Hi experts,

Thank you for your idea and suggestion.

For the design A, some enhancements would be deployed to improve the design as below:

- Avoid using VLAN 1 to be the user or server VLAN

- Uplink port would be Giga ethernet

- The uplink cable is Fiber cable, MMF interface would be considered to order

- OSPF would be configured for internal routing protocol.

The advantage of design A should have:

- Improved convergence.

- Traffic load balancing .

- single set of troublshooting.

- simplified multicast config and single control plane

For the design B, some enhancements would be deployed to improve the design as below:

The advantage of design B should have:

- Avoid using VLAN 1 to be the user or server VLAN

- Uplink port would be Giga ethernet

- The uplink cable is Fiber cable, MMF interface would be considered to purchase

- "Channel-group" would be considered to deploy for increasing the bandwidth of uplink trunks

- ethernet channel would be consider to deploy for availability

- OSPF would be configured for internal routing protocol.

Besides, there are some issues would like to clarify with experts. Grateful if you would have any idea or suggestion

Design A

1. Should the VTP be enabled to sync the VLAN DataBase between two core switches?

2. If all VLAN would be configured on all access switch 2960, there are many uplinks to core switch for same VLAN communication. How to address this issue to combine the uplinks to two or three ports only?

3. What is the disadvange of design A?

Design B

4. For the design B, could VLAN 3 be configured on different two or three access switches (e.g. c2960-01, c2960-02, c2960-03)? If so, how does the c2960-01 know that some hosts within VLAN 3 to be in c2960-02? From my understanding, the traffic, which goes to trunk port, should be the inter-vlan traffic outside VLAN3.

e.g. C2960-01 VLAN2 and VLAN3

C2960-02 VLAN3 and VLAN4

C2960-03 VLAN5 and VLAN3

5. What is the advange of design B?

6. What is the disadvange of design B?

7. For the network security, the active VLAN would be specified. If one new VLAN would be added to the network, have the configuration of all 2960 and 4503 to be modified otherwise the existing vLAN could not communicate with the hosts which are sitting on the new VLAN? Any idea to tackle this issue? to achieve the min administration work and adequate network security to avoid unauthorize network equipment to be connected the network easier.

Design A and Design B

8. Would the flex link be deployed to design A or B? if so, the spanning tree L2 protocol should be disabled. Any advantage of Flex link?

9. If load share (or balance) is one of the requirement, what protocol should be implemented? which design component would be added? related configuration or URL is much welcome

Your help is much appreciated

rdgs

Anita

It's quite difficult to say what the best design is because you haven't given any requirements but from the devices you are using some things can be said.

Firstly you cannot use L3 from the access-layer as Mohammed suggested simply because the 2960 is not a L3 switch so you will have to run L2 uplinks from the

access-layer.

Also as Brian pointed out the second design simply isn't possible because a 2960 switch cannot support multiple L3 vlan interfaces and route between them.

Since you have 2960 in the access-layer you will not be running a routing protcol from the access-layer. So when you write -

"The advantage of design A should have:

- Improved convergence.

- Traffic load balancing .

- single set of troublshooting.

- simplified multicast config and single control plane"

i'm not sure entirely what you mean. OSPF will only be running between the 2 4500 distribution switches and will not extend to the access-layer.

You should definitely run trunks from the 2960 switches to the distribution switches. The reason being that you will need at least 2 vlans per 2960 switch. I say at least because again we don't have any requirements but at a minimum

1) One vlan for clients - data

2) One vlan for managing the 2960 switch

optionally you may need a further vlan for voice if you are going to be running VOIP to clients.

VTP - you have 2 options -

1) the 4500 switches are both VTP servers and the 2960 switches are VTP clients. Advantage is you only need to update one of the 4500 switches and the changes will be propogated to all other switches. Disadvantage is you can accidentally overwrite the vlan database of all switches when you introduce a new switch.

2) You can make all the switches VTP transparent. Advantage and disadvantage the opposite of 1).

It's not going to make a huge difference which one you use.

