<html><body><div style="color:#000; background-color:#fff; font-family:Helvetica Neue-Light, Helvetica Neue Light, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif;font-size:16px"><div id="yiv7922449655"><div id="yui_3_16_0_1_1433562002835_34099"><div style="color:#000;background-color:#fff;font-family:Helvetica Neue-Light, Helvetica Neue Light, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif;font-size:16px;" id="yui_3_16_0_1_1433562002835_34098"><div><span></span></div><br clear="none"> <div id="yiv7922449655yui_3_16_0_1_1433482419060_21912" style="font-family:Helvetica Neue-Light, Helvetica Neue Light, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif;font-size:16px;"> <div id="yiv7922449655yui_3_16_0_1_1433482419060_21911" style="font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif;font-size:16px;"> <div dir="ltr" id="yiv7922449655yui_3_16_0_1_1433482419060_21910"> <hr size="1"> <font size="2" face="Arial"> <b><span style="font-weight:bold;">From:</span></b> Richard Thornton <richie.thornton@gmail.com><br clear="none"> <b><span style="font-weight:bold;">To:</span></b> ausnog@lists.ausnog.net <br clear="none"> <b><span style="font-weight:bold;">Sent:</span></b> Friday, 5 June 2015, 15:32<br clear="none"> <b><span style="font-weight:bold;">Subject:</span></b> [AusNOG] Hatteras redundancy<br clear="none"> </font> </div> <div class="yiv7922449655y_msg_container" id="yiv7922449655yui_3_16_0_1_1433482419060_21913"><br clear="none">Hi,<br clear="none"><br clear="none">Not sure if this is the best mailing list but you have all been very<br clear="none">helpful in the past :)<br clear="none"><br clear="none">Apologies if my knowledge is a bit sketchy, I am trying to visualise<br clear="none">how I can have "redundant" hatteras, let me paint a picture:<br clear="none"><br clear="none">Rack in SY3<br clear="none">Dual routers and internet connections<br clear="none">Hatteras comes in to an hypervisor appliance over an ethernet VLAN on a switch<br clear="none"><br clear="none">Right now I only have one hatteras circuit but that will grow.<br clear="none"><br clear="none">So I want to add a second appliance to remove a single point of<br clear="none">failure and also add an extra switch for the same reason.<br clear="none"><br clear="none">As you know one of the cool things about hatteras is the fact it looks<br clear="none">like layer 2 LAN (MPLS right), so I would rather not route the<br clear="none">hatteras after it's handed to me, so how do I get all this redundancy<br clear="none">without losing the layer 2.</div><div class="yiv7922449655y_msg_container" id="yiv7922449655yui_3_16_0_1_1433482419060_21913"><br clear="none"></div><div class="yiv7922449655y_msg_container" id="yiv7922449655yui_3_16_0_1_1433482419060_21913">/ That's why looking like a layer 2 LAN isn't really that "cool", or as simple as it initially appears, because redundancy becomes a problem.</div><div class="yiv7922449655y_msg_container" id="yiv7922449655yui_3_16_0_1_1433482419060_21913"><br clear="none"></div><div class="yiv7922449655y_msg_container" id="yiv7922449655yui_3_16_0_1_1433482419060_21913" dir="ltr">/ If I understand your scenario correctly, your choices are:</div><div class="yiv7922449655y_msg_container" id="yiv7922449655yui_3_16_0_1_1433482419060_21913"><br clear="none"></div><div class="yiv7922449655y_msg_container" dir="ltr" id="yiv7922449655yui_3_16_0_1_1433482419060_21913">(a) Spanning Tree Protocol or a faster variant (RSTP, MSTP) </div><div class="yiv7922449655y_msg_container" dir="ltr" id="yiv7922449655yui_3_16_0_1_1433482419060_21913">(b) Multi-Chassis LAG</div><div class="yiv7922449655y_msg_container" dir="ltr" id="yiv7922449655yui_3_16_0_1_1433482419060_21913">(c) Plug your appliances directly into the Hatteras devices, and run VRRP between them</div><div class="yiv7922449655y_msg_container" dir="ltr" id="yiv7922449655yui_3_16_0_1_1433482419060_21913">(d) Plug your routers directly into the Hatteras devices, and run VRRP/HSRP between them</div><div class="yiv7922449655y_msg_container" dir="ltr" id="yiv7922449655yui_3_16_0_1_1433482419060_21913"><br clear="none"></div><div class="yiv7922449655y_msg_container" dir="ltr" id="yiv7922449655yui_3_16_0_1_1433482419060_21913">/ There are a variety of issues with STP. Carriers, or the equipment they use, commonly drop it on "emulated LAN" services because (a) true IEEE 802.1d switches aren't supposed to forward STP BPDUs, (b) a multi-vendor network might have a mix of equipment that may or may not be able to forward them, and (c) STP BPDUs may leak across services, impacting other customers, or possibly, impacting the carrier network itself (if they happen to be running STP internally for some reason, even though they should avoid it). Some of these issues would go away if there was a way to perform STP authentication (similar to how IP routing protocols can support authentication), but it doesn't.