Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite

We have several servers on colocation and now trying to re-organize the network by utilizing Cisco ASA 5505 as a router and Cisco 3750x series switch.

Network topology is looking like that:

    uplink
      |
+----------+
| ASA 5505 |
+----------+
      |
      |(trunk vlan10,101,102)
      |
+-----------+
|   3750x   |
+-----------+
      |
      |
      |
+--------------------------+
| Server N                 |
| 192.168.10.10  : vlan10  |
| 192.168.101.10 : vlan101 |
| 192.168.102.10 : vlan102 |
+--------------------------+

The problem with 3750x configuration as we need to deliver three different subnets (vlan 10,101,102) to the "Server N". "Server N" has multiple IPs from different subnets (vlan101 and 102) assigned to the same NIC. Plus, it has Base Motherboard Controller on board with another IP from vlan10. BMC shares the NIC - thus there is only one physical link from the server to switch.

Since 3750x doesn't allow having multiple vlans allowed on the same port with out trunking - what is the best way to configure the switch to allow this configuration?

share|improve this question
2  
"Trunking" is practically defined as "having multiple VLANs on the same port". Why don't you trunk to the server? – David Schwartz Apr 24 '12 at 2:38
This requires additional OS configuration (like bonding) which is undesired. Many dedicated server providers are able to add additional IPs with out having you to reconfigure your server. We would like to go the same way first and keep "trunk to the server" as the last resort. – Eugene M Apr 24 '12 at 2:58
Curious what OS you're running that tagging is enormous task? I can do this in Windows with a broadcom adapter in about 30 seconds. – SpacemanSpiff Apr 24 '12 at 5:16
@EugeneM: It doesn't require bonding, it just requires trunking. Providers add additional IPs without requiring you to reconfigure your server because the IPs are in the same subnet. – David Schwartz Apr 24 '12 at 5:24
1  
More likely, they just put each IP (other than the first) in its own subnet and routed them to the host as /32s. You can also put multiple subnets in the same VLAN. I'm not sure why you think that won't work in your environment. – David Schwartz Apr 24 '12 at 5:47
show 4 more comments

3 Answers

up vote 3 down vote

Trunk the interface going to the server.

share|improve this answer
does it require additional server configuration (like re-building linux kernel with 802.1Q support) ? – Eugene M Apr 24 '12 at 3:00
you should be able to do a vconfig add [eth device] [vlan], this will create a [eth device].[vlan] interface you can work with. – Steve Butler Apr 24 '12 at 7:01
take a look at this link cyberciti.biz/tips/… – Steve Butler Apr 24 '12 at 7:08
up vote 3 down vote

Although it is common to have a 1-to-1 Layer 2 to Layer 3 mapping (aka vlan to IP network mapping), you don't have to.

If you really don't want a trunk, it might be appropriate to have multiple L3 networks exist within a single vlan. However, keep in mind that this could be a security risk as all that is needed to bypass firewall rules between the L3 networks on the ASA is a host to change its IP settings since they are all in the same vlan.

You need to decide the appropriate solution on your own of course. However, if you get comfortable configuring vlan trunks on both switches servers then you can feel confident that your decision wasn't made due to a bias towards taking a shortcut.

share|improve this answer
thanks for the reply, that was my first thought to combine multiple subnets into the same vlan, but it looks like ASA 5505 doesn't support it. In our orifinal topology - all servers were connected through $30 dumb switch and everything worked just fine. I just can't believe that such complex devices for $4K cannot do what dumb switch does... – Eugene M Apr 24 '12 at 3:37
up vote 1 down vote

Well, I'm not going to waste time telling you you're doing it wrong, but there is a way to achieve what you want that's going to burn ports on your 3750 :)

Set the following: Port 1 on VLAN10 Port 2 on VLAN101 Port 3 on VLAN102

Ports 4-7 on a fourth VLAN, let's call it 103.

Now... connected Port 1 to Port 4, Port 2 to Port 5, Port 3 to Port 6, Port 7 to your server.

Ta da... you have just bridged your three VLANs back together... YAY.

This is all sorts of the "wrong way to do it", but I suppose it does get you what you want, all three broadcast domains merged back together. Your ASA may get pissy with you, you've been warned.

share|improve this answer
that's a 1001st way to burn a switch ;) anyway, i wonder how every dedicated server provider can deliver different IP ranges (from totally different subnets) to the server with our having you reconfigure anything in the system... – Eugene M Apr 24 '12 at 5:44
It will not burn the switch, lol. You're not even going to come CLOSE to hitting the ASIC limitations of a 3750. – SpacemanSpiff Apr 24 '12 at 13:52
1  
Just another good reason for me to hate the Cisco ASA :) – SpacemanSpiff Apr 24 '12 at 13:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.