01 / Campus
Collapsed core with HSRP on the STP root
IOS XE, Catalyst 9000
One building, two core switches, layer 2 to the access closets. The most common campus design there is, and the one most often built with the gateway and the spanning-tree root on different switches.
Layer 2 trunkPort-channelRoutedBlocked by STPKeepalive or out-of-band
The rules
- For every VLAN, the same switch is the spanning-tree root and the HSRP active gateway. If they differ, traffic crosses the inter-core link twice.
- Split the VLANs: odd VLANs on CORE-1, even on CORE-2, so both cores and both uplinks carry traffic.
- Set explicit STP priorities (4096 and 8192). Do not use the root primary macro.
- HSRP version 2, preempt with a delay so routing and the port-channel settle before the gateway moves back.
- Inter-core link is an LACP port-channel of at least two links on different line cards or stack members.
- Root guard on core downlinks, BPDU Guard and PortFast on every access edge port, explicit allowed VLAN lists on every trunk.
Addressing
| VLAN | Subnet | Gateway (VIP) | CORE-1 | CORE-2 | Root and active |
|---|---|---|---|---|---|
| 10 Users | 10.10.10.0/24 | .1 | .2 | .3 | CORE-1 |
| 20 Voice | 10.10.20.0/24 | .1 | .2 | .3 | CORE-2 |
| 30 Wireless | 10.10.30.0/23 | .1 | .2 | .3 | CORE-1 |
| 40 Printers | 10.10.40.0/26 | .1 | .2 | .3 | CORE-2 |
Config
CORE-1
spanning-tree mode rapid-pvst spanning-tree vlan 10,30 priority 4096 spanning-tree vlan 20,40 priority 8192 ! interface Vlan10 ip address 10.10.10.2 255.255.255.0 standby version 2 standby 10 ip 10.10.10.1 standby 10 priority 110 standby 10 preempt delay minimum 60 ! interface Vlan20 ip address 10.10.20.2 255.255.255.0 standby version 2 standby 20 ip 10.10.20.1 standby 20 priority 100 standby 20 preempt delay minimum 60 ! interface range TenGigabitEthernet1/1/1 - 2 channel-group 1 mode active interface Port-channel1 description CORE-2 switchport mode trunk switchport nonegotiate switchport trunk allowed vlan 10,20,30,40 ! interface range GigabitEthernet1/0/1 - 3 description Downlinks to access switchport mode trunk switchport nonegotiate switchport trunk allowed vlan 10,20,30,40 spanning-tree guard root
CORE-2
spanning-tree mode rapid-pvst spanning-tree vlan 20,40 priority 4096 spanning-tree vlan 10,30 priority 8192 ! interface Vlan10 ip address 10.10.10.3 255.255.255.0 standby version 2 standby 10 ip 10.10.10.1 standby 10 priority 100 standby 10 preempt delay minimum 60 ! interface Vlan20 ip address 10.10.20.3 255.255.255.0 standby version 2 standby 20 ip 10.10.20.1 standby 20 priority 110 standby 20 preempt delay minimum 60 ! port-channel and downlinks as CORE-1
Verify
show
show spanning-tree root show standby brief show etherchannel summary show interfaces trunk
Prove it before you sign it off
| Test | Expect |
|---|---|
| Compare the two outputs above | For each VLAN, the root bridge and the HSRP active router are the same switch. |
| Reload CORE-1 | CORE-2 becomes active for VLAN 10 and 30 when the 10 second hold time expires (default timers). Hosts keep the same gateway MAC. |
| CORE-1 returns | It takes back VLAN 10 and 30 after the 60 second preempt delay, not before. |
| Shut one Po1 member | Po1 stays up on the other link. No STP change. |
02 / Branch
Dual-WAN branch with a tracked default route
IOS XE, ISR and Catalyst 8000 routers
A branch router with a primary internet or WAN circuit and a cheaper backup. You want failover that notices when the provider is broken, not just when the cable is unplugged.
