Blade switch 3020 - server group / network group split

clausonna · ‎03-01-2007

The server / datacenter guys here are seriously looking at the HP c-Class blade system and the Cisco 3020 blade switches. I like the fact that the 16 internal ports remove the need for me to manually patch each individual bladeserver, but I'm concerned about the having to grant the server guys configuration access to the 3020's in order to allocate ports to blades.

Right now they have no access, not even read-only, to the server distribution switches (6509's), mostly because they've never needed to, and also because we don't trust 'em :-) (I'm not an admin on their servers, they're not admins on my switches!)

I intend on implementing the same features/functionality on the Cisco 3020 that we do on our other switches, including AAA TACACS+ authentication, QoS, trunking/uplink options, etc.

However, even after reading all of the documentation (both Cisco and HP) I'm not sure:

1) using the CLI, can I assign a switchport to a bladeserver, or is that only accomplished via the HP Virtual Connect (or other) GUI application?

2) Is it possible (using Cisco ACS via TACACS or RADIUS) to give the server admins Read-only access to the switchport config, and/or JUST the ability to modify which bladeserver maps to which internal port?

Is it possible/feasible to lock the server guys out of the 3020 entirely, and if so what are the downsides.

3) Is the 3020 supported via Ciscoworks LMS (RME config pulls, ios updates)?

Any experiences with the 3020, good or bad, would be greatly appreciated!

Thanks!

- Neil

fmeetz · ‎03-07-2007

3020 support Ciscoworks.

This URL should help you:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2284/products_getting_started_guide_book09186a00801f0e16.html

kcoley · ‎03-07-2007

Neil,

Let me answer your questions in order:

1) Yes, you can use the CLI to manange the CBS3020 including switchport assignment. The Virtual Connect GUI is only available on the HP Virtual Connect switch and not applicable on other modules. The CBS 3020 does have a web based GUI but it is only for initial configuration and device monitor. Cisco does provide a free Java based PC application that can manage up to 40 CBS3020 per group. You can download CNA 5.0 from www.cisco.com/go/networkassistant.

You can use TACACS or RADIUS to grant different levels of access per user. Unfortunately, not sure at what level you need in order to run the "config" command. Certainly setting a different password for "enable" mode is easy.

You can lock the server guys out by simply not giving them the enable password. You can also password the console port too. Some users do just that.

Nick Egloff · ‎03-08-2007

Neil -

We have exactly the same issue.

In addition, depending on the blades used, you could end up needing *4* switches to accomplish the same thing they used to do with 2 in the p-series.

AND, although I don't know why, HP never considered implementing some kind of 'stacking' along the backplane or even via some external cable, although that's been available since the 2950/3550 and is fully implemented in the 3750 series, so that eliminates possibilities for redundant uplinks across switches via etherchannel and a good backplane built-in among the different switches in the c-series chassis.

We haven't made a full decision yet, but I'm actually seriously thinking about NOT going with the 3020 and using either the new 3750s with the 10Gig uplinks and then the HP fan out panels instead of the 3020s, just because of the above reasons.

clausonna · ‎03-08-2007

Thanks for the input. I've fired off the same questions/concerns to our HP sales / sales engineering teams. I'll be sure to post any information that I get back.

On a side note, if you have access to the presentations from Cisco Networkers 2006 there's a great presentation called "DC-2603 - High-Density Server Farms". It covers the three different types of Cisco blades switches and the blade chassis architecture, as well as a whole section on virtualization.

jpthomsen · ‎06-01-2007

Howdy... We just went through this earlier this year. We also were perplexed as to why HP, with the pretty substantial internal backplane, would not have used a stacking system similar to the 3750's for the 3020 units. Ultimately, it seemed that the only benefit for us to using the internal switches was not having to do a lot of wiring. Since we were looking first and formost for a completely redundant setup, we went with 2x 3750's per cabinet and the pass-throughs for the HP C-class. After some good tests and such, it looks like the decision has paid off and frankly the cables in the DC look great from my desk... ;)

With our next setup we have again purchased the pass-throughs but will be evaluating another product supplied from Blade Technologies which essentially uses software to do (in short) what the 3750's do on the internal HP branded units. I may have more to comment after the eval, but honestly am very impressed with the 3750's performance in the areas of redundancy. We have no use for 10G however with 2x 3750's we have the ability to loop up to 8 ports into one 8GB etherchannel (4GB keeping redundant runs back to our COREs).

Hope this helps somewhat!

Cheers,

Jacob

rsohi · ‎05-30-2007

Hello, we have just implemented 3020's within the HP blade system. I will try to answer some of your questions from our experience.

1) The blade server are mapped internally to specific ports on the 3020. In our environment:

Each enclosure houses 4 Cisco 3020 switches. A server in the enclosure can have either 2 or 4 nics:

If the server is in slot 1 and it has two nics it connects nic1 to port 1 on switch 1, and nic2 to port 1 on switch 2.

If the server is in slot 5 and has four nics it connects nic1 to port 5 on switch 1, nic2 to port 5 on switch 2, nic3 to port 5 on switch 3, and nic4 to port 5 on switch 4 within the enclosure. It can get a little confusing.

2) Our group maintains for admin of these switches. We do not allow the server folks to have any access to them other than through the gui, which doesn't give them much info, and only used when the switches are intially installed. There is no way to change an assignment of switch ports they are internally mapped through the backplane as discussed in issue 1.

3) I have added the blade switches to CiscoWorks. However, it does not seem to supported under DFM (Device Fault Manager).

I hope this helps, If you require futher information don't hesistate to ask.

regards,

Raj

rsohi · ‎06-12-2007

Folks, here is a very good link to a doc that describes with excellent detail blade server intergration:

http://www.cisco.com/application/pdf/en/us/guest/netsol/ns304/c649/ccmigration_09186a00807ed7e1.pdf

regards,

Raj

Nick Egloff · ‎06-12-2007

Hey Raj -

Unfortunately, this only deals with the p-series directly; the questions in a good part of this thread (if not all) were more along the c-series line...

It's good from an "overview" direction, but there are a good number of changes in the c-series architecture which invalidate a number of the p-series "best practices"... at least from a network standpoint...

Thanks.

...Nick

rsohi · ‎06-12-2007

Hi Nick, yes I agree. I thought it might be of use from an Overview perspective. I should have stated that, agreed.

thanks,

Raj

kcoley · ‎06-18-2007

c-series follows the same guidelines as p-series.