Traditional Layer 2 Access Layer

Figure 7-1 shows the traditional Layer 2 access layer. This is the de facto model that has been used for years, where VLANs are defined in the distribution switches, HSRP gateways are configured for the VLANs with active and standby, and the Spanning Tree Protocol root bridge is configured. The access switch is configured as a Layer 2 switch that forwards traffic via trunk ports to the distribution switches. There is no load balancing because Spanning Tree Protocol blocks one of the uplink trunks, so only one uplink is active for each VLAN.

Distribution layer switches act as default gateways. Layer 3 links are used between the core and distribution switches with a routing protocol.

Updated Layer 2 Access Layer (Using VSS)

Figure 7-2 shows the updated Layer 2 access layer. In this model, the distribution switches are still the demarcation between the Layer 2 and Layer 3 boundaries. The difference now is that Virtual Switching System (VSS) is configured in the distribution layer. With VSS, the physical distribution switch pair is merged into a virtual switch. VSS is supported on Cisco 4500, 6500, and 6800 Series switches. With VSS, both access switch uplinks are used, doubling the bandwidth from access switches to the distribution pair. The bundled pair is called a Multichassis EtherChannel (MEC), and it creates a loop-free topology. With Gigabit Ethernet uplinks, you have 2 Gbps of uplink bandwidth, and with 10 Gigabit Ethernet uplinks, you have 20 Gbps of uplink bandwidth.

When VSS is used, there is no need for a first-hop routing protocol (FHRP) such as HSRP. This solution provides faster convergence and higher uplink bandwidth than the traditional Layer 2 access design.

Layer 3 Access Layer

Figure 7-3 shows the Layer 3 access layer. With this design model, the Layer 3 demarcation is pushed to the access layer. The access layer switches have VLANs defined and act as the default gateways. Notice that VLANs are not able to span access switches.

Layer 3 links are now used from the access layer to the distribution switches to the core. The use of HSRP is not necessary. In this solution, the access layer switches act as default gateways and participate in routing, and there is no need for an FHRP.

Hybrid LAN Access Layer

The hybrid access layer combines the use of Layer 2 switching with Layer 3 at the access layer. In this design, some VLANs are defined in the access layer and others in the distribution layer. There are Layer 3 and Layer 2 links between the distribution switches and the access switches. With the Layer 2 links, Spanning Tree Protocol is still in the network. This design is not the preferred design because it has the added complexity of mixed Layer 2 and Layer 3 access layers per VLAN, but it is usually implemented for various reasons. One reason to implement these solutions might be sensor or security devices requiring a shared VLAN. The disadvantage is that Spanning Tree Protocol is enabled on these VLANs.

Access Layer Designs

Table 7-4 summarizes the access layer designs.

The following are the recommended best practices for the building access layer:

• Limit VLANs to a single closet when possible to provide the most deterministic and highly available topology.

• Use Rapid Per-VLAN Spanning Tree Plus (RPVST+) if Spanning Tree Protocol is required. It provides for faster convergence than traditional 802.1d default timers.

• Set trunks to ON and ON with no-negotiate.

• Prune unused VLANs to avoid broadcast propagation; this is commonly done on the distribution switch. VLAN Trunking Protocol (VTP) version 2 and version 3 automatically prune unused VLANs.

• Use VTP Transparent mode because there is little need for a common VLAN database in hierarchical networks.

• Disable trunking on host ports because it is not necessary. Doing so provides more security and speeds up PortFast.

• Consider implementing routing in the access layer to provide fast convergence and Layer 3 load balancing.

• Use the switchport host command on server and end-user ports to enable PortFast and disable channeling on these ports. Alternatively, you can use the spanning-tree portfast default global command.

• Use the Cisco STP Toolkit, which provides the following tools:

  • PortFast: Bypasses the listening/learning phase for access ports.

  • Loop Guard: Prevents an alternate or root port from becoming designated in the absence of bridge protocol data units (BPDUs).

  • Root Guard: Prevents external switches from becoming root.

  • Design Strategy: Used to design a Spanning Tree Protocol priority strategy with the highest priorities hardcoded at the top layers of the Spanning Tree Protocol tree.

  • BPDU Guard: Disables a PortFast-enabled port if a BPDU is received.

Stacking Access Switches

Stacking is a method of joining multiple physical access switches into a single logical switch. Switches are interconnected by stackwise interconnect cables, and a master switch is selected. The switch stack is managed as a single object and uses a single IP management address and a single configuration file. This reduces management overhead. Furthermore, the switch stack can create an EtherChannel connection, and uplinks can form MECs with an upstream VSS distribution pair.

