Routing Redundancy - VRRP or Spare Switch

[Steve21]

Morning Guys,

 

Looking to get some more redundancy setup here for future proofing, and was wondering if we don't go the VRRP route e.g. 2x 5406ZLs which will cost a bit, is there any problem with just having say, a 2920 doing the main routing, and then a spare 2920 exact same config setup to plug in if the other blows up?

 

Will routing etc get upset by the change in MAC addresses on the switch?

 

As nice as VRRP would be to have, obviously 2x Chassis going to be a lot dearer than 2x 2920s (or another similar model)

 

Thanks,

Steve

[Domino]

That should be fine - however keep in mind at some point you're gonna want to use that switch for something else (it always happens with hardware spares) so at that point you lose redundancy.

 

it might also be worth putting in RANCID to automatically keep the config changes from the primary switch up to date Shrubbery Networks, Inc. - RANCID

 

We use it for all our switches/firewalls and it's saved our ass a few times.

[matt40k]

Sounds very wasteful. How often does your switches go wrong? If we're talking new switches, I've never had a core switch die that was in warranty, I've had ports stop working but so long as you've bought quality it won't take the whole thing down. The key seems to be quality, spare ports and support. Worse case scenario, switch dies, next day new one arrives. Believe it or not folks can survive a day without IT, even a high school! IMHO I'd prefer 1x 5406ZLs with dual PSU then 2x 2920, but hey, I'm no switch expert. I just know from experience you can end up chasing a mythical unicorn, the end-users won't notice the difference between netgear switch and all the bells and whistles Cisco setup. All they know is when it goes wrong and with a complex setup, you have more things that can go wrong.

[Steve21]

That should be fine - however keep in mind at some point you're gonna want to use that switch for something else (it always happens with hardware spares) so at that point you lose redundancy.

 

it might also be worth putting in RANCID to automatically keep the config changes from the primary switch up to date Shrubbery Networks, Inc. - RANCID

 

We use it for all our switches/firewalls and it's saved our ass a few times.

 

Ah that's cool will take a look thanks

 

Sounds very wasteful. How often does your switches go wrong? If we're talking new switches, I've never had a core switch die that was in warranty, I've had ports stop working but so long as you've bought quality it won't take the whole thing down. The key seems to be quality, spare ports and support. Worse case scenario, switch dies, next day new one arrives. Believe it or not folks can survive a day without IT, even a high school! IMHO I'd prefer 1x 5406ZLs with dual PSU then 2x 2920, but hey, I'm no switch expert. I just know from experience you can end up chasing a mythical unicorn, the end-users won't notice the difference between netgear switch and all the bells and whistles Cisco setup. All they know is when it goes wrong and with a complex setup, you have more things that can go wrong.

 

The two server rooms are opposite ends though, so going to need 2 of something (10Gb Fibre links between the two required either way, taking VRRP out of it). (Well 3 but 3rd doesn't come into play for routing)

 

Two chassis would be ideal but obviously a lot of wonga for no benefit on a day to day basis Thus the wondering about the 2920s as cheaper and do pretty much everything the chassis does much cheaper. (Main idea being keep the "spare" one in the other server room so it's there if needed to plug in if the main one dies/breaks/burns etc)

 

Steve

[FN-GM]

Have you considered something like VSS (or HP equivalent) to stack the switches via your fibre cable? I know someone who does this with 2 Cisco 4500X switches and it works really well.

 

A couple of benefits to the stacking idea:

- Configuration is a much easier.

- No spanning tree issues

- Both switches will be routing and forwarding at the same time. VRRP works on an Active / Standby system.

- If you go for VRRP and you need to make configuration changes (new VLANS ACL's etc) you will need to do this on both switches manually. Stacking you don't

 

If you setup VRRP you will need to make sure your spanning tree is spot on. You will need to make sure the Master VRRP switch is the spanning tree root bridge. You will also need to make sure the backup will become the root bridge if the master goes offline. If you don't do this you will end up it simply not working. If you don't configure spanning tree by default it will use the device with the lowest mac address as the root bridge, this tends to be the oldest switch in the network. If you don't configure it you might end up with a old switch in cab being the root bridge. This will cause issues with VRRP.

