nonegotiate

end

calvin#

calvin#sh int gi 2/0/51 trunk

Port Mode Encapsulation Status Native vlan

Gi2/0/51 on 802.1q trunking 1

Port Vlans allowed on trunk

Gi2/0/51 1-4094

Port Vlans allowed and active in management domain

Gi2/0/51 1,5,10,41,70,72,110,112,172,192,222,310,722,999

Port Vlans in spanning tree forwarding state and not pruned

Gi2/0/51 1,5,10,41,70,72,110,112,172,192,222,310,722,999

calvin#

calvin#sh int gi 2/0/51 switchport

Name: Gi2/0/51

Switchport: Enabled

Administrative Mode: trunk

Operational Mode: trunk

Administrative Trunking Encapsulation: dot1q

Operational Trunking Encapsulation: dot1q

Negotiation of Trunking: On

Access Mode VLAN: 999 (VLAN0999)

Trunking Native Mode VLAN: 1 (default)

Administrative Native VLAN tagging: enabled

Voice VLAN: none

Administrative private-vlan host-association: none

Administrative private-vlan mapping: none

Administrative private-vlan trunk native VLAN: none

Administrative private-vlan trunk Native VLAN tagging: enabled

Administrative private-vlan trunk encapsulation: dot1q

Administrative private-vlan trunk normal VLANs: none

Administrative private-vlan trunk associations: none

Administrative private-vlan trunk mappings: none

Operational private-vlan: none

Trunking VLANs Enabled: ALL

Pruning VLANs Enabled: 2-1001

Capture Mode Disabled

Capture VLANs Allowed: ALL

Protected: false

Unknown unicast blocked: disabled

Unknown multicast blocked: disabled

Appliance trust: none

calvin#

calvin#sh int gi 2/0/51

GigabitEthernet2/0/51 is up, line protocol is up (connected)

Hardware is Gigabit Ethernet, address is 0015.c6fb.2033 (bia 0015.c6fb.2033)

MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,

reliability 255/255, txload 1/255, rxload 1/255

Encapsulation ARPA, loopback not set

Keepalive not set

Full-duplex, 1000Mb/s, link type is force-up, media type is 1000BaseSX SFP

input flow-control is off, output flow-control is unsupported

ARP type: ARPA, ARP Timeout 04:00:00

Last input 00:00:00, output 00:00:19, output hang never

Last clearing of "show interface" counters never

Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0

Queueing strategy: fifo

Output queue: 0/40 (size/max)

5 minute input rate 149000 bits/sec, 100 packets/sec

5 minute output rate 27000 bits/sec, 6 packets/sec

181265 packets input, 34665585 bytes, 0 no buffer

Received 30398 broadcasts (19885 multicasts)

0 runts, 0 giants, 0 throttles

0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored

0 watchdog, 19885 multicast, 0 pause input

0 input packets with dribble condition detected

12368 packets output, 6240046 bytes, 0 underruns

0 output errors, 0 collisions, 1 interface resets

0 babbles, 0 late collision, 0 deferred

0 lost carrier, 0 no carrier, 0 PAUSE output

0 output buffer failures, 0 output buffers swapped out

calvin#

Jon Marshall · ‎12-09-2013

JD

I have a very similar setup, however, I do need the same IP's on both switches (Layer 2).

Here is my setup on each 3750 catalyst

You say the above, but then say there is no overlap with IP subnets and your diagram shows the same. So which is it ?

If both switches are L2 where do you route the vlans on these switches ? You must have a L3 switch in each building that routes the vlans if these are not doing it.

Can you post "sh ip route" from both switches ?

Jon

jdiaz · ‎12-10-2013

Sorry, I should've clarified. As it stands now, each site has there own vlan and subnet. However, after I have my 200MB ptp up and working, I want to be able to migrate machines back and forward. For example, I'd like to move server X with ip address of 192.168.40.7 from Atlanta to Houston, and have it come online in Houston with the same IP and still able to access all the services in Atlanta.