As for uplinks. You should look to uplink each 2960 switch to both 4500 switches. Each uplink would be a L2 trunk. Because of STP one of the uplinks will block per vlan. Lets assume you have 1 data vlan and a management vlan per 2960. If you want to use utilise both links for the data vlan then you can

1) etherchannel but then you have to send both links to the same 4500 and if that 4500 goes down you have lost connectivity.

2) You could use a L3 link between the 4500 switches. Then both uplinks can be used. This is a perfectly valid design choice and maximises the bandwidth from the 2960 switches.

3) Joseph makes a very valid point however about 3750 switches in a stack instead of the 4500s. If you use a 3750 stack you can then create an etherchannel from the 2960 switches and use cross-stack etherchannel on the 3750 switches which means you have an etherchannel going to both 3750 switches.

If you decide to have multiple data vlans per 2960 you can actually use of the links for one vlan and the other link for the other vlan etc. This is done by setting the STP root on the relevant 4500 and matching it to the HSRP active gateway.

Design B just won't work as previously said.

As for standard procedures -

1) Do not use vlan 1 for anything

2) On the L2 trunks set a specific vlan to the native vlan. This vlan should not be used for any end devices and it does not need a L3 SVI because the native vlan never needs routing

3) Allocate another vlan which does not have a L3 SVI and assign any unused ports into this vlan and shut down those ports.

4) The management vlan for the switches should be a dedicated vlan that is only used for managing the switches.

To further secure your switches use this white paper as a starter -

http://www.cisco.com/en/US/solutions/collateral/ns340/ns517/ns431/ns17/networking_solutions_whitepaper0900aecd80459628.html

Having said all that, the above is really very generic information. As i initially said without knowing what your requirements are that's all it can be.

Jon

Mohamed

"However, you mentioned the OSPF should be running between the distribution 4503 series, but the design (Routed Access design) illustrates the opposite as they clearly pointed out the routing including OSPF or Eigrp to be running between the access layer to the distribution layer as well."

Agreed. My comment about OSPF/EIGRP only running between the 4500 switches as referring to Anita's setup and not a generic L3 routed access-layer.

You are quite right that in a routed access-layer OSPF/EIGRP is used not only in the distribution layer but also extends to the access-layer.

Jon

Hi,

Thank you for your valuable idea and suggestion.

However, some points would like to clarify and the real meaning what it is:

---- Jon ----

2) On the L2 trunks set a specific vlan to the native vlan. This vlan should not be used for any end devices and it does not need a L3 SVI because the native vlan never needs routing

3) Allocate another vlan which does not have a L3 SVI and assign any unused ports into this vlan and shut down those ports.

4) The management vlan for the switches should be a dedicated vlan that is only used for managing the switches.

----- end of message -----

Does above message respond following question?

------ Anita's question -----

Design B

4. For the design B, could VLAN 3 be configured on different two or three access switches (e.g. c2960-01, c2960-02, c2960-03)? If so, how does the c2960-01 know that some hosts within VLAN 3 to be in c2960-02? From my understanding, the traffic, which goes to trunk port, should be the inter-vlan traffic outside VLAN3.

e.g. C2960-01 VLAN2 and VLAN3

C2960-02 VLAN3 and VLAN4

C2960-03 VLAN5 and VLAN3

-------- end of question -----

If yes,

Item 2, grateful if you could elaborate it, example is much appreciated

Item 3, grateful if you could elaborate the first part, I understand the unused ports to be shutdown.

Item 4, the management VLAN is native VLAN, isn't it? if not, grateful if you could elaborate it

Besides, could the 2960 switch (c2960-01) pass the local VLAN traffic (e.g. VLAN3) to another 2960 switch (c2960-02) which the same vlan (VLAN3) was configured via the trunk port inbetween the L3 switch (core switch)?

Grateful if you could advise on following:

8. Would the flex link be deployed to design A or B? if so, the spanning tree L2 protocol should be disabled. Any advantage of Flex link?

9. If load share (or balance) is one of the requirement, what protocol should be implemented? which design component would be added? related configuration or URL is much welcome

Thank you very much

rdgs