Inter VLAN Routing CPU

[ITGURU]

I've noticed that when machines have our core switch IP set as their default gateway to access devices/systems on all VLANs the core switch increases CPU usage drastically.

We only have 6 VLANs, however when the workstations are set to use edge router the core switch CPU idles 40-45%, however as soon as change a workstation gateway to the core switch IP it increases 60-85& (peak) even when idling and not accessing anything on the VLAN.

Is this normal to be that high?

[3s-gtech]

Is tour core switch doing the inter-VLAN routing? Do you have another switch acting as router to a WAN?

[ITGURU]

Is tour core switch doing the inter-VLAN routing? Do you have another switch acting as router to a WAN?

 

yes the core is doing the intervlan routing as have no access to edge cisco router, which connects to the WAN.

[3s-gtech]

Why are you setting the core as the gateway, in that case? It’s doing an awful lot of work, which is why the CPU usage is going up.

[ITGURU]

Why are you setting the core as the gateway, in that case? It’s doing an awful lot of work, which is why the CPU usage is going up.

 

So i can access network devices on all the VLANs from my management workstation and is up 100% of the time rather than doing the routing on an edge switch.

Thats typically where L3 routing should be taking place, if i cannot do it on the edge WAN router.

[psydii]

That seems odd? We have a lot of vlans (and acls and spanning tree), the core is the default gateway for everything (except the edge router/firewall system where it gets more complex), and CPU utilisation is in the 40-60% range, and this does not appreciably alter even when we are saturating our larger inter-switch connects with updates/images etc.

 

What switch do you have for the core? Is it suitable for its role? Is its firmware up to date? Might you actually have some sort of loop on your hands?

[ITGURU]

I am using STP but no loops visible from traffic monitoring. It does fluctuate at time though. Its a pure L3 switch. Will at some point disconnect some links, see if makes any difference or whether purely because workstation is using it as its gateway.

[FragglePete]

We've got a Ye Olde HP Procurve 5406ZL at our core where each has a VLAN has it's IP address at the core. Each VLAN uses this IP address as it's gateway. Been running like that for years and our CPU Utlization is up and down, but a couple of refreshes showed the highest at 37% and lowest at 2% - it chugs along quite happily.

 

Pete

[JRA]

We've got a Ye Olde HP Procurve 5406ZL at our core where each has a VLAN has it's IP address at the core. Each VLAN uses this IP address as it's gateway. Been running like that for years and our CPU Utlization is up and down, but a couple of refreshes showed the highest at 37% and lowest at 2% - it chugs along quite happily.

 

Pete

So sorry to hijack but is this a YE OLDE J8697A? Not an Aruba-flavoured ZL2 right?

 

How big is the network (roughly?) Reason I ask is I've been on the verge of swapping my (wheezy) Cisco small business switch core stack out for "old faithful" (a real OG ZL next to me) and this post is kinda persuading me I just might drag it out of retirement!

[FragglePete]

So sorry to hijack but is this a YE OLDE J8697A? Not an Aruba-flavoured ZL2 right?

 

How big is the network (roughly?) Reason I ask is I've been on the verge of swapping my (wheezy) Cisco small business switch core stack out for "old faithful" (a real OG ZL next to me) and this post is kinda persuading me I just might drag it out of retirement!

 

Yup, HP Switch 5406zl (J8697A) !! I know it's old, but it's like old faithful. It's on my to replace list when the budget allows. We have over the years replaced the 24x1Gb SFP Modules to 8x10Gb SFP+ Modules with 2nd hand units that the likes of SwitchShop have sourced for us.

 

Currently have around 540 desktops running, around 90 APs with Sixth Form and Staff BYOD Traffic along with around 75 Chromebooks, 46 x Printers/MFD's also, 120 VOIP Phones, etc. We have CCTV as well running but I generally sit that on it's own set of fibres bring that back to it's own core using a Unifi XG System but viewing of cameras the traffic certainly flows across the VLANs. We have about 12 VLANs in operation, mainly geographical reasons of the site.

 

I do need to update and did look at the ZL2 range as I believe you can use the same modules. But, I'm at capacity in terms of 10Gb Uplinks to edge switches and 10Gb Connections to the servers we've got connected to it.

 

Pete

[psydii]

I will deny everything but we have similarly old and faithful box. I have **no idea** where this screen shot came from.

 

[3s-gtech]

“But think of the firmware vulnerabilities! You’re basically murdering your students by using that!”

[PotNoodleTech]

FYI my old 5412ZL was superior in every datasheetmeasurement to the 48 port Aruba junk my LEA force installed in it's place. They're (were) a hell of a workhorse core switch and the reason I got one is because of the flexibility with the modules my schools is spread out over a large area with many buildings being able to fit a 10G ethernet module for the servers was great, then a 10gig fibre module for the building links was great, then a 48 port POE+ mnodule for the wifi points and phones great, and then the normal 48 port for PCs was great. Loved it. Miss it.

[JRA]

They're proper brutes. Had one at an old place, not a flicker out of it for the decade I was there, CPU barely broke a sweat. I think I looked at some DfE spec from a Connect the Classroom post and noticed it was only out on RAM as a qualifier! Still!

 

The 8x10gb modules for them are the pricey bit, but I saw a chassis with a couple of mixed modules go for a tenner last week.

 

Huge apologies @ITGURU for the nostalgia trip that just became there! Buy an old ZL?

[robintech]

“But think of the firmware vulnerabilities! You’re basically murdering your students by using that!”

 

 

There was surprisingly a HP Switch 5406zl (J8697A) firmware update on Oct 31, 2022 ( AOS-S Switch RA.16.04.0026 ) which is installed on ours, think it was purchased in 2006

[Norphy]

In the last MAT I worked for, I put in as many 5400ZL2s in as I could lay my hands on, both on the core and the edge, and I had a couple of the OG 5406s sitting in primary schools. Those are both fantastic switches.

[slugshead]

5406 at our core too.

 

Last school had a 5412 as the core. Started putting 5406's at the edge, redundant PSUs, modules to suit the buildings needs, all for cheaper than a CX6300 too.

[Primus]

We also love the 5400R zl2s too, fantastic value for money although they cannot be far off their end of sale date now sadly - then it's 5 years and after that no more firmware updates or warranty (depending on when you bought yours and which warranty Aruba fancy applying to it!)

[Roberto]

Used to fit those HP 5406 & 5412 switches when I worked in edu. They were absolute champions. Not sure where they are in their lifecycle now but very good, reliable bits of kit in my opinion.

[psydii]

Not sure where they are in their lifecycle now

We're at the "if we turn it off, we far from certain it will start again" stage. I've got a config set up to allow us to re-purpose a "modern" edge switch (a 2920!) to get us back up and running if the worst were to happen.

[Davit2005]

We run 4 HP 8200zl's soon to be replaced and have in excess of 300 vlans, intervlan routing, internal OSPF, 4 MSTP instances in a mesh topology. And we don't have any issues with Intervlan routing performance.

 

We do run a few 5400r's but none of these do intervlan routing at the moment.

 

I'm surprised you are struggling with 6 vlans. I would check out firmware too. Some firmware is known to show 100% utilization on ports falsely.

 

Do you have any ACLs on the switches?