Edited October 19, 2015 by FN-GM

[jamesfed]

How about looking at the 5400R zl2 series - they have dual management modules (like the 8200 series) so your only single point of failure (assuming you have dual port modules and dual power supplies) is the chassis which I've never seen fail.

[Steve21]

Have you considered something like VSS (or HP equivalent) to stack the switches via your fibre cable? I know someone who does this with 2 Cisco 4500X switches and it works really well.

 

A couple of benefits to the stacking idea:

- Configuration is a much easier.

- No spanning tree issues

- Both switches will be routing and forwarding at the same time. VRRP works on an Active / Standby system.

- If you go for VRRP and you need to make configuration changes (new VLANS ACL's etc) you will need to do this on both switches manually. Stacking you don't

 

If you setup VRRP you will need to make sure your spanning tree is spot on. You will need to make sure the Master VRRP switch is the spanning tree root bridge. You will also need to make sure the backup will become the root bridge if the master goes offline. If you don't do this you will end up it simply not working. If you don't configure spanning tree by default it will use the device with the lowest mac address as the root bridge, this tends to be the oldest switch in the network. If you don't configure it you might end up with a old switch in cab being the root bridge. This will cause issues with VRRP.

 

That's an interesting idea Didn't even know they could do that if I'm honest! Wonder what HPs equivalent is haha

 

Guess that means all 3 of the server rooms "could" be setup the same way too, or does it only work with 1 other device?

 

How about looking at the 5400R zl2 series - they have dual management modules (like the 8200 series) so your only single point of failure (assuming you have dual port modules and dual power supplies) is the chassis which I've never seen fail.

 

The main reason I was looking at 2 devices is our DR servers etc are in a separate server room so if the main one "breaks" majorly, e.g. fire/flood etc, it'd be wiped out and the DR not actually work as it's got no routing. (Bad design from the company that did it imho )

 

Thanks,

Steve

[FN-GM]

Guess that means all 3 of the server rooms "could" be setup the same way too, or does it only work with 1 other device?

 

You can only Virtual Stack 2 devices with Cisco, HP equivalent might be different. We have it here with Cisco, but they are next to each other not the other end of the building, it will work just the same way though. Although it will be more expensive as you are connection via 10GB fibre and not 10GB copper.

[matt40k]

The main reason I was looking at 2 devices is our DR servers etc are in a separate server room so if the main one "breaks" majorly, e.g. fire/flood etc, it'd be wiped out and the DR not actually work as it's got no routing. (Bad design from the company that did it imho )

 

I think your getting DR and Redundancy muddled up and the number of 9's required. Running fibre from each cabinet to two "server rooms" makes sense. If the main room gets burnt out, replacing switches can done with 24 hrs. Running fibre, yer, if you can get fibre runs done in week I'll be impressed. Generally you have a server room at one end and at the other you'll have the IT office and each cabinet will have fibre each. Backup media is stored in the IT office, the data is stored in the server room.

 

Running an extra fibre when installing it isn't that much extra, especially when you reduce your recovery time from well over a week to 1 day - it isn't something that needs upgrading for a very long time either. Buying another core switch is £££ and needs to be replaced regularly (ish), but it does reduce your recovery time to less then a day. If the school wants this recovery time, they should be finding you the cash.

 

IMHO if you want a true DR setup, build a backup site in Azure then buy a 4G router that can VPN to your Azure site

[win]

HP and some others offer a next day replacement service so i don't see the need for routing redundancy, unless you've got a super critical facility that can't go down. In saying that, i do have a spare older switch to swap out if needed while i wait for the replacement.

 

You could just leave an unpowered old switch under it so you just need to swap the cables over if it crashes.

[njc235]

Consider HPs 5800 series which connected with 10g fibre form a virtual chassis with active active links. Both (actually up to 9) switches are live which means that your DR area is on line as well. HPs IRF is becoming a common model in schools where the 10g dependency is growing. The 5800 has the added advantage of being at the top of HPs lifetime warranty range. Remove the single point of failure and have 2 or more active switches