</div><div class="yiv7922449655y_msg_container" dir="ltr" id="yiv7922449655yui_3_16_0_1_1433482419060_21913"><br clear="none"></div><div class="yiv7922449655y_msg_container" dir="ltr" id="yiv7922449655yui_3_16_0_1_1433482419060_21913">/ Multi-Chassis LAG (MC-LAG) is an alternative that doesn't suffer from as many issues as STP. However, it isn't standardised by the IEEE, and to I think to completely eliminate a single point of failure across the both the pair of links and the pair of equipment at the ends of them, both devices have to support MC-LAG (and run MC-LAG independently of each other - i.e., the far end doesn't realise the local end-is running MC-LAG, and the local end doesn't realise the far end is running MC-LAG). So both the Hatteras devices and the two switches that you have would need to support and have enabled MC-LAG. Even if the Hatterases (Hatteri?") do support MC-LAG, the carrier using them might not have it available as a product option.</div><div class="yiv7922449655y_msg_container" dir="ltr" id="yiv7922449655yui_3_16_0_1_1433482419060_21913"><br clear="none"></div><div class="yiv7922449655y_msg_container" dir="ltr" id="yiv7922449655yui_3_16_0_1_1433482419060_21913">/ The third option makes the two appliances look like a single host with two network cards attached to the same network. VRRP is then used to make one of those network cards active for all IP traffic, and if that network card fails, then the other network card (and therefore appliance) takes over within a few seconds. The drawbacks are that you become constrained to having to run everything on the two directly attached appliances, and if you want this fail over to become transparent to the down stream clients, you have to somehow synchronise application and other state (e.g., firewall and TCP connection state) between them.</div><div class="yiv7922449655y_msg_container" dir="ltr" id="yiv7922449655yui_3_16_0_1_1433482419060_21913"><br clear="none"></div><div class="yiv7922449655y_msg_container" dir="ltr" id="yiv7922449655yui_3_16_0_1_1433482419060_21913">/ The forth option uses a pair of routers instead of the appliances and running VRRP or HSRP between them. This overcomes the issue of having to run everything on the directly attached appliances, but now you don't have the "simplicity" of the single LAN because you're now doing IP routing, and your throughput may be reduced because layer 3 throughput is more expensive than layer 2 throughput if you're limited to the same amount of $s.</div><div class="yiv7922449655y_msg_container" dir="ltr" id="yiv7922449655yui_3_16_0_1_1433482419060_21913"><br clear="none"></div><div class="yiv7922449655y_msg_container" dir="ltr" id="yiv7922449655yui_3_16_0_1_1433482419060_21913">/ It is also common for people to want both redundancy and performance, so that you have active/active rather than active/passive links and attached equipment. The above options don't provide that, or at least don't easily provide it. Doing redundancy and spreading traffic over multiple links/paths is easier to do at the IP layer, because IP protocols have been designed to support and use multiple paths through the network. If your network gets just a bit more complicated than below, a better service to get might be a Layer 3 VPN.</div><div class="yiv7922449655y_msg_container" dir="ltr" id="yiv7922449655yui_3_16_0_1_1433482419060_21913"><br></div><div class="yiv7922449655y_msg_container" dir="ltr" id="yiv7922449655yui_3_16_0_1_1433482419060_21913">/ Regards,</div><div class="yiv7922449655y_msg_container" dir="ltr" id="yiv7922449655yui_3_16_0_1_1433482419060_21913">/ Mark.</div><div class="qtdSeparateBR"><br><br></div><div class="yiv7922449655yqt8379839267" id="yiv7922449655yqtfd27483"><div class="yiv7922449655y_msg_container" dir="ltr" id="yiv7922449655yui_3_16_0_1_1433482419060_21913"><br clear="none"></div><div class="yiv7922449655y_msg_container" dir="ltr" id="yiv7922449655yui_3_16_0_1_1433482419060_21913"><br clear="none">So right now the hatteras is handed to me by a middle man, I may<br clear="none">remove the middle man and start doing the MPLS.<br clear="none"><br clear="none">So like this:<br clear="none"><br clear="none">circuit1 switch/router appliance1 internet router1<br clear="none"> X X X<br clear="none">circuit2 switch/router appliance2 internet router2<br clear="none"><br clear="none">Thanks for looking.<br clear="none"><br clear="none">Cheers<br clear="none">Richard<br clear="none">_______________________________________________<br clear="none">AusNOG mailing list<br clear="none"><a rel="nofollow" shape="rect" ymailto="mailto:AusNOG@lists.ausnog.net" target="_blank" href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br clear="none"><a rel="nofollow" shape="rect" target="_blank" href="http://lists.ausnog.net/mailman/listinfo/ausnog">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br clear="none"><br clear="none"><br clear="none"></div> </div></div><div class="yiv7922449655yqt8379839267" id="yiv7922449655yqtfd76415"> </div></div><div class="yiv7922449655yqt8379839267" id="yiv7922449655yqtfd20000"> </div></div></div></div></div></body></html>