VSS Deployement

Answered Question
Jan 15th, 2010

hi

I am planning to do attached deployment wherein i need the input from the expert.

without vss it seems little simple in which the connectivity between 4506-6509 will be dual uplink connectivty wherein stp will block one of the link (preferably link going towards HSRP Standby 6509 ) and both cat 6509 will run HSRP for the vlans configured in 4506.

for the connectivity between 6509-ASA5520 i can configure L3 subnets for all teh 4 links ospf can be configured and link cost can be manipulated for best paths.

now with vss i am confused on the configuration to be done for the link between 4506-6509.can i configure ether channel for teh 2 links going from 4506 to 6509 considering MEC in vss.what kind of configuration is recommended for the connectivty between 6509 and ASA 5520..

please suggest me teh best possible option as we will do the deployement in couple of days.

Attachment: 
I have this problem too.
1 vote
Correct Answer by Giuseppe Larosa about 6 years 10 months ago

Hello Sameer,

>> but it seems ordering alredy being done and consignment awaited  :-)

this is typical ordering done before network designer does his/her job.

1)  WS-6704 is not suitable for building VSS link because it lacks an ASIC chip for VSL protocol encapsulation

The 10-Gigabit Ethernet port can be located on the supervisor engine module or on one of the following switching modules:

WS-X6708-10GE-3C or WS-X6708-10GE-3CXL

WS-X6716-10GE-3C or WS-X6716-10GE-3CXL

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/vss.html#wp1053927

2)  I personally prefer BFD and fast hellos. My understanding is that a dedicated link is required but it doesn't need to be a 10GE link

To use the IP BFD detection method, you must provision a direct Ethernet connection between the two switches. Regular Layer 3 ping will not function correctly on this connection, as both chassis have the same IP address. The VSS instead uses the Bidirectional Forwarding Detection (BFD) protocol.

To use the dual-active fast hello packet detection method, you must provision a direct Ethernet connection between the two switches. You can dedicate up to four non-VSL links for this purpose.

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/vss.html#wp1063892

3) dual active detection doesn't need to run on all possible links, so the question about missing of support of enhanced PAGP on the ASA is not relevant.

I prefer BFD and IP fast hellos because they don't involve any external device, but just the two chassis that form the VSS pair.

According to other colleagues you can combine multiple methods of active detection for increased security.

see best practices

http://www.cisco.com/en/US/products/ps9336/products_tech_note09186a0080a7c837.shtml#vsl_llr

IP fast hellos requires Cisco IOS Software Release 12.2(33)SXI and           later.

Hope to help

Giuseppe

Correct Answer by Giuseppe Larosa about 6 years 10 months ago

Hello Sameer, Jon,

>> Option 2 is problematic because you have 2 inside interfaces per ASA and this can cause problems.

I agree, the ASA is versatile and has several router capabilities, but its main job is to be a firewall.

I had some doubts about option2 it might be technically possible but it would require tuning and increased complexity, but I see that Jon has the same opinion.

It does not pay off. Option 1 is a well know design that works and provide fault tolerance of link or node (one ASA or one chassis in the VSS)

Hope to help

Giuseppe

Correct Answer by Giuseppe Larosa about 6 years 10 months ago

Hello Sameer,

I've direct experience of ASA active/standby failover pair.

In this case a common subnet is required.

The two vertical links on VSS should be switchport in access mode on a specific vlan, with SVI ip address that is the next-hop for the ASA.

The L2 broadcast domain should be in common between the two chassis.

I don't think you can take advantage of MEC either L3 or L2 when interacting with ASA unless bundling is supported on ASA.

Also Active/Active just refers to the fact that in multicontext mode, contexts can be divided in failover groups and ASA1 can be active for failover-group1 and ASA2 can be active for failover-group2 but for a given context only one ASA is active:

>>

Active/Active Failover Overview

Active/Active failover is only available to adaptive security appliances in multiple context mode. In an Active/Active failover configuration, both adaptive security appliances can pass network traffic.

In Active/Active failover, you divide the security contexts on the adaptive security appliance into failover groups. A failover group is simply a logical group of one or more security contexts. You can create a maximum of two failover groups. The admin context is always a member of failover group 1. Any unassigned security contexts are also members of failover group 1 by default.

>> (end of text)

For the VSS the next-hop is the ip address of active ASA: HSRP is not needed on VSS side and not supported  on ASA side.

The ASA active/standby failover pair in case of failover the new active takes the ip address of active ASA, gratuioutus ARP is sent and ARP table of VSS should be updated.

We use these failover-groups but this would be needed only if multiple exit vlans are between the VSS and the ASA pair

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/ha_active_active.html#wp1080046

ASA should not support etherchannels see config chapter about interfaces

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/intrface.html

So as I wrote before vertical links should be layer2 ports in access mode (mono context) or L2 trunk (if multicontext is needed). L2 vlan(s) have L3 obejcts defined in VSS.