It was my thought that when we create the trunk between the two switches, It would be no different than if the Houston switch was here in Atlanta. Especially since my trunk is set to allow all vlans. The switches are catalyst 3750, which are Layer 3 switches. They run our ACL's for each site. We don't want to have to create a static route for each vlan, which is why we re-vlaned Houston last week.

Do I need to setup the IPsec VPN tunnel again between the routers for this to work? We had the tunnel in the past, but I took it down thinking we would no longer need it, now that we have the PTP fiber from 3750 to 3750. The tunnel was from ASA (router) to ASA. (hope this makes sense).

Atlanta

garfield#sh ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route

Gateway of last resort is 172.16.1.254 to network 0.0.0.0

C 192.168.40.0/24 is directly connected, Vlan192

172.16.0.0/24 is subnetted, 1 subnets

C 172.16.1.0 is directly connected, Vlan172

10.0.0.0/24 is subnetted, 3 subnets

C 10.11.1.0 is directly connected, Vlan10

C 10.3.3.0 is directly connected, Vlan310

S 10.7.2.0 [1/0] via 10.11.1.57

S* 0.0.0.0/0 [1/0] via 172.16.1.254

garfield#

Houston

calvin#sh ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route

Gateway of last resort is 172.16.2.254 to network 0.0.0.0

172.16.0.0/24 is subnetted, 1 subnets

C 172.16.2.0 is directly connected, Vlan722

C 192.168.41.0/24 is directly connected, Vlan41

10.0.0.0/24 is subnetted, 1 subnets

C 10.11.2.0 is directly connected, Vlan112

S* 0.0.0.0/0 [1/0] via 172.16.2.254

C 192.168.130.0/23 is directly connected, Vlan5

calvin#

Jon Marshall · ‎12-10-2013

JD

Okay, so you have renumbered the vlans so there is no need for routing between vlans.. Each vlan should exist on both switches and the trunk should allow them all which it does so there is no need to route.

So what exactly isn't working ie. from what device are you trying to connect (device and IP address) and what device are you trying to connect to (device and IP address) ?

Can you also post from each switch -

1) sh vlan brief

2) sh vtp status

3) sh vtp mode

Note also that 2) and 3) are important because when you joined the 2 switches together if they had been in the same domain one could have overwritten the others database so we need to be careful here.

Jon

jdiaz · ‎12-10-2013

Many thanks, Jon. You are correct, I had not mentioned my intent to move servers around, originally.

What is not working, is that I cannot ping Houston from Atlanta and viceversa. For example, If I am logged into the ATL switch, I try to ping the HOU switch, but get no reply. In this example, Let's say that ATL switch is 10.11.1.2.. If I try to ping 10.11.2.2 (HOU) nothing. 10.11.1.x traffic should be tagged as vlan 10 in ATL, and 10.11.2.x should be NOW tagged as vlan 112 in HOU.

