1. Home
  2. Cisco Systems
  3. 3750 load balancing over dual links with seperated VLAN's

3750 load balancing over dual links with seperated VLAN's

Hi,

I'm trying to setup a system which uses 2 transparent networks as WAN. All "routers" are Cisco 3750 and each location has 5 VLAN's. VLAN 1 is isolated, VLAN 2, 3, 4 and 5 can route to each other on the local 3750 stack. However: VLAN's 2, 3 and 4 should each have their own uplink to the transparent WAN's. So, for instance:

VLAN 2 goes out on Fa1/0/2 and Fa2/0/2 VLAN 3 goes out on Fa1/0/3 and Fa2/0/3 VLAN 4 goes out on Fa1/0/4 and Fa2/0/4

VLAN 1 and 5 are not to be routed over the WAN

I've made a small sketch of the system which can be seen at

formatting link
to clarify.

What I'd like to reach is that VLAN 3 at Location 4 goes out of Fa1/0/3 and Fa2/03 only, Fa1/0/3 goes directly to location 1 (the main location). Fa2/0/3 goes to location 2 (the backup main location) and then up the fiber to location 1. I don't want EIGRP to select routes on links not intended for that VLAN.

What I've done so far: I've enabled three EIGRP AS's. One for each of the VLAN's and assigned IP address to Fa1/0/2-4 and Fa2/0/2-4. They do find the appropriate neighbours, but if I unplug all links for VLAN

4, I can still connect to VLAN 4 on another location over the WAN.

I've tried setting ACL's to deny trafic between for instance Fa1/0/2 and VLAN 3 and 4, but was unsuccesfull (sorry, didn't keep the ACL test config). All it did was block VLAN routing on the location itself.

I've looked at setting the locations 3-5 as stub routers in EIGRP, but I'm not sure whether this should solve my problem.

Here's my (edited) config for the router in Location 4:

--------------------------------------------------------------------------------------------------------

version 12.2 no service pad service timestamps debug uptime service timestamps log uptime no service password-encryption ! hostname LOC4RTR ! enable secret 5 xxxxxxxxxxxxxxxxxxxxxxxxxx ! username xxxxxxx privilege 15 secret 5 xxxxxxxxxxxxxxxxxxxxxxxxxxxx no aaa new-model clock timezone CET 1 clock summer-time CET recurring last Sun Mar 2:00 last Sun Oct 3:00 switch 1 provision ws-c3750-24ts switch 2 provision ws-c3750-24ts system mtu routing 1500 ip subnet-zero ip routing ! ! mls qos ! ! no file verify auto spanning-tree mode pvst spanning-tree extend system-id ! vlan internal allocation policy ascending ! ! interface FastEthernet1/0/2 no switchport ip address 2.1.2.4 255.255.255.0 speed 10 duplex full flowcontrol receive desired ! interface FastEthernet1/0/3 no switchport ip address 2.1.3.4 255.255.255.0 speed 10 duplex full flowcontrol receive desired ! interface FastEthernet1/0/4 no switchport ip address 2.1.4.4 255.255.255.0 speed 100 duplex full flowcontrol receive desired ! interface FastEthernet2/0/2 no switchport ip address 2.2.2.4 255.255.255.0 speed 10 duplex full flowcontrol receive desired ! interface FastEthernet2/0/3 no switchport ip address 2.2.3.4 255.255.255.0 speed 10 duplex full flowcontrol receive desired ! interface FastEthernet2/0/4 no switchport ip address 2.2.4.5 255.255.255.0 speed 100 duplex full flowcontrol receive desired ! interface Vlan1 ip address 192.168.1.1 255.255.255.0 ! interface Vlan2 ip address 1.4.2.1 255.255.255.0 ! interface Vlan3 ip address 1.4.3.1 255.255.255.0 ! interface Vlan4 ip address 1.4.4.1 255.255.255.0 ! interface Vlan5 ip address 1.4.5.1 255.255.255.0 ! router eigrp 2 variance 2 network 2.1.2.4 0.0.0.255 network 2.2.2.4 0.0.0.255 network 1.4.2.1 0.0.0.255 maximum-paths 2 no auto-summary ! router eigrp 3 variance 2 network 2.1.3.4 0.0.0.255 network 2.2.3.4 0.0.0.255 network 1.4.3.1 0.0.0.255 maximum-paths 2 no auto-summary ! router eigrp 4 variance 2 network 2.1.4.4 0.0.0.255 network 2.2.4.4 0.0.0.255 network 1.4.4.1 0.0.0.255 maximum-paths 2 no auto-summary ! ip classless ip http server ip http authentication local ! ! ! control-plane ! ! line con 0 login line vty 0 4 login length 0 line vty 5 15 login ! end

---------------------------------------------------------------------------------------------------------

Thanks in advance for any help,

Marc Rietman

Reply to
rsoft
Loading thread data ...

l/network.jpgto clarify.

-------------------------------

--------------------------------

This just doesn't make much sense to me. What exactly are you trying to accomplish? It's definitely not load-balancing, as manually establishing hops like this is only going to limit you to one path or another, when you have 4 other ones that are perfectly good to use or load-balance, but you are effectively creating 3 WANs (1 for each vlan). Is this even a WAN, or is it a lab? I assume the latter since you mention 'transparent' WANs. Bottom line is that we need more information as to what your goals are before we get into how to engineer it. Policy-based routing is surely a great option to ensure different paths are used, but you seem to not want failover beyond what you have configured.....you are manually creating a routing protocol, and one that is inferior to the options you have today which could give you plenty of resiliency and aggregate bandwidth.

Reply to
Trendkill

the config looks like you are routing at each switch port such as Fa

1/0/2, since you have "no switchport". that port connects to the WAN, but you talk about connecting VLANs?

are you trying to get Layer 2 links across the WAN? - if so you probably want vlans trunked on each port, multiple spanning tree and alter the spanning tree costs to bias different vlans to different push.

If you want multiple IP networks that are isolated, then i suggest you run VRF-lite on each switch and then each switch can act as multiple separate routers. The flip side here is that you dont then get to have

1 big IP network.

Finally if you want 1 routed IP network, then a better way may be to load balance across the set of WAN links at each site - EIGRP can do that, although i find OSPF much easier to work with.

If you use session based load balance which is default then as long as there are a fair number of devices per site communicating you should get reasonable load balancing.

there is yet another approach based on policy routing. Set up 1 set of "normal" traffic paths using the routing protocol. Then use ACLs to pick out some traffic at each switch and divert that to a different WAN port (IP telephony traffic, or everything marked DSCP "EF" would be 1 possiblity). You need to be careful to only use ACLs that can be handled in hardware or the switch degrades to a 5k pps software based router.

Different ASes gives you different routing instances, but doesnt split the routing table on a single box on its own - controlling which routes go where can be painful.

Reply to
Stephen

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.