Switch Redundancy

[timberdoodle]

In our production server rack we have a single Procurve 2910-48g that provides L2 switching for the entire VMWare infrastructure, appliances, the whole gamut. We just got a second switch so I can setup some redundancy. I am trying to figure out where to start.

Originally I was thinking VRRP (HSRP), that is not supported.
Now I am looking at Distributed Trunking.

Basically the purpose is to have our VMWare infrastructure NICs split 50/50 between the two switches. The other appliances I am not concerned about other than our route to the internet.

We have a Sonicwall NSA 5500 and multiple ISP drops. My thought was, have a port on each switch go to - for instance - X0,X1 on the firewall both configured as LAN. Sonicwall is obviously the SPOF but an Active/passive is not in the budget.

Thanks

 

[k1pp3r]

stack them and then setup etherchannel for your vmware boxes

Note: not sure if HP is called etherchannel, i'm using cisco 3750's so whatever HP's equiv is

 

[timberdoodle]

HP calls it trunking. Basically Distributed Trunking is the poor mans way of doing what you are talking about. It creates a link between two switches so you can share the VM hosts between switches.

 

[NetJunkie]

You don't need to trunk. Split the NICs across the two switches and just use Hash by Virtual Port ID (the default), Hash by Source MAC, or Load Based Teaming (if using Enterprise Plus and Distributed Switch). No port channel needed..no switch stacks needed. The only time you need to port-channel with VMware is if you do Hash Based on IP Address...which often isn't worth the hassle.

 

[timberdoodle]

You don't need to trunk. Split the NICs across the two switches and just use Hash by Virtual Port ID (the default), Hash by Source MAC, or Load Based Teaming (if using Enterprise Plus and Distributed Switch). No port channel needed..no switch stacks needed. The only time you need to port-channel with VMware is if you do Hash Based on IP Address...which often isn't worth the hassle.

Ok I'll give that a try. Looks like distributed trunking isn't supported anyhow on the 2910.

Any Sonicwall folks care to chime in on what I assume will be load balancing between two switches.

 

[timberdoodle]

Well that worked gangbusters. It is already default as you mentioned set to Route by virtual port ID which seems to work out of the box once a second switch is incorporated.

 

[Wrench00]

Ok I'll give that a try. Looks like distributed trunking isn't supported anyhow on the 2910.

Any Sonicwall folks care to chime in on what I assume will be load balancing between two switches.

Its tricky with a sonicwall. I have done only two sonicwall HA configs. I did try using a single sonicwall to two switches but I ran into problems. You actually need to configure the switches. I believe you need to use STP options to detect reduntant routes.

I use the 1910g and I use trunking in my vm cluster with STP.

 

[k1pp3r]

Its tricky with a sonicwall. I have done only two sonicwall HA configs. I did try using a single sonicwall to two switches but I ran into problems. You actually need to configure the switches. I believe you need to use STP options to detect reduntant routes.

I use the 1910g and I use trunking in my vm cluster with STP.

Thats why I love the ASA5510's in active/passive, they work like a champ with little config.

 

[Wrench00]

Thats why I love the ASA5510's in active/passive, they work like a champ with little config.

The thing is that having one firewall/router is still your problem. As far as I would be concerned this is still a single point of failure.
Its great that asa has this option but if that device fails you're still screwed.

You can just configure the switches to handle redundant routes but if the router fails your still in the same position.

I just would do two routers in HA mode. The sonicwalls work really good in that combo. Then you would have a trully redundant network. The second router also doesn't require any licensing all you need to purchase is HA Hardware which is much cheaper. I would just call sonicwall and find out.

 

[k1pp3r]

The thing is that having one firewall/router is still your problem. As far as I would be concerned this is still a single point of failure.
Its great that asa has this option but if that device fails you're still screwed.

Umm, I have two ASA 5510's in active/standby hooked to different switches in my stack, if the primary fails the standby unit assumes its IP and takes over.

 

[Wrench00]

Umm, I have two ASA 5510's in active/standby hooked to different switches in my stack, if the primary fails the standby unit assumes its IP and takes over.

Oh well you can do active/passive with two sonicwalls easily. you can also do active/active.

I thought you were referring to a single device having active/passive port. Made no sense to me.