ATL

garfield#sh vlan brief

VLAN Name Status Ports

---- -------------------------------- --------- -------------------------------

1 default active Gi1/0/49, Gi1/0/50, Gi1/0/51

Gi1/0/52, Gi2/0/49, Gi2/0/50

Gi2/0/52

5 VLAN0005 active

10 VLAN0010 active Gi1/0/20, Gi1/0/29, Gi1/0/30

Gi1/0/31, Gi1/0/32, Gi1/0/33

Gi1/0/34, Gi1/0/35, Gi1/0/36

Gi1/0/37, Gi1/0/38, Gi1/0/39

Gi1/0/40, Gi1/0/41, Gi1/0/42

Gi1/0/43, Gi1/0/44, Gi1/0/45

Gi1/0/46, Gi1/0/47, Gi1/0/48

Gi2/0/20, Gi2/0/29, Gi2/0/30

Gi2/0/31, Gi2/0/32, Gi2/0/33

Gi2/0/34, Gi2/0/35, Gi2/0/36

Gi2/0/37, Gi2/0/38, Gi2/0/39

Gi2/0/40, Gi2/0/41, Gi2/0/42

Gi2/0/43, Gi2/0/44, Gi2/0/45

Gi2/0/46, Gi2/0/47, Gi2/0/48

41 VLAN0041 active

70 VLAN0070 active

72 VLAN0072 active Gi1/0/1, Gi1/0/2, Gi2/0/1

Gi2/0/2

110 VLAN0110 active

112 VLAN0112 active Gi2/0/27

172 VLAN0172 active Gi1/0/5, Gi1/0/6, Gi1/0/7

Gi1/0/8, Gi2/0/5, Gi2/0/6

Gi2/0/7, Gi2/0/8

192 VLAN0192 active Gi1/0/3, Gi1/0/4, Gi1/0/9

Gi1/0/10, Gi1/0/11, Gi1/0/12

Gi1/0/13, Gi1/0/14, Gi1/0/15

Gi1/0/16, Gi1/0/17, Gi1/0/18

Gi1/0/19, Gi1/0/21, Gi1/0/22

Gi1/0/23, Gi1/0/24, Gi1/0/25

Gi1/0/26, Gi1/0/27, Gi2/0/3

Gi2/0/4, Gi2/0/9, Gi2/0/10

Gi2/0/11, Gi2/0/12, Gi2/0/13

Gi2/0/14, Gi2/0/15, Gi2/0/16

Gi2/0/17, Gi2/0/18, Gi2/0/19

Gi2/0/21, Gi2/0/22, Gi2/0/23

Gi2/0/24, Gi2/0/25, Gi2/0/26

Gi2/0/28

222 VLAN0222 active

310 VLAN0310 active

722 VLAN0722 active

VLAN Name Status Ports

---- -------------------------------- --------- -------------------------------

999 VLAN0999 active

1002 fddi-default act/unsup

1003 token-ring-default act/unsup

1004 fddinet-default act/unsup

1005 trnet-default act/unsup

garfield#

garfield#sh vtp status

VTP Version : running VTP1 (VTP2 capable)

Configuration Revision : 16

Maximum VLANs supported locally : 1005

Number of existing VLANs : 18

VTP Operating Mode : Server

VTP Domain Name : SU4

VTP Pruning Mode : Disabled

VTP V2 Mode : Disabled

VTP Traps Generation : Disabled

MD5 digest : 0xD3 0x52 0x2B 0xBC 0x96 0x08 0xB9 0x31

Configuration last modified by 0.0.0.0 at 9-2-95 06:58:04

Local updater ID is 10.11.1.2 on interface Vl10 (lowest numbered VLAN interface

found)

garfield#

garfield#sh vtp ?

counters VTP statistics

password VTP password

status VTP domain status

garfield#sh vtp counters

VTP statistics:

Summary advertisements received : 709

Subset advertisements received : 3

Request advertisements received : 0

Summary advertisements transmitted : 2076

Subset advertisements transmitted : 16

Request advertisements transmitted : 0

Number of config revision errors : 0

Number of config digest errors : 0

Number of V1 summary errors : 0

VTP pruning statistics:

