OSPF and VLANs

[worldnews7]

Scope of Inquiry:

I've supported heterogeneous networks for merely a decade, but never quite big enough to expose me to Enterprise routing/switching concepts in real-time. I've supported numerous Metro Ethernet hub and spoke topologies, as well as a few racks in a datacenter environment ... however, once again ... no real application of OSPF, EIGRP, etc. 

I'm learning some of the fundamental concepts of OSPF, adjacency, LSA types, etc... but one thing that has me tripped up is whether or not/how VLANs would be leveraged in a real-world scenario, in an OSPF environment.

Can anyone kindly give me a very clear and concise explanation/high-level explanation of the contextual application of VLANs in an OSPF network, including whether or not tags would exist in each area, etc. * Please do not pontificate --- that is to overstate a simple explanation with extraneous details that are outside the scope of a basic/real-world explanation. Hope that wasn't too terse, but I'm trying to gain a working knowledge of the protocol and its nuances quickly. 

Thanks!

-Data-

[Peter Paluch · Accepted solution]

Hi Data,

To be concise, OSPF and VLANs are independent. OSPF has no idea on whether it runs over a LAN or a VLAN and it makes no difference to its operation. Likewise, a VLAN does not care what kinds of protocols are operated above it.

Whether VLANs would be leveraged in a real-world scenario in an OSPF environment - absolutely yes, they would, but the motivation is not the OSPF alone. Remember, each of these technologies is basically a tool with a specific purpose, and you as a network administrator choose and combine different tools to achieve different goals.

You would be using VLANs to virtualize a single physical switched network into several independent switched environments depending on how you intend to segment your network: different groups of users, different workgroups, different security contexts...

When you have segmented your switched network into VLANs, you have created a set of IP networks, one for each VLAN. And now, just like with normal physically independent networks, you need to collect the existing information about IP networks and communicate it to other routers, perhaps over the networks themselves, or through some other standalone links. This is what you use OSPF for. Forget about the fact that the networks are not built on standalone physical topologies but rather only on VLANs - OSPF does not see this and does not care.

Today's enterprise networks are built using multilayer switches and make heavy use of VLANs. Apart from hosting groups of end users, these VLANs may also serve specific purposes: allow remote management of active devices (so-called management VLANs), contain voice/video/multicast traffic, separate groups of servers or storage devices in data centers, etc. Each VLAN has a separate IP network space, and information about the IP networks has to be carried to all routers in your network. Therefore, a routing protocol is a must - OSPF is one of natural choices. The multilayer switches that are acting both as switches and routers at the same time would run OSPF and advertise the IP networks in the individual VLANs to other routers in the network.

I am not sure if this tackles the point but please feel welcome to ask further!

Best regards,
Peter

[worldnews7]

Peter,

Thank you kindly, I think I have a pretty solid understanding of the explanation ... and thank you Joseph, as well. 

If you gentlemen would be so kind, what would give me closure, or the ultimate context, would be a sample (physical topology). It seems like most of the resources out there speak to the logical topology, but not the physical topology. 

For a clearer understanding, could you give me a cursory explanation of the physical topology? In an Enterprise or ISP backbone? I'm generally familiar with SP, Campus, and Enterprise equipment (Juniper or Cisco), so you can throw in models for a theoretical scenario. I know it seems involved, but I would be greatly appreciative, and walk away with a better understanding of the physical. 

I guess my physical topology inquiry could be less nebulous, by starting (for example) with Area0. In (Area0), are the routers typically, geographically disparate? Or are they all sitting in a large datacenter separated by switches? I presume for a large entity, the NOC (or hub) is where Area0 resides, no? Or is spanning large geography immaterial with Fiber and MPLS, for a single Area0? 

Preface: I understand there will be certain performance implications, based on the variance ... 

Help me understand ... thanks!

[Joseph W. Doherty]

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

Hmm, don't know if I can briefly provide such a description.  Currently, I work in a large company (about 100,000 employees [with about 5,000 Enterprise switches and routers]) and my purview is about 10% of our Enterprise's switches and routers.  My sites range is size from just supporting a few hosts to thousands of hosts, equipment "sizes" range from Cisco 800 series ISRs, up to 6500s in VSS pairs.

From a VLAN standpoint, VLANs generally provide subnets for hosts which also range is size from a /29 up to a /23.  VLAN/subnets are defined principally for like hosts and sized for the number of like hosts.  However, generally like host VLANs/subnets are split into multiple like VLANs/subnets once you get up to about a /24.