HSRP

Cisco Hot Standby Routing Protocol (HSRP) provides a way for an IP workstation that supports only one default router to keep communicating on the internetwork even if its default router becomes unavailable. HSRP works by creating a virtual router that has its own IP and MAC addresses. The workstations use this virtual IP address as their default router.

HSRP routers on a LAN communicate among themselves to designate two routers as active and standby. The active router sends periodic hello messages. The other HSRP routers listen for the hello messages. If the active router fails and the other HSRP routers stop receiving hello messages, the standby router takes over and becomes the active router. Because the new active router assumes both the phantom’s IP and MAC addresses, end nodes see no change. They continue to send packets to the phantom router’s MAC address, and the new active router delivers those packets.

The default HSRP timers are 3 seconds for the hello timer and 10 seconds for the dead timer. You can achieve subsecond failover with HSRP by setting the hello timer to 200 milliseconds and the dead timer to 750 milliseconds. It is recommended to configure HSRP with preemption. With preemption, the primary HSRP router reassumes the primary role when it comes back online. HSRP preemption should be explicitly configured because by default it is disabled. HSRP does not support load sharing as part of the protocol specification. In order to use both uplink paths to the distribution switches, different HSRP groups are configured for different VLANs, with the primary router configured for Switch A for some VLANs and the primary router configured for Switch B for other VLANs. HSRP has a native interface tracking mechanism that is used to track an uplink. If the uplink fails, the HSRP priority is reduced.

HSRP also works for proxy ARP. When an active HSRP router receives an ARP request for a node that is not on the local LAN, the router replies with the phantom router’s MAC address instead of its own. If the router that originally sent the ARP reply later loses its connection, the new active router can still deliver the traffic.

Figure 7-7 shows a sample implementation of HSRP.

In Figure 7-7, the following sequence occurs:

Step 1. The workstation is configured to use the phantom router (192.168.1.1) as its default router.

Step 2. Upon booting, the routers elect Router A as the HSRP active router. The active router does the work for the HSRP phantom. Router B is the HSRP standby router.

Step 3. When the workstation sends an ARP frame to find its default router, Router A responds with the phantom router’s MAC address.

Step 4. If Router A goes offline, Router B takes over as the active router and continues the delivery of the workstation’s packets. The change is transparent to the workstation.

VRRP

Virtual Router Redundancy Protocol (VRRP) is a router redundancy protocol defined in RFC 3768. VRRPv2 only supports IPv4. RFC 5798 defines VRRPv3 for both IPv4 and IPv6 networks. VRRP is based on Cisco’s HSRP but is not compatible with it. VRRP specifies an election protocol that dynamically assigns responsibility for a virtual router to one of the VRRP routers on a LAN. The VRRP router controlling the IP addresses associated with a virtual router is called the master, and it forwards packets sent to these IP addresses. The election process provides dynamic failover in the forwarding responsibility in the event that the master become unavailable. This allows any of the virtual router IP addresses on the LAN to be used as the default first-hop router by end hosts. The virtual router backup assumes the forwarding responsibility for the virtual router if the master fails. The default VRRP hello timer is 1 second, and the dead timer is 3 seconds. Unlike in HSRP, VRRP preemption is enabled by default. Similar to HSRP, to configure load balancing, different VRRP groups are configured for different VLANs. VRRP can also be configured to track the uplink to decrement the VRRP priority of the primary router.

GLBP

Global Load Balancing Protocol (GLBP) is a Cisco-proprietary FHRP that allows packet load sharing among a group of routers. GLBP protects data traffic from a failed router or circuit, such as HSRP, while allowing packet load sharing between a group of redundant routers. Methods for load balancing with HSRP and VRRP work with small networks, but GLBP automatically allows for first-hop load balancing on larger networks.

Unlike HSRP, GLBP provides for load balancing between multiple redundant routers—up to four gateways in a GLBP group. It balances the load by using a single virtual IP address and multiple virtual MAC addresses. All the hosts are configured with the same virtual IP address, and all routers in the virtual router group participate in forwarding packets. By default, all routers in a group forward traffic and do load balancing automatically. GLBP members communicate between each other through hello messages sent every 3 seconds to the multicast address 224.0.0.102, User Datagram Protocol (UDP) port 3222.