Trunk Join Transmitted Join Received Summary advts received from

non-pruning-capable device

---------------- ---------------- ---------------- ---------------------------

Gi1/0/28 1 1 0

Gi2/0/51 0 0 0

HOU

calvin#sh vlan brief

VLAN Name Status Ports

---- -------------------------------- --------- -------------------------------

1 default active Gi1/0/49, Gi1/0/50, Gi1/0/51

Gi1/0/52, Gi2/0/49, Gi2/0/50

Gi2/0/52

5 VLAN0005 active Gi1/0/33, Gi1/0/34, Gi1/0/35

Gi1/0/36, Gi1/0/37, Gi1/0/38

Gi1/0/42, Gi1/0/43, Gi1/0/44

Gi1/0/45, Gi1/0/46, Gi1/0/47

Gi1/0/48, Gi2/0/33, Gi2/0/34

Gi2/0/35, Gi2/0/36, Gi2/0/37

Gi2/0/38, Gi2/0/42, Gi2/0/43

Gi2/0/44, Gi2/0/45, Gi2/0/46

Gi2/0/47, Gi2/0/48, Po11, Po12

Po13

10 VLAN0010 active

41 VLAN0041 active Gi1/0/11, Gi1/0/12, Gi1/0/13

Gi1/0/14, Gi1/0/15, Gi1/0/16

Gi1/0/20, Gi2/0/11, Gi2/0/12

Gi2/0/13, Gi2/0/14, Gi2/0/15

Gi2/0/16, Gi2/0/20

70 VLAN0070 active Gi1/0/1, Gi1/0/2, Gi1/0/3

Gi1/0/4, Gi2/0/1, Gi2/0/2

Gi2/0/3, Gi2/0/4

72 VLAN0072 active

110 VLAN0110 active

112 VLAN0112 active Gi1/0/21, Gi1/0/22, Gi1/0/23

Gi1/0/24, Gi1/0/25, Gi1/0/26

Gi1/0/27, Gi1/0/28, Gi1/0/29

Gi1/0/30, Gi1/0/31, Gi1/0/32

Gi2/0/21, Gi2/0/22, Gi2/0/23

Gi2/0/24, Gi2/0/25, Gi2/0/26

Gi2/0/27, Gi2/0/28, Gi2/0/29

Gi2/0/30, Gi2/0/31, Gi2/0/32

172 VLAN0172 active

192 VLAN0192 active

222 VLAN0222 active

310 VLAN0310 active

722 VLAN0722 active Gi1/0/5, Gi1/0/6, Gi1/0/7

Gi1/0/8, Gi1/0/9, Gi1/0/10

Gi2/0/5, Gi2/0/6, Gi2/0/7

Gi2/0/8, Gi2/0/9, Gi2/0/10

999 VLAN0999 active

1002 fddi-default act/unsup

1003 token-ring-default act/unsup

1004 fddinet-default act/unsup

1005 trnet-default act/unsup

calvin#

calvin#sh vtp status

VTP Version capable : 1 to 3

VTP version running : 1

VTP Domain Name :

VTP Pruning Mode : Disabled

VTP Traps Generation : Enabled

Device ID : 0015.c6fb.2000

Configuration last modified by 192.168.130.2 at 0-0-00 00:00:00

Feature VLAN:

--------------

VTP Operating Mode : Transparent

Maximum VLANs supported locally : 1005

Number of existing VLANs : 18

Configuration Revision : 0

MD5 digest : 0x80 0x93 0xE1 0x4B 0xCE 0xB2 0xB5 0xD5

0xC6 0x9B 0x12 0xD7 0x03 0xBE 0xFF 0xBD

calvin#

calvin#sh vtp int gi 2/0/51

Interface VTP Status

------------------------------------

GigabitEthernet2/0/51 enabled

calvin#sh vtp counters

VTP statistics:

Summary advertisements received : 0

Subset advertisements received : 0

Request advertisements received : 0

Summary advertisements transmitted : 0

Subset advertisements transmitted : 0

Request advertisements transmitted : 0

Number of config revision errors : 0

Number of config digest errors : 0

Number of V1 summary errors : 0

VTP pruning statistics:

Trunk Join Transmitted Join Received Summary advts received from

non-pruning-capable device

---------------- ---------------- ---------------- ---------------------------

Gi2/0/51 0 0 0

Po1 0 0 0

Po2 0 0 0

Po3 0 0 0

calvin#

Thanks.

Jon Marshall · ‎12-10-2013

JD

The issue is your routing tables. You are pinging from one IP subnet to another and so you need a route for it but the Atlanta switch has no route to 10.11.2.0/24 so it will actually send the packet to it's default gateway.

When i said there was no need to route i meant for the same vlan ie. if you moved a server from Houston to Atlanta it would go into the same vlan ie. same IP subnet, and it would be able to talk to the other servers in that vlan/IP subnet in either building.

