Stacking switches Part - I (HPE IRF - Intelligent Resilient Framework)

Last couple of days I was busy configuring stacking of switches from different vendors. So, I thought it would be better to share my experiences and lessons that I have learned while configuring stacking technology from different network switch vendors. I will not go to the details of different stacking architectures, rather only try to cover how to configure them.

First in line is - HPE IRF (Intelligent Resilient Framework).

Let's define our network constraints; the example has following characteristics -  

  • The stack is consists of two (2) switches of same model and software version.
  • In each switch two (2) ethernet ports are used for stacking purposes.
  • The stacking ports in the switches are cross connected in ring topology.

The switches are connected as the diagram below - 

Fig 01 - HPE IRF with 2 switches

IRF allows stacking by using normal ethernet network ports, no special stacking ports are required. We have selected 2 forty gigabit ethernet ports (FGE 0/53 & FGE 0/54) and cross connected them.

SW-U01 will be the master switch and SW-U02 will be the standby switch.

Now we can start configuring the switches.

Let's configure our master switch which is SW-U01 first - 


SW-U01 (master) configuration commands

Administratively shut down the ports that are used for stacking.

[SW-U01]interface range FortyGigE 1/0/53 to FortyGigE 1/0/54
[SW-U01-if-range]shutdown


Make sure the switch has a member id of 1. By default every switch has a member id of 1.

[SW-U01]irf member 1 renumber 1


Set the IRF priority of the switch to highest, so that it becomes master when the stack is formed. Available priority values are 1 - 32, where highest values are preferred while determining the master switch in a IRF stack.

[SW-U01]irf member 1 priority 32


Now we will configure 2 IRF ports and assign one FGE interface to each IRF port.

[SW-U01]irf-port 1/1
[SW-U01-irf-port1/1]port group interface FortyGigE 1/0/53

[SW-U01]irf-port 1/2
[SW-U01-irf-port1/1]port group interface FortyGigE 1/0/54


Now we will enable the FGE ports that we have shutdown previously and save our configuration changes. Then reboot the switch.

[SW-U01]interface range FortyGigE 1/0/53 to FortyGigE 1/0/54
[SW-U01-if-range]undo shutdown
[SW-U01]save
[SW-U01]quit
<SW-U01>reboot


Now the most important command, activation of the IRF stacking feature. After this command the switch will try to from the stack actively.

[SW-U01]irf-port-configuration active


SW-U02 (standby) configuration commands

Administratively shut down the ports that are used for stacking.

[SW-U02]interface range FortyGigE 1/0/53 to FortyGigE 1/0/54
[SW-U02-if-range]shutdown

Assign the switch a member id of 2. By default every switch has a member id of 1.

[SW-U02]irf member 1 renumber 2


After that we need to save the configuration, and reboot the switch so that member id of 2 is activated for that switch.

[SW-U02]save
[SW-U02]quit
<SW-U02>reboot


After the reboot, the member id of the switch is 2, we can verify that by using following command, now all the interface numbering starts with the number 2.

[SW-U02]display interface brief
Brief information on interfaces in bridge mode:
Link: ADM - administratively down; Stby - standby
Speed: (a) - auto
Duplex: (a)/A - auto; H - half; F - full
Type: A - access; T - trunk; H - hybrid
Interface            Link Speed   Duplex Type PVID Description
FGE2/0/53            ADM  40G     A      A    1
FGE2/0/54            ADM  40G     A      A    1
GE2/0/1              DOWN auto    A      A    1
GE2/0/2              DOWN auto    A      A    1
GE2/0/3              DOWN auto    A      A    1


From now on, we will adress the switch with it's member id 2, while configuring remaining of the stacking configuration.

Set the IRF priority of the switch to lower than the master switch, so that it never becomes the master switch when the stack is formed. 

[SW-U02]irf member 2 priority 10


Now we will configure 2 IRF ports and assign one FGE interface to each IRF port.

[SW-U02]irf-port 2/1
[SW-U02-irf-port2/1]port group interface FortyGigE 2/0/53

[SW-U02]irf-port 1/2
[SW-U02-irf-port2/1]port group interface FortyGigE 2/0/54


Now we will enable the FGE ports that we have shutdown previously and save our configuration changes. 

[SW-U02]interface range FortyGigE 2/0/53 to FortyGigE 2/0/54
[SW-U02-if-range]undo shutdown
[SW-U02]save


Now we activate the IRF stacking feature. After this command the switch will try to from the stack actively. When we type this command, all slave switches reboots automatically and when the reboot is finished it joins the IRF stack. So, do not forget to save your configuration before typing the command the below.

[SW-U02]irf-port-configuration active


Verifying IRF configuration

What IRF does is that it makes a single virtual switch from those 2 physically connected switches and provides more ports and redundancy.  

The easiest way to verify a stack is formed is to type the "display interface brief" command, which groups together each switch interfaces with their member id. If interfaces from both switches are present that means the stack is formed.

