Single Internet Connection but HA Infrastructure — Using Bridging Instead of Routing

Introduction — The Design Constraint

The cus­tomer had decided to build a host­ing plat­form, but could only arrange for a single inter­net con­nec­tion to that site due to loc­a­tion. However, all other hard­ware was duplic­ated for high avail­ab­il­ity. After con­sid­er­ing the options the fol­low­ing dia­gram was pre­pared show­ing the first pass at the design. This was the Internet Connection (100Mb Ethernet) con­nec­ted to the router, then con­nec­ted to a switch, which was inter­con­nec­ted by trunk to a second switch. The first layer of fire­walls is then connected.

In this design, the router and the first switch are single points of fail­ure as shown on the diagram

Solution

After some con­sid­er­a­tion, this design could be improved if the router was con­nec­ted to both switches. This can be done by cre­at­ing a bridge inter­face in the router and using span­ning tree to detect and change the topo­logy in the event of an out­age. So the design is changed to the following:

Using VRF Lite for Internet to sep­ar­ate the Management /​ Control Plane

After con­sid­er­ing the secur­ity and the oper­a­tional man­age­ment, it was decided that hav­ing the con­trol plane of the Internet facing router pos­sibly access­ible from the Internet was not an accept­able risk. This risk could be mit­ig­ated by using VRF Lite to sep­ar­ate the inter­net rout­ing from the man­age­ment routing.

The con­fig­ur­a­tion shown below is the sample con­fig­ur­a­tion for this configuration:


!
ip vrf Internet
rd 100:101
!Create the VRF for the Internet traffic
!
bridge irb
!Enable the bridging software for IOS
!
interface GigabitEthernet0/0
description to Internet Provider network next hop 198.18.200.2
ip vrf forwarding Internet
!assign the external interface to the VRF
ip address 198.18.200.1 255.255.255.252
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/1
description to the left side switch
no ip address
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/1.100
description Internet connection
encapsulation dot1Q 100
bridge-group 1
!
interface GigabitEthernet0/1.2000
description Management connection
encapsulation dot1Q 2000
bridge-group 2
!
interface GigabitEthernet0/2
desc to the right side switch
no ip address
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/2.100
description Internet connection
encapsulation dot1Q 100
bridge-group 1
!
interface GigabitEthernet0/2.2000
description Management Connection
encapsulation dot1Q 2000
bridge-group 2
!
interface BVI1
description BVI for internal Internet network
ip vrf forwarding Internet
ip address 198.18.10.1 255.255.255.128
!
interface BVI2
description BVI for Mgmt
ip address 192.168.254.1 255.255.255.224
!
!
ip route 0.0.0.0 0.0.0.0 192.168.254.31
!set the route for device management
ip route vrf Internet 0.0.0.0 0.0.0.0 198.18.200.2
!set the default route for the service provider
!
bridge 1 protocol ieee
bridge 1 route ip
bridge 2 protocol ieee
bridge 2 route ip
!enable the bridging protocols for both the Internet and management connections


Conclusion

The solu­tion has been work­ing well. A recent switch upgrade pro­cess meant that no out­ages were involved. This was a reas­on­ably simple con­fig­ur­a­tion change that has sub­stan­tially improved the oper­a­tion of the net­work. The Security were most pleased with the con­trol plane separation.

Please rate this post:

(2 votes, average: 9.00 out of 10)

 Loading ...