Hope to help

Giuseppe

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (3 ratings)
Loading.
Giuseppe Larosa Fri, 01/15/2010 - 01:31

Hello Sameer,

>> an i configure ether channel for teh 2 links going from 4506 to 6509 considering MEC in vss

this is the advantage of VSS over two standalone chassis

For connecting the ASA each ASA box needs to connect with one interface so it is reasonable to connect one to chassis1 and one to chassis2

Hope to help

Giuseppe

sameermunj Fri, 01/15/2010 - 01:47

Hi

So to confirm for the connectivity between  4506-6509 i can configure etherchannel (L2) at 4506 end.

now regarding ASA-6509 connectivity,you have mentioned only vertical links,so will they be a /30 point to point link.As the firewall will work in active staby mode i can have single ip at vss end and 3 ip's in ASA.(2 physical ip and single HSRP ip...192.168.1.1/29 for VSS interface.192.168.1.2/29 ASA1 interface ,192.168.1.3/29 ASA 1 physical interafce and 192.168.1.4 will be ASA HSRP IP.)...ASA will point route towards VSS ip for internal lan and VSS will point ASA hSRP ip as default route for outside network).

the proposed design includes cross links apart from the vertical links so will this design work anyhow or only option left is vertical links.As the design already shared with customer, if any option available with this please let me know.

Regards

Giuseppe Larosa Fri, 01/15/2010 - 03:31

Hello Sameer,

>> o will they be a /30 point to point link.

no, the IP subnet should be able to include both ASA ip addresses and VSS SVI address on vlan it cannot be a /30.

>> ASA will point route towards VSS ip for internal lan and VSS will point ASA hSRP ip as default route for outside network)

VSS should point to ip address of active ASA, they exchange ip addresses when changing role from active to standby. HSRP should be not supported by ASA.

hope to help

Giuseppe

sameermunj Sat, 01/16/2010 - 22:48

Hi Giuseppe

I have gone through the design doc for vss and its more clear now from the configuration perspective.for the connectivity between 4506-6509 i will configure Layer2 port channle in 4506 for the 2 ports going towards VSS bundle and at VSS end it will be Layer 2 MEC.i will cobnfigure access side vlan in VSS and it will work.

Regarding the connectivity between VSS -ASA there is a confusion.Here i can creare Layer 3 MEC or i can run routed link for this connectivity.i have couple of queries on the same for which i need your help.Please respond.

1==If i configure Layer 3 MEC in vss then i need to bundle both ports in each ASA.L3 Port channel in ASA 1 will have 1 subnet and L3 port channel in ASA2 will have diffrent subnet.i am not clear weather this config is supported in ASA or not but even if it supported for Actvie-Standby ASA setup both ASA should be in same subnet.Even if i configure all 4 links as /30 links instaed of L3 MEC the subnets between both ASA will be diffrent.

2==As mentioned by you if i have just vertical connectivty between VSS & ASA i am not clear on what will be the config in both devices.If i use diffrent /30 subnets for this connectivity then still i will have diffrent ip subnets in BOTH ASA which i think not supported for Active-Standby setup.

3=even if i go for Active-Active setup in ASA for the connectivity between VSS-ASA (Using L3 MEC or 4 /30 Routed links) on the public side of ASA where it will connecte to internet router throuh L2 Switch i cant make it active-Active and it has to be active-standby so that internet router will point towards HSRP ip of Public interface of ASA for internal LAN.Also for the Active Active setup on public side,if i go for the user tunnel over internet for this ASA i need to create 2 tunnel and in active-standby setup i would have done single tunnel with HSRP ip of Public interface of ASA.

I know its too long but i would be thankful if u clear my above queries.

Thanks in advance.

Sameer.

Correct Answer
Giuseppe Larosa Sun, 01/17/2010 - 02:08

Hello Sameer,

I've direct experience of ASA active/standby failover pair.

In this case a common subnet is required.

The two vertical links on VSS should be switchport in access mode on a specific vlan, with SVI ip address that is the next-hop for the ASA.

The L2 broadcast domain should be in common between the two chassis.

I don't think you can take advantage of MEC either L3 or L2 when interacting with ASA unless bundling is supported on ASA.

Also Active/Active just refers to the fact that in multicontext mode, contexts can be divided in failover groups and ASA1 can be active for failover-group1 and ASA2 can be active for failover-group2 but for a given context only one ASA is active:

>>

Active/Active Failover Overview

Active/Active failover is only available to adaptive security appliances in multiple context mode. In an Active/Active failover configuration, both adaptive security appliances can pass network traffic.