But for the vlans with different IP subnets you have to route, you can't L2 switch because they are not in the same vlan/IP subnet.

So you need routes on each switch for the other buildings vlans/IP subnets.. You don't have to use static routes you could use a dynamic routing protocol instead. You would need a common L3 vlan interface on both switches for the peering.

Jon

jdiaz · ‎12-10-2013

That sounds it could be exactly what the problem is. Could I ask you for an example on how I would create one of these routes and\or how I would setup a routing proticol? Do I do this on both switches?

Thank you!

Jon Marshall · ‎12-10-2013

JD

Can you have a read of the last post i sent and see which way you want to go.

A lot depends on how many servers you are going to be moving. If there are a lot then that means you need pretty much all the vlans in both sites in which case the routed option is less attractive.

If on the other hand you only need perhaps one or two vlans to be in both buildings then routing between buildings is probably a better option.

Jon

jdiaz · ‎12-10-2013

There could be a lot. Potentially, all of my Atlanta servers could at one point move to HOU, since HOU is my Business continuity site. We intend to use to vmware SRM (not sure if you are familiar with it)... SRM creates mirrors of the servers from Atlanta in Houston. it sends replications updates to these mirrors every so often (15m to 24h, depending on config). In the event of a disaster in Atlanta and Houston's SRM cannot longer see Atlanta one or more of the Atlanta server hosts, we will be able to activate the mirrors in HOU, and keep going. The clinch is that while web servers may be down in Atlanta, applications servers may still be online tehre, so we will need to be able to pass traffic between them, as if they were all still in the same datacenter \ rack.

I can redo any config on the HOU switch, but ATL is my production environment. I guess my misunderstanding was that the PTP line (trunk), would operate the same as the IPSec VPN tunnel we had, only with more bandwidth. I was told it would be a very simple setup... something along the lines of "just create a dot1q trunk on each interface, and you are ready to go." It has obviously proven anything but.

Would the L3 interface you're talking about be the same where the fiber handoff from my ISP is plugged into? The SP was very clear when they said they would only support a dot1q trunk, nonegotiate. Anything oter than that would leave us out of SLA coverage.

Am being naive in my understanding that a trunk with native vlan1 and allowed vlans "all" between two interfaces directly connected by my ISP's fiber should be act as if I sinply uplinked a new switch? Perhaps I'm being oversimplistic.

I hope this answeres your questions. I really appreciate your help.

Jon Marshall · ‎12-10-2013

JD

If the IP subnets were the same in both sites then you would have no issues. It's not so much the vlans as the IP subnets. You have to route between IP subnets and that is what your IPSEC tunnels were in effect doing. A trunk link does not route, it L2 switches so a trunk was never going to replace your IPSEC setup in the same way.

When you setup a trunk with same vlans on both sides but different IP subnets then you are joining together 2 IP subnets and to do this you could use secondary addressing on the L3 vlan interface but that is not usually the way to do it with L3 switches.

If you are looking at having all the vlans/IP subnets available in both sites then the routed option makes no sense. With the routed option your trunk would allow the routing vlan (a new vlan) and only those vlans needed in both sites ie. the ones where you have servers in the same IP subnet in both buildings. If there were just a few then that would be okay.

But if you think you may want the flexibility of having all vlans/IP subnets available in both buildings so any server in an vlan/IP subnet can be in either building then a L2 trunk allowing all vlans together with HSRP on the switches is probably best.

I can help you out with either config but obviously the config is quite different depending on what you choose. Note also that if you choose to go with HSRP then you will need at least 2 spare IP addresses in each subnet.

Jon

jdiaz · ‎12-10-2013

Thanks, Jon.

Seems that an L2 trunk allowing all vlans together with HSRP is what I need. I can find an extra two IP on each vlan. If I can't, we have bigger issues

So, how do I go about that?

Trunking between separate buildings with same vlan numbering scheme