Benefits of GLBP include the following:

• Load sharing: GLBP can be configured in such a way that traffic from LAN clients can be shared by multiple routers.

• Multiple virtual routers: GLBP supports up to 1024 virtual routers (GLBP groups) on each physical interface of a router.

• Preemption: GLBP enables you to preempt an active virtual gateway with a higher-priority backup.

• Authentication: Simple text password authentication is supported.

VSS

Virtual Switching System (VSS) solves the Spanning Tree Protocol unused blocked links problem by converting the distribution switching pair into a logical single switch. With VSS, the physical topology changes because each access switch has a single upstream distribution switch rather than having two upstream distribution switches. The bundled access switch pair is called a Multichassis EtherChannel (MEC), and it creates a loop-free topology eliminating Spanning Tree Protocol. VSS is configured only on Cisco 4500, 6500, and 6800 Series switches.

In Figure 7-8, the two switches are connected to each other via virtual switch links (VSLs), which makes them seem like a single switch. The key benefits of VSS include the following:

• Layer 3 switching toward the access layer

• Simplified management of a single configuration of the VSS distribution switch

• Better return on investment (ROI) via increased bandwidth between the access layer and the distribution layer

• No need to configure an FHRP such as HSRP or VRRP

Load Balancing

Most IP routing protocols can balance loads across parallel links that have equal cost. Use the maximum-paths command to change the number of links over which the router balances for IP; the default is four, and the maximum is six. To support load balancing, keep the bandwidth consistent within a layer of the hierarchical model so that all paths have the same cost. (Cisco Enhanced Interior Gateway Routing Protocol [EIGRP] is an exception because it can balance loads across multiple routes that have different metrics by using a feature called variance.)

A hop-based routing protocol does load balancing over unequal-bandwidth paths as long as the hop count is equal. After the slower link becomes saturated, packet loss at the saturated link prevents full utilization of the higher-capacity links; this scenario is called pinhole congestion. You can avoid pinhole congestion by designing and provisioning equal-bandwidth links within one layer of the hierarchy or by using a routing protocol that takes bandwidth into account.

IP load balancing in a Cisco router depends on which switching mode the router uses. Process switching balances loads on a packet-by-packet basis. Fast, autonomous, silicon, optimum, distributed, and NetFlow switching do load balancing on a destination-by-destination basis because the processor caches information used to encapsulate the packets based on destination for these types of switching modes.

Increasing Campus Availability

In addition to facilitating load balancing, redundant routes increase network availability.

You should keep bandwidth consistent within a given design component to facilitate load balancing. Another reason to keep bandwidth consistent within a layer of a hierarchy is that routing protocols converge much faster on multiple equal-cost paths to a destination network.

By using redundant, meshed network designs, you can minimize the effect of link failures. With such designs, depending on the convergence time of the routing protocols, it is unlikely that a single link failure will have a catastrophic effect.

You can design redundant network links to provide a full mesh or a well-connected partial mesh. In a full-mesh network, every Layer 3 switch has a link to every other Layer 3 switch, as shown in Figure 7-9. A full-mesh network provides complete redundancy and provides good performance because there is just a single-hop delay between any two campus sites. The number of links in a full mesh is n(n − 1)/2, where n is the number of routers. Each switch is connected to every other switch. A well-connected partial-mesh network provides every switch with links to at least two other routing devices in the network.

A full-mesh network can be expensive to implement because of the number of links required. In addition, groups of Layer 3 switches or routers that broadcast routing updates or service advertisements have practical limits in terms of scaling. As the number of routing peers increases, the amount of bandwidth and the CPU resources devoted to processing broadcasts increase.

A suggested guideline is to keep broadcast traffic at less than 20% of the bandwidth of each link; this amount limits the number of peer routers that can exchange routing tables or service advertisements. When designing for link bandwidth, reserve 80% of the bandwidth for data, voice, and video traffic so that the rest can be used for routing and other link traffic. When planning redundancy, follow guidelines for simple hierarchical design.

Figure 7-10 illustrates a classic hierarchical and redundant campus enterprise design that uses a partial-mesh design between switches rather than a full-mesh topology.

The following are oversubscription design recommendations:

• When implementing data oversubscription, the recommended practice is for 20-to-1 oversubscription for access-to-distribution links.

• For distribution-to-core, the oversubscription recommendation is 4 to 1.

• You can increase bandwidth by adding more links and aggregating them. Between the campus, these links can be 10 Gigabit Ethernet or 40 Gigabit Ethernet fiber links.