A VLAN/subnet might only be hosted on one large chassis (4510 or 6509/6513) or it might be hosted on multiple L2 switches (2Ks/3Ks).  Generally (but not always) VLANs/subnets do not span multiple sites.

At the moment, all sites with a region, generally one or more adjacent US States, are grouped into the same OSPF area.  I.e. such a region might have 50 to a couple of hundred OSPF "routers" in the same area.

Originally area zero was used to tie the region areas together, but currently BGP is used with the WAN core (between regions).

OSPF, per area, of course has all the subnets being hosted by VLANs and also all the (numbered) p2p links (per region/OSPF-area networks can run into a couple of hundred).

LAN designs are generally just 1 or 2 layers, this because you can host so much on a large chassis or stack.  For example, at one of my larger sites, my user edge devices are 3 6509s with 96 port line cards.  As the users ports support both VoIP and data VLANs, a single data or VoIP VLAN spans two line cards (i.e. 192 ports).  So with 7 user line cards, the chassis hosts 4 data VLANs/subnets(/24) and 4 VoIP VLANs/subnets(/24).  As the 6509 has a L3 sup, the 8 chassis subnets are included in that device's OSPF router section and advertized to the rest of the OSPF area (via a dual gig, L3 Etherchannel, uplinked to a site core 6509 - the latter having two 10g SM off-site OSPF p2p fiber links).

At a small (old technology) branch, I might have a "ring" of several 2K series switches.  For routing I'll have some 3K switch with an off-site gig link and a connection to one of the 2K switches.  I might also have a small ISR with a VPN tunnel, for off-site, with a connection to a different 2K switch.  There will be one to several VLANs/subnets defined on the 2K switches and 3K switch.  The ISR will indirectly have access to the VLANs via .q subinterfaces.  The 3K and ISR provide the subnet getways and include the VLAN/subnets into OSPF.  The also generally will run HSRP for the VLAN/subnet gateway IP.

At a small (newer technology) branch, may have a L3 stack and an ISR.  One stack member has the high speed off-site gig link, the ISR connects to a different stack member.  However, the ISR now has a L3 routed p2p link to the L3 stack; there's no HSRP.  Yet, VLANs/subnets are pretty much as the above (paragraph).

Hopefully the above gives you a view into some real world, large scale, with VLANs and OSPF.

If you have additional questions, feel free to ask.

[worldnews7]

That my friend was a comprehensive answer. I'm rapidly learning, but have to get my enterprise chops up. This short dialog makes me realize that I need to get in the woodshed a bit more. Namely because I've been operating at my peak in the SMB space, and am still pursuing my break in the enterprise space. I'll be opening new threads for sure! Thanks again. 

Oh! Haha, I guess I forgot to ask the most important question of all:

At what point would you identify that an IGP, such as OSPF is necessary to implement. I was in an environment with a hub and spoke Metro Ethernet, with L3 switches at the perimeter of each site (of course with respective VLANs) --- and I recall there being a lot of turnover because the network wasn't being managed efficiently. At any rate, I recall the (then senior network engineer still a little green) suggesting that we implement OSPF (as it was a Juniper environment). Looking back, I wonder why that wouldn't of been necessary, with only 3-4 physical sites, and only a handful of L3 devices. Would there have been any benefit to that? And how does route summarization work with OSPF in tiny environments, where I presume we would have only had a Area0 ?

By now you guys are like: "Man, we really should have not responded to this dude."   :0

Thanks so much again!

-Data-

[Joseph W. Doherty]

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

When to use a IGP?  Well IMO, once you have more than one router.  ;)

With static routing, manual scalability becomes an issue early on depending on the topology of your network.  Consider even something as simple as 3 routers connected in a ring, each with only one interior network.  Each router may need four static routes for the two possible paths to each of of the other routers' interior network.  Do the router interconnections have different bandwidths, such that you need to also weight your routes?  Are the router interconnections such that if the link/path goes down the router "knows" it's down?  If an interior network goes down, do you still want to send traffic toward it?

But although I think an IGP is often worthwhile even in very small topologies, yes you can deal with half a dozen routers with static routing.  Also, static routing doesn't consume link bandwidth or router CPU like IGPs do.