Layer 2 trunkPort-channelRoutedBlocked by STPKeepalive or out-of-band
The rules
- Probe something beyond the provider's router. Their router can answer while their network is down.
- Pin the probe address to ISP A with a host route, and add a Null0 host route behind it. Without the Null0 route the probe fails over to ISP B, succeeds, and the default route flaps back and forth.
- Damp the track with a delay: quick to fail (30 seconds), slow to return (60 seconds or more).
- The backup default route has a distance of 250 so it only appears when the tracked route is gone.
- NAT each provider with its own route-map matched on the outgoing interface, so traffic is translated to the address of the link it leaves on.
- Existing sessions break on failover because their NAT address changes. Tell the users, it is not a fault.
Addressing
| Item | Value | Note |
|---|---|---|
| ISP A link | 203.0.113.2/30 | next hop 203.0.113.1 |
| ISP B link | 198.51.100.2/30 | next hop 198.51.100.1 |
| Probe target | 192.0.2.53 | replace with a stable address you are allowed to ping |
| LAN | 10.20.0.0/24 | NAT inside |
Config
BRANCH-RTR
ip sla 10 icmp-echo 192.0.2.53 source-interface GigabitEthernet0/0/0 threshold 1000 timeout 1000 frequency 10 ip sla schedule 10 life forever start-time now ! track 10 ip sla 10 reachability delay down 30 up 60 ! ! pin the probe to ISP A, and drop it rather than reroute it ip route 192.0.2.53 255.255.255.255 203.0.113.1 ip route 192.0.2.53 255.255.255.255 Null0 250 ! ip route 0.0.0.0 0.0.0.0 203.0.113.1 track 10 ip route 0.0.0.0 0.0.0.0 198.51.100.1 250 ! ip access-list standard NAT-INSIDE permit 10.20.0.0 0.0.0.255 route-map NAT-ISPA permit 10 match ip address NAT-INSIDE match interface GigabitEthernet0/0/0 route-map NAT-ISPB permit 10 match ip address NAT-INSIDE match interface GigabitEthernet0/0/1 ! ip nat inside source route-map NAT-ISPA interface GigabitEthernet0/0/0 overload ip nat inside source route-map NAT-ISPB interface GigabitEthernet0/0/1 overload
Verify
show
show ip sla statistics 10 show track 10 show ip route 0.0.0.0 show ip nat translations | count .
Prove it before you sign it off
| Test | Expect |
|---|---|
| Normal running | track 10 is Up, the default route points at 203.0.113.1, SLA return code OK. |
| Block the probe upstream, or shut Gi0/0/0 | After about 30 seconds track 10 goes Down and the default route moves to 198.51.100.1. |
| ISP A recovers | The route returns 60 seconds after the probe succeeds again, not on the first reply. |
| Watch for flapping | show track 10 shows one change per event. Repeated changes mean the probe is escaping via ISP B. |
03 / Data centre and campus
Firewall transit /29 per VRF
IOS XE core with an HA firewall pair
A core switch routes several security zones (for example corporate, guest and payment) and every zone must reach the others and the internet only through a firewall pair. Each zone is a VRF with its own small transit network to the firewall.
Layer 2 trunkPort-channelRoutedBlocked by STPKeepalive or out-of-band
The rules
- One VRF per zone on the core, one transit VLAN and one /29 per VRF. Traffic between zones has no path except through the firewall.
- The same offsets in every /29: +1 core switch, +2 and +3 kept for a second core or HSRP later, +4 firewall virtual address, +5 FW-1, +6 FW-2. Anyone can find the firewall without a diagram.
- Each VRF has a default route to +4. The firewall routes the zone's subnets back to +1.
- Firewall-facing ports are trunks with negotiation off and only the transit VLANs allowed.
- Mark them as edge trunks. Firewalls do not run spanning tree, and a failover should not wait for STP to move a port to forwarding.
