Configuring subnet access on a Cisco 2960

Question

Greetings,

I want to configure a 24-port Cisco Catalyist 2960 to perform as follows:

1. Four ports going to a SAN
2. Four ports going to four ESX servers for iSCSI storage traffic
3. Four ports going to the four ESX servers for management traffic (the vmware stuff)
4. Four ports for linking two of these switches together.

• The switch's management address is 10.10.0.1 (255.0.0.0)
• The ESX service-console has been setup as 10.20.30.1 and hooked into Gi0/11

Requirement 1 and 2 seem okay - we've put that on a separate VLAN (10):

interface range Gi0/1 - 10
  description Storage
  switchport access vlan 10

Requirement 4 seems okay - we've set those up as a trunk:

interface range Gi0/21 - 24
  description Uplink
  channel-group 1 mode active

The switch-ports for #3 have been setup as their own VLAN to isolate the VM traffic.

interface range Gi0/11 - 20
  description ESX
  switchport access vlan 20

My problem is that the switch can't ping 10.20.30.1 at all. Do I need to setup routing? My ESX console is on the default VLAN (i.e. I've not specified it in the setup), and the laptop I'm using to terminal in to the switch is also on VLAN 1.

Answer 1

You will need to implement some method of InterVLAN Routing to route between the different vlans in your scenario. However, due to the utilization of 2960 Switches you won't have the capability of implementing "ip routing" and configuration of SVIs for a Default Gateway for each subnet. One solution is to implement "Router on a Stick" utilizing a separate Layer 3 Router or Switch to handle the IP Routing and SVIs for each vlan/subnet. The traffic will then be trunked out of the 2960 to the MLS Switch or Router and will be returned over the same trunk port. This isn't the best method has it greatly reduces your throughput due the single interface. You will need to determine wether the amount of throughput is acceptable for your design. If not, I would recommend you upgrade to the 3560G or 3750G switches which would be capable of routing your Layer 3 traffic between subnets.

Also, in your VMWare ESX Configuration, is the Service Console dedicated to a specific eth interface, or do you have it connected to a VSwitch being tagged with a specific vlan id? You'll want to make sure that if you are trunking to that port that you configure the tagging of the Service Console to the requested vlan id, or you implement "switchport trunk native vlan xx" with xx being the vlan you wish the Service Console traffic to be in.

Answer 2

Okay, I think this is all working now! Jeff's answer wasn't directly the correct one, but it got me into the right area of the config. One of the problems I had was incorrect subnet masking on the ESX server :(

---

Here's the switch config that seems to be working right now:

First we name the box and also enable Jumbo frames, as it'll be used for Storage and large-file traffic:

hostname Switch-009
system mtu jumbo 9000

Next we create the two VLANs for the Storage network and the VMWare network (VSphere traffic, VMotion, etc)

vlan 10
  name Storage

vlan 20
  name VMWare

Now we configure the first 10 ports to be for the storage. This is where the 4 ports from the SAN and the NIC port from each of the four ESX servers will connect (and two spares)

interface range Gi0/1 - 10
  description Storage
  switchport access vlan 10

Now we do the same for the VMWare traffic ports:

interface range Gi0/11 - 20
  description ESX
  switchport access vlan 20

Next we configure the last four ports (these happen to be the four dual-purpose GBIC sockets)

interface range Gi0/21 - 24
  description Uplink
  channel-group 1 mode active

Finally we give the VMWare VLAN an ip address so that we can connect to it for switch-management purposes

interface vlan 20
  ip address 10.20.0.1 255.0.0.0

---

We now have all the storage equipment (EqualLogic controllers, VMWare vswitch for storage etc) all on 10.10.x.x addresses, all the VMWare traffic on 10.20.x.x addresses, and a production network (not on these switches so not shown here) on 10.50.x.x addresses.

Answer 3

Not directly concerning your problem - but you should enable Jumbo Frames for your iSCSI VLAN.