With OSPF, you cannot do network (area) summarization with only a single area.  Even with multiple areas, there are "gotchas" with summarization or with stub areas.  However, if you really need multiple OSPF areas, you're probably going to need/want to summarize or use stub areas.

Keeping route tables small was helpful for keeping routing fast.  However with L3 switches and with something like CEF, large routing tables don't have the impact they once did for route forwarding.  However, you might bump into hardware resource limitations with large route tables and maintenance of a large route table, especially if the topology isn't stable, can be a resource problem too.  So, there are still good reasons to summarize routes.  For example, you might want to use a default toward the Internet rather than having all your internal routers carry all Internet routes (laugh).

[worldnews7]

Yes, yes, yes! This is the type of theory you don't find in most contemporary publications. Thank you kindly for all the feedback. 

So in a Metro Ethernet hub and spoke topology, where we had our Colo space (leased from ISP) --- then approximately 3 Metro spokes/sites hanging off it, we could of benefited from an IGP, such as OSPF? I'm just reiterating what you stated, but want to make sure I'm clear. When introducing OSPF, what would happen to the static routes? Depending on the vendor, I guess the static routes would have a lower preference and take precedence, no? Does that mean we'd have to kill all of the static routes first? Sorry for so many questions, it's like a light bulb is going off, and I'm full of inquiries.

Thanks again!

[Joseph W. Doherty]

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

For just 4 routers, especially if hub and spoke, static routing wouldn't be that difficult to maintain.  However, personally, I would still use a IGP.

Why?  Well say I wanted to add/change/delete a network at one branch.  With static routing, I may need to go to all the other routers and update their static routing configuration.  With an IGP, I just update the local router and it informs all the other routers.

MetroE could be a case where loss of end-to-end connectivity might not be seen with a down interface, if not, static routes will keep forwarding traffic toward the destination.  With a IGP, it will detect the logical break in connectivity.

If you were to transition from static routing to an IGP, such as OSPF, you could transition hitless by having both active during the transition.  (BTW, by default, statics are preferred over dynamic routes, but you can change ADs.)  However, you could also drop all the statics and configure an IGP.  "In-band", you would telnet from router to router; the routers "know" how to route across connected/shared networks.  The latter, though, will interrupt packet forwarding.

[worldnews7]

You are the man, Joseph! I'm 32, but want to be like you when I grow up ... hopefully that's not awkward ---- hehe.

Next question:

Can you describe how, why, and what happens when routes --- let's say from Internet residential subscriber ---- get passed to the CO (local ISP)?

What happens when a public (customer's) address hits the PE equipment/Gateway? 

Is that where the IGP masks the public address (such as OSPF NSSA), then routes it through the areas to an edge BGP router ---- finally to the next ISP/hop? 

If easier, you can describe it with EIGRP. I think this example would be super helpful! Thanks again for your patience. You're a good teacher. 

-Data-

[Craddockc]

Peter,

I know im about 4 years late to the game on this post but, are there any negative design considerations when using VLAN SVI's as the L3 interfaces in OSPF vs using physical L3 interfaces? VLAN SVI's dont typically go down unless all of the physical links carrying that VLAN go down, how can this fact impact OSPF operation?

Thanks.

[Joseph W. Doherty · Accepted solution]

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

VLANs, with dynamic routing, are generally "invisible" to the routing protocol, however they are often used to support a subnet.

For example, a router might have a connection to a switch port which is defined as an access port for a particular VLAN.  The router's port is defined with a IP and advertizes that network to the OSPF domain.

Or, a router is defined subinterfaces, tied to .Q tags.  The switch port (connected to the router) is defined as a trunk.  Each router subinterface has an IP.  Again, the router advertizes its interfaces subnets to OSPF.

Or, a L3 switch has both VLANs and VLAN interfaces defined on it.  The latter having IPs and being advertized to OSPF.

For the latter two cases, it's common to have multiple VLANs on a switch or switches.  In the first example, you could have a "dumb" switch, that cannot host multiple VLANs, yet a router could still have multiple subnets on that switch (or the same VLAN) using secondary addressing (normally avoided if you have VLAN capable switches).

I.e. normally, you have a VLAN per subnet that's larger than a /30.  However, you can have VLANs for /30s or /31s too.

[Peter Paluch · Accepted solution]

Hey Joe,

Didn't see your post as I was writing mine :) Good explanation!

Best regards,
Peter

[Joseph W. Doherty]

Peter, thank you for the compliment, and of course your explanation is your usual excellence.