- Keep one numbering scheme for VLAN, VRF and subnet, so VLAN 902 is always the second zone and 10.255.1.8/29.
Addressing
| VRF | VLAN | Transit /29 | Core (+1) | FW VIP (+4) | FW-1, FW-2 |
|---|---|---|---|---|---|
| CORP | 901 | 10.255.1.0/29 | 10.255.1.1 | 10.255.1.4 | .5, .6 |
| GUEST | 902 | 10.255.1.8/29 | 10.255.1.9 | 10.255.1.12 | .13, .14 |
| PCI | 903 | 10.255.1.16/29 | 10.255.1.17 | 10.255.1.20 | .21, .22 |
Config
CORE
vrf definition CORP address-family ipv4 ! vlan 901 name TRANSIT-CORP ! interface Vlan901 description Transit to firewall, VRF CORP vrf forwarding CORP ip address 10.255.1.1 255.255.255.248 ! ip route vrf CORP 0.0.0.0 0.0.0.0 10.255.1.4 name FW-VIP ! ! users in VRF CORP interface Vlan10 vrf forwarding CORP ip address 10.10.10.1 255.255.255.0 ! ! repeat for GUEST (902, 10.255.1.8/29) and PCI (903, 10.255.1.16/29) ! interface range GigabitEthernet1/0/47 - 48 description FW-1 and FW-2 switchport mode trunk switchport nonegotiate switchport trunk allowed vlan 901-903 spanning-tree portfast edge trunk
Verify
show
show vrf show ip route vrf CORP 0.0.0.0 show ip arp vrf CORP 10.255.1.4 ping vrf CORP 10.255.1.4 source Vlan10
Prove it before you sign it off
| Test | Expect |
|---|---|
| ARP for the VIP | One MAC for 10.255.1.4, owned by the active firewall. |
| Fail the firewall over | The VIP moves to FW-2. The core ARP entry updates from gratuitous ARP and pings lose at most a few packets. |
| Traceroute from a GUEST host to a CORP host | The second hop is the firewall (10.255.1.12). The core has no direct route between zones. |
| show spanning-tree interface Gi1/0/47 detail | The port is in the portfast edge trunk mode, and forwarding. |
04 / Data centre
vPC pair with dual-attached access
NX-OS, Nexus 9000
Two Nexus switches act as one for the devices below them, so every server or access switch has an active-active port-channel with no blocked links.
Layer 2 trunkPort-channelRoutedBlocked by STPKeepalive or out-of-band
The rules
- The peer keepalive never runs over the peer-link. Use mgmt0 in the management VRF or a dedicated routed link.
- Peer-link: at least two links on different modules, a trunk, spanning-tree port type network.
- peer-gateway, so hosts that reply to the physical MAC of the other switch are still routed locally.
- peer-switch with the same STP priority on both, so the pair appears as one root.
- auto-recovery and delay restore, so a single switch coming back on its own still brings its vPCs up, and routing converges before they forward.
- Use the same number for the vPC and the port-channel. Dual-attach everything, or orphan ports lose service when the peer-link fails.