In Active/Active failover, you divide the security contexts on the adaptive security appliance into failover groups. A failover group is simply a logical group of one or more security contexts. You can create a maximum of two failover groups. The admin context is always a member of failover group 1. Any unassigned security contexts are also members of failover group 1 by default.

>> (end of text)

For the VSS the next-hop is the ip address of active ASA: HSRP is not needed on VSS side and not supported  on ASA side.

The ASA active/standby failover pair in case of failover the new active takes the ip address of active ASA, gratuioutus ARP is sent and ARP table of VSS should be updated.

We use these failover-groups but this would be needed only if multiple exit vlans are between the VSS and the ASA pair

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/ha_active_active.html#wp1080046

ASA should not support etherchannels see config chapter about interfaces

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/intrface.html

So as I wrote before vertical links should be layer2 ports in access mode (mono context) or L2 trunk (if multicontext is needed). L2 vlan(s) have L3 obejcts defined in VSS.

Hope to help

Giuseppe

sameermunj Sun, 01/17/2010 - 05:39

Hi Giuseppe

i think i have understood is clear and i have made it in the attached schematic as mentioned in option1 .its really clear now.

now only doubt is if i have cross links between vss and ASA can i use something mentioned in option 2 or only option 1 is only possible.

Anyway thanks for making it clear.

Sameer

Attachment: 
Jon Marshall Sun, 01/17/2010 - 11:29

sameermunj wrote:

Hi Giuseppe

i think i have understood is clear and i have made it in the attached schematic as mentioned in option1 .its really clear now.

now only doubt is if i have cross links between vss and ASA can i use something mentioned in option 2 or only option 1 is only possible.

Anyway thanks for making it clear.

Sameer

Sameer

Option 1 is the way to connect the ASAs to the 6500. That is a standard design and with option 1 you have failover and redundancy with the firewalls.

Option 2 is problematic because you have 2 inside interfaces per ASA and this can cause problems.

Jon

Correct Answer
Giuseppe Larosa Sun, 01/17/2010 - 14:08

Hello Sameer, Jon,

>> Option 2 is problematic because you have 2 inside interfaces per ASA and this can cause problems.

I agree, the ASA is versatile and has several router capabilities, but its main job is to be a firewall.

I had some doubts about option2 it might be technically possible but it would require tuning and increased complexity, but I see that Jon has the same opinion.

It does not pay off. Option 1 is a well know design that works and provide fault tolerance of link or node (one ASA or one chassis in the VSS)

Hope to help

Giuseppe

sameermunj Sun, 01/17/2010 - 21:07

Hi Giuseppe,Jon

your input is well taken and we are going ahaed with Option1 .Similar connectivity was previously proposed for outside interface (2 outside interface) with 2 l2 switches in between before finally terminated on 2951 Internet router

But now as per your input on inside interface,i ahve edited the design for outside interface (Schematic attached) also and i feel this should work.Like inside interface, ip address will be mentioned to outside interface and 2 hwic port on 2951 router will be part of same vlan and ip address will be given to interface vlan which will be next hop for ASA.

Between 2 Cat 2950 switches i have shown interconnectivity which i feel required.(shown dotted just to take your confirmation)

please confirm weather this will work or any change is required ???

thanks in advance.

Sameer

Attachment: 
Giuseppe Larosa Sun, 01/17/2010 - 22:00

Hello Sameer,

yes the link between the two C2950 L2 switches is needed and has to be in the same vlan (it may be a L2 trunk permitting  the outside vlan).

Two notes:

by using two HWIC ports on the C2951 (this looks like to be a new ISR2 ...) it takes part on STP for vlan outside_vlan.

This means that or one C2951 port will be in blocking or the link between the two C2951 will be in blocking state on one side, all depends from who is the root bridge.

Second note, that is the most important: this design contains a single point of failure that is the C2951, so overall design of this internet access is not fault tolerant.

You should consider to use two border routers and two internet links to achieve true fault tolerance.

ASA is able to support two default routes with different next-hops on the SAME interface, so this would not be a problem.

Hope to  help

Giuseppe

sameermunj Sun, 01/17/2010 - 22:38

Hi Giuseppe

I really agree with you on your input on Internet router but it seems ordering alredy being done and consignment awaited  :-)

lets see how i can take this forward.

Regarding VSS i have follwoing plan

1=VSL link i am planning with 1 10G port from Sup 720-10G and another port from 10G line card.I think this is the best practive.

2=On lan side i am connecting to 4506 and am doing L2 MEC for this connectivity so for Dual Active detection meachnism i can use Enhanced PagP as its supported on Cat-4506.Just let me know even after configuring Enhanced PagP do i need to consider IP BFD also.This will take 1 more 10G port from both chassis so if only Enhanced Pagp is sufficient, i wont go with IP BFD.