<SW-U01>display interface brief
Brief information on interfaces in bridge mode:
Link: ADM - administratively down; Stby - standby
Speed: (a) - auto
Duplex: (a)/A - auto; H - half; F - full
Type: A - access; T - trunk; H - hybrid
Interface            Link Speed   Duplex Type PVID Description
FGE1/0/53            UP   40G     F(a)   --   --
FGE1/0/54            UP   40G     F(a)   --   --
FGE2/0/53            UP   40G     F(a)   --   --
FGE2/0/54            UP   40G     F(a)   --   --


To get basic information about the stack and it's members - like who is master/standby, priority etc.

<SW-U01>display irf
MemberID    Role    Priority  CPU-Mac         Description
 *+1               Master   32        7a8e-b6d3-0104  ---
   2                 Standby 10        7a8e-bc6b-0204  ---
--------------------------------------------------
 * indicates the device is the master.
 + indicates the device through which the user logs in.

 The bridge MAC of the IRF is: 7a8e-b6d3-0100
 Auto upgrade                : yes
 Mac persistent              : 6 min
 Domain ID                   : 0


To get info about IRF ports, which physical interface is assigned to that port and it's operational status, type the command below -

<SW-U01>display irf link
Member 1
 IRF Port  Interface                             Status
 1         FortyGigE1/0/53                       UP
 2         FortyGigE1/0/54                       UP
Member 2
 IRF Port  Interface                             Status
 1         FortyGigE2/0/53                       UP
 2         FortyGigE2/0/54                       UP


To get the topological information about IRF, use the command below - 

<SW-U01>display irf topology
                                          Topology Info
 -------------------------------------------------------------------------
                     IRF-Port1                                  IRF-Port2
 MemberID    Link       neighbor      Link       neighbor    Belong To
 1                    UP         2                  UP          2                7a8e-b6d3-0104
 2                    UP         1                  UP          1                7a8e-b6d3-0104


Further reading and reference

















Location: Sundsvall, Sweden

Comments

Post a Comment

Popular posts from this blog

Fortigate firewall AAA Configuration for management with TACACS+ protocol and Cisco ISE

Image
In this blog I will write about how to implement AAA services in Fortigate firewalls using Cisco ISE as an authentication server with TACACS+ protocol. First good to know our limitations. AAA means - Authentication (supported by ISE TACACS+), Authorization (partially supported by ISE TACACS+; Fortigate implements Admin-Profiles; so what a user can/cannot do is defined locally in the firewall with "Admin Profiles"; ISE just instructs the firewall to allocate one of those profiles), Accounting (not supported; instead configure syslog to get accounting data, Fortigate firewalls generate syslog messages for configuration changes made by a user). Let's jump to our configuration. Our topology is very simple; one Fortigate firewall and Cisco ISE server connected with the same management network which looks like below -  01 - Network Topology We have a management network 192.168.199.0/24. The firewall is at  .230  and Cisco ISE is at  .49  IP address. We are running the lates
Read more

Stacking switches Part - VI (Dell OS10 VLT - Virtual Link Trunking)

Image
In this blog I will configure MLAG (multi chassis link aggregation) for Dell OS10 switches. As every other vendor choses a fancy name of their implementation of MLAG; Dell is no exception to this. Dell calls their implementation VLT - Virtual Link Trunking . Let's look at our network topology - Two Dell OS10 switches will run peering between them and will run VLT/MLAG between them. Two Debian 10 linux machine will be connected with LACP bonding with both switches. They will simulate the client connection. Our topology looks like below - 01 - Dell OS10 VLT Topology Let's look at some terminology before configuration - VLT peer – The two switches participating in VLT are peer to each other. In a VLT domain a maximum of two switches are allowed. VLT interconnect (VLTi) – VLTi synchronizes state information between VLT peers. It synchronizes layer 2 and layer 3 control-plane information. These state/control-plane information includes MAC table, ARP table, IPv6 neighbors etc. VLT
Read more

Arista EOS AAA configuration for management with TACACS+ protocol and Cisco ISE (Part I)

Image
Today I will write about AAA configuration (SSH authentication, authorization and accounting) for Arista EOS switches with Cisco ISE as authentication server and AAA protocol will be TACACS . Our topology is very simple. One Arista switch and One Cisco ISE server is running on the same network. Our topology looks like below - 01 - Network Topology We have a management network 192.168.199.0/24. The switch is at .134 and Cisco ISE is at .49 IP address. We are running the latest version of ISE - version 3.0. Let's define our AAA requirements - Arista switches comes with two pre defined user roles - "network-admin" and "network-operator" . We will use those two roles. Every user after successful authentication from tacacs server (ISE), will be authorized as either "network-admin" or "network-operator" role. In turn these two roles will determine read-write or read-only access to the switch. N ote: With TACACS, we can also do individual cl
Read more