Cisco – Routing with seperate WAN link for backups

backupsciscorouting

We have two geographically separate data centers. We are preparing to implement a new WAN connection (dark cloud) that would be used only for backup traffic. The servers will have two NIC cards (production & backup) but what is the best way to ensure that the production and backup traffic doesn't mix? At the moment we are just using static routes to get to the WAN, but looking to implement BGP between our SP and ourselves. Internal RP is a mix of EIGRP and OSPF. Cores are Cisco 6500s and WAN routers will soon be upgraded to ASRs.

Suggestions on solutions? Policy-based routing (PBR)? VRFs?

Network Diagram

Best Answer

Assuming the two NICs on the servers are used to separate production and backup traffic, use VRFs. That's the best traffic separation technique there is. For more scalability (not sure you need it based on the diagram), throw full-blown MPLS/VPN in the mix, it runs on both Cat 6500 and ASRs.

Related Solutions

Inter VLAN Routing – Layer 3 Switch Over Routed Ports with Trunk Link

In your sheme you need 3 trunk links (if there is only one physical connection between these switches):

switch 1 to switch 0
switch 0 to switch 2
switch 2 to L3SW

The routing between these subnets will be handled by the L3 switch. so if pc 0 wants to ping to pc 1:

PC0 > (gets it on his vlan 1 port) switch 1 (trunk) > switch 0 (trunk) > switch 2 (trunk) > L3SW (vlan1 > vlan2) (sends it out of its trunk port) > switch 2 (trunk) > switch 0 (trunk) > switch 1 (vlan2) > pc1

Cisco SG300 – VLAN Routing Configuration Guide

It doesn't work because of a limitation of the SG300.
The SG300 doesn't have routed ports.

I set up a clean SG300 config but it was not possible to reach the ISP Gateway:
Config of SG300:

config-file-header
switche5bce7
v1.4.5.02 / R800_NIK_1_4_194_194
CLI v1.0
set system mode router 

file SSD indicator encrypted
@
ssd-control-start 
ssd config 
ssd file passphrase control unrestricted 
no ssd file integrity control 
ssd-control-end cb0a3fdb1f3a1af4e4430033719968c0 
!
vlan database
vlan 100,200 
exit
voice vlan oui-table add 0001e3 Siemens_AG_phone________
voice vlan oui-table add 00036b Cisco_phone_____________
voice vlan oui-table add 00096e Avaya___________________
voice vlan oui-table add 000fe2 H3C_Aolynk______________
voice vlan oui-table add 0060b9 Philips_and_NEC_AG_phone
voice vlan oui-table add 00d01e Pingtel_phone___________
voice vlan oui-table add 00e075 Polycom/Veritel_phone___
voice vlan oui-table add 00e0bb 3Com_phone______________
bonjour interface range vlan 1
hostname switche5bce7
no passwords complexity enable 
username cisco password encrypted d033e22ae348aeb5660fc2140aec35850c4da997 privilege 15 
!
interface vlan 100
 name "VLAN100" 
 ip address 20.20.20.33 255.255.255.224 
!
interface vlan 200
 name "VLAN200" 
 ip address 20.20.20.129 255.255.255.224 
!
interface gigabitethernet1
 ip address 20.20.20.2 255.255.255.252 
!
interface gigabitethernet10
 switchport mode access 
 switchport access vlan 100 
!
interface gigabitethernet20
 switchport mode access 
 switchport access vlan 200 
!
exit
ip default-gateway 20.20.20.1

Afterwards I set up a Catalyst 3750 Switch with the same VLANs and config and I was able to issue no switchport on Interface Gigabit1/0/1.

Now I can reach the ISP Gateway how it should be.
Config of 3750:

Current configuration : 3535 bytes
!
version 12.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Switch
!
boot-start-marker
boot-end-marker
!
!
!
!
no aaa new-model
switch 1 provision ws-c3750x-24p
system mtu routing 1500
ip routing
!
!
!         
!
crypto pki trustpoint TP-self-signed-2617031040
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-2617031040
 revocation-check none
 rsakeypair TP-self-signed-2617031040
!
!
spanning-tree mode pvst
spanning-tree extend system-id
!
!
!
!
vlan internal allocation policy ascending
!
!
!
interface FastEthernet0
 no ip address
 no ip route-cache cef
 no ip route-cache
 no ip mroute-cache
!
interface GigabitEthernet1/0/1
 no switchport
 ip address 20.20.20.2 255.255.255.252
!
interface GigabitEthernet1/0/2
!
interface GigabitEthernet1/0/3
!
interface GigabitEthernet1/0/4
!
interface GigabitEthernet1/0/5
!
interface GigabitEthernet1/0/6
!
interface GigabitEthernet1/0/7
!
interface GigabitEthernet1/0/8
!
interface GigabitEthernet1/0/9
!
interface GigabitEthernet1/0/10
 switchport access vlan 100
 switchport mode access
!         
interface GigabitEthernet1/0/11
!
interface GigabitEthernet1/0/12
!
interface GigabitEthernet1/0/13
!
interface GigabitEthernet1/0/14
!
interface GigabitEthernet1/0/15
!
interface GigabitEthernet1/0/16
!
interface GigabitEthernet1/0/17
!
interface GigabitEthernet1/0/18
!
interface GigabitEthernet1/0/19
!
interface GigabitEthernet1/0/20
!
interface GigabitEthernet1/0/21
!
interface GigabitEthernet1/0/22
!
interface GigabitEthernet1/0/23
!
interface GigabitEthernet1/0/24
!
interface GigabitEthernet1/1/1
!
interface GigabitEthernet1/1/2
!
interface GigabitEthernet1/1/3
!
interface GigabitEthernet1/1/4
!
interface TenGigabitEthernet1/1/1
!
interface TenGigabitEthernet1/1/2
!
interface Vlan1
 no ip address
!
interface Vlan100
 ip address 20.20.20.33 255.255.255.224
!         
ip classless
ip route 0.0.0.0 0.0.0.0 20.20.20.1
ip http server
ip http secure-server
!
ip sla enable reaction-alerts
!
!
line con 0
line vty 0 4
 login
line vty 5 15
 login
!
end

Best Answer

Related Solutions

Inter VLAN Routing – Layer 3 Switch Over Routed Ports with Trunk Link

Cisco SG300 – VLAN Routing Configuration Guide

Related Topic