Addressing
| Item | N9K-1 | N9K-2 | Note |
|---|---|---|---|
| mgmt0 (keepalive) | 192.168.0.1/24 | 192.168.0.2/24 | VRF management |
| Role priority | 10 | 20 | lower is primary |
| STP priority | 4096 | 4096 | same, with peer-switch |
| Vlan10 gateway | 10.30.10.2 | 10.30.10.3 | HSRP VIP .1, both forward |
Config
N9K-1
feature lacp feature vpc feature interface-vlan feature hsrp ! spanning-tree vlan 1-3967 priority 4096 ! vpc domain 10 role priority 10 peer-keepalive destination 192.168.0.2 source 192.168.0.1 vrf management peer-switch peer-gateway auto-recovery ip arp synchronize delay restore 150 ! interface port-channel1 description vPC peer-link switchport mode trunk spanning-tree port type network vpc peer-link interface Ethernet1/49-50 channel-group 1 mode active ! interface port-channel20 description ACCESS-1 switchport mode trunk switchport trunk allowed vlan 10,20 vpc 20 interface Ethernet1/1 channel-group 20 mode active
N9K-2
! as N9K-1, with these differences vpc domain 10 role priority 20 peer-keepalive destination 192.168.0.1 source 192.168.0.2 vrf management
Verify
show
show vpc brief show vpc consistency-parameters global show vpc orphan-ports show port-channel summary
Prove it before you sign it off
| Test | Expect |
|---|---|
| show vpc brief | Peer status: peer adjacency formed ok. Keepalive: peer is alive. Every vPC shows consistency success. |
| Shut one access uplink | Po20 stays up on the other switch. No STP topology change. |
| Fail the peer-link with the keepalive up | The secondary suspends its vPC ports and SVIs. Dual-attached devices carry on through the primary. |
| Reload N9K-1 | N9K-2 keeps forwarding and takes the primary role. vPCs come back on N9K-1 after delay restore. |
05 / Management
Out-of-band management in Mgmt-vrf
IOS XE, Catalyst 9000
You want to reach and manage every switch even when the production network is broken, and keep management traffic away from user VLANs.
Layer 2 trunkPort-channelRoutedBlocked by STPKeepalive or out-of-band
The rules
- Gi0/0 on Catalyst 9000 is fixed in Mgmt-vrf. It cannot carry user traffic or join a port-channel, so it is ideal for management and useless for anything else.
- Mgmt-vrf has its own default route. The global default route does not apply to it.
- Every service needs its VRF or source interface set: TACACS+, syslog, NTP, SNMP and file copies all default to the global table.
- The VTY access-class needs vrf-also, or SSH arriving through Mgmt-vrf is refused.
- Add a console server on the same out-of-band network for the day the switch will not boot.
- Put a firewall between the OOB network and everything else. It is the keys to the building.
Addressing
| Item | Value | Note |
|---|---|---|
| OOB subnet | 10.250.1.0/24 | gateway .1 on the management firewall |
| Switch Gi0/0 | 10.250.1.11 | one address per switch |
| Services | 10.250.0.0/24 | TACACS+ .5, syslog .20, NTP .10, SNMP .30 |
Config
CAT9K
interface GigabitEthernet0/0 vrf forwarding Mgmt-vrf ip address 10.250.1.11 255.255.255.0 no shutdown ! ip route vrf Mgmt-vrf 0.0.0.0 0.0.0.0 10.250.1.1 ! ip access-list standard MGMT-ONLY permit 10.250.0.0 0.0.255.255 line vty 0 15 access-class MGMT-ONLY in vrf-also transport input ssh ! tacacs server TAC1 address ipv4 10.250.0.5 key <key> aaa group server tacacs+ TACACS server name TAC1 ip vrf forwarding Mgmt-vrf ip tacacs source-interface GigabitEthernet0/0 ! logging host 10.250.0.20 vrf Mgmt-vrf logging source-interface GigabitEthernet0/0 vrf Mgmt-vrf ntp server vrf Mgmt-vrf 10.250.0.10 snmp-server host 10.250.0.30 vrf Mgmt-vrf version 3 priv NMS ip tftp source-interface GigabitEthernet0/0 ip ssh source-interface GigabitEthernet0/0
Verify
show
show ip route vrf Mgmt-vrf ping vrf Mgmt-vrf 10.250.0.5 show tacacs show ntp associations show logging | include Logging to
Prove it before you sign it off
| Test | Expect |
|---|---|
| SSH to 10.250.1.11 from the management network | Login works with a TACACS+ account. |
| Shut all production uplinks in a lab | SSH over Gi0/0 still works. That is the whole point. |
| test aaa group TACACS <user> <password> legacy | User successfully authenticated. |
| show logging | Shows logging to 10.250.0.20 (vrf Mgmt-vrf) with messages counted. |