3=On VSS=ASA side i am just configuring those ports as Switch port and configuring interface vlan.i dont think enhanced Pagp support is there in ASA.what would be the ideal solution for this.shall i go ahaed for IP BFD which will server the purpose for vss==4506 as well as for VSS==ASA connectivity.

Regards

Correct Answer
Giuseppe Larosa Sun, 01/17/2010 - 23:36

Hello Sameer,

>> but it seems ordering alredy being done and consignment awaited  :-)

this is typical ordering done before network designer does his/her job.

1)  WS-6704 is not suitable for building VSS link because it lacks an ASIC chip for VSL protocol encapsulation

The 10-Gigabit Ethernet port can be located on the supervisor engine module or on one of the following switching modules:

WS-X6708-10GE-3C or WS-X6708-10GE-3CXL

WS-X6716-10GE-3C or WS-X6716-10GE-3CXL

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/vss.html#wp1053927

2)  I personally prefer BFD and fast hellos. My understanding is that a dedicated link is required but it doesn't need to be a 10GE link

To use the IP BFD detection method, you must provision a direct Ethernet connection between the two switches. Regular Layer 3 ping will not function correctly on this connection, as both chassis have the same IP address. The VSS instead uses the Bidirectional Forwarding Detection (BFD) protocol.

To use the dual-active fast hello packet detection method, you must provision a direct Ethernet connection between the two switches. You can dedicate up to four non-VSL links for this purpose.

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/vss.html#wp1063892

3) dual active detection doesn't need to run on all possible links, so the question about missing of support of enhanced PAGP on the ASA is not relevant.

I prefer BFD and IP fast hellos because they don't involve any external device, but just the two chassis that form the VSS pair.

According to other colleagues you can combine multiple methods of active detection for increased security.

see best practices

http://www.cisco.com/en/US/products/ps9336/products_tech_note09186a0080a7c837.shtml#vsl_llr

IP fast hellos requires Cisco IOS Software Release 12.2(33)SXI and           later.

Hope to help

Giuseppe

sameermunj Sun, 01/17/2010 - 23:55

Thanks for the Reply..

1)  WS-6704 is not suitable for building VSS link because it lacks an ASIC chip for VSL protocol encapsulation

==I think i missed this part.i have 8 port 10 G card (WS-X6708-10G-3C) which supports VSS.

2)  I personally prefer BFD and fast hellos. My understanding is that a dedicated link is required but it doesn't need to be a 10GE link

To use the IP BFD detection method, you must provision a direct Ethernet connection between the two switches. Regular Layer 3 ping will not function correctly on this connection, as both chassis have the same IP address. The VSS instead uses the Bidirectional Forwarding Detection (BFD) protocol.

To use the dual-active fast hello packet detection method, you must provision a direct Ethernet connection between the two switches. You can dedicate up to four non-VSL links for this purpose.

===This wil do. i have 48 port 10/100/1000 card which i can use for this connectivity.Now as per the guide i need to configure Layer 3 interface for IP BFD.I can dedicate 4 such interfaces with diffrent ip address on each interface.Now Fast hello is L2 technology so just want to confirm if on the same interface (which used for IP BFD) can i enable dual-active fast-hello  or should be unique interface for BFD & Fast Hello.

we have ordered for 12.2.33 sxh so seems fast hello will not be available in this.

so fast-hello is supported then i will enable all 3 majors (Enhanced PagP,IP BFD,Fast-Hello) for detecting Dual active detection.

sameermunj Mon, 01/18/2010 - 04:45

Hi jon

As per your suggesstion i am going ahead with Option 1 wherein each 6509-1 will connect to ASA by vertical links without any cross link..

i have small query on the same.As my access (4506) connected to both 6509 chassis and because of L2 MEC traffic will come to both 6509 switches.

As my forewall is in Active-Standby,link between 6509-2=ASA2 will not carry traffic so the traffic coming from Access to 6509-2 will traverse via 6509-1 to ASA 1 or any other option.

Please reply..

Jon Marshall Mon, 01/18/2010 - 05:05

sameermunj wrote:

Hi jon

As per your suggesstion i am going ahead with Option 1 wherein each 6509-1 will connect to ASA by vertical links without any cross link..

i have small query on the same.As my access (4506) connected to both 6509 chassis and because of L2 MEC traffic will come to both 6509 switches.

As my forewall is in Active-Standby,link between 6509-2=ASA2 will not carry traffic so the traffic coming from Access to 6509-2 will traverse via 6509-1 to ASA 1 or any other option.

Please reply..

Sameer

Correct in what you say. All traffic going to 6509-2 will have to traverse the link between the 2 6500 switches. You can't really avoid this unless you run active/active on your ASAs but bear in mind that active/active is a bit misleading. It does not mean that each context uses both firewalls. Per context it is still active/standby. It just means you have multiple contexts and have ASA1 active for some contexts and ASA2 active for other contexts.

Jon

Actions

This Discussion