Hello, I don't have a lot of EXP with ArubaOS-CX and I had to learn from scratch this new language. I'm making for my work, a new network with 2 8320's and a lot of other switchs from the old OS, HPE procurve and Aruba switching. You seem to be really good at it, I have a few questions, is that ok to ask them here?
Can you use the same mac address for the active-gateway for each of your vlans? If no, is there a hard limit to how many l3 vlans you can have with unique mac-addresses? Also, should vsx result in a zero downtime failover and failback (i.e. user sitting behind an aruba 2930m with a trunk to a vsx pair acting as the core for the users subnet - would a failover of the vsx primary result in any lost icmp traffic to another user being inter-vlan routed to another l3 interface managed by the vsx pair - what about failback)? Thank you for the videos and hopefully you keep them coming!
Yes, you can use the same vMAC for each active gateway VLAN on the switch. Active gateway is similar to VRRP in that routed traffic from the VSX node is sourced from the switch interface MAC and not the virtual MAC address.
Thanks. I work for Aruba Networks. The term of Shared ethernet links is not right for the CX series. Shared ethernet means when you have ports lined up in stack/VSF/IRF number. Example: 1/0/1 or 2/0/1 within the same switch, However in case of VSX you only see your own interfaces within the local scope of the switch, unless you ask it exclusively with "VSX" command(show interface brief vsx-peer ). So interfaces are not shared.
First of all, thank you very much for these comments. Your explanation is spot on and that's exactly how it works. the terminology shared ethernet was meant to explain it correctly. But understood your point and if it brings confusion than we need to use some other terminology. What would your recommendation be?
"Show" commands for active-gateway status and IPs? I'm searching and searching the internet but not finding a way to verify "fhrp" IP applied outside "show run" output. Any assistance you can provide is appreciated.
How do i avoid loops over the VSX ISL link? I know with MCLAG it should not be a problem. But my distribution switches cant do MCLAG and i have 6 of them connected using VLT (but there is a maximum of 2 members). So i can't prevent a loop forming. Spanning-tree protocols does not match either... I Tried to only allow a specific vlan over the VSX ISL link but that makes all the switches connect to a random 8320 even though keepalive is up and running (so it does not work in that situation). But a loop starts as soon as i allow all vlans over the VSX link and i can't tun on loop-protection because the switches tells me that, that is not something you should do....
Hi, you might end up on the primary or on the secondary. The active gateway functionality uses a hashing mechanism that allows you to load balance clients between both switches (primary and secondary). Based on the hashing mechanism, you either take the route through the primary or the secondary switch. If you need to make sure that you are ssh'ing into the primary or secondary switch, you have to ssh to the IP address that is configured on the VLAN interface instead of the active gateway IP address and you'll be fine.
16:15 I love the layout of the putty windows to represent the different switches on the diagram!
Excellent. Thankyou for the video. Very helpful after reading up on VSX.
As promised in the ArubaOS-CX 10.1 introduction video, here is the video covering VSX, hope you'll like it.
Hello, I don't have a lot of EXP with ArubaOS-CX and I had to learn from scratch this new language. I'm making for my work, a new network with 2 8320's and a lot of other switchs from the old OS, HPE procurve and Aruba switching. You seem to be really good at it, I have a few questions, is that ok to ask them here?
Excellent demonstration! Thank you.
Thanks Alot
Can you use the same mac address for the active-gateway for each of your vlans? If no, is there a hard limit to how many l3 vlans you can have with unique mac-addresses? Also, should vsx result in a zero downtime failover and failback (i.e. user sitting behind an aruba 2930m with a trunk to a vsx pair acting as the core for the users subnet - would a failover of the vsx primary result in any lost icmp traffic to another user being inter-vlan routed to another l3 interface managed by the vsx pair - what about failback)? Thank you for the videos and hopefully you keep them coming!
Did you ever get the answer this to this question? If so, what was the answer?
Yes, you can use the same vMAC for each active gateway VLAN on the switch. Active gateway is similar to VRRP in that
routed traffic from the VSX node is sourced from the switch interface MAC and not the virtual MAC
address.
Thanks. I work for Aruba Networks. The term of Shared ethernet links is not right for the CX series. Shared ethernet means when you have ports lined up in stack/VSF/IRF number. Example: 1/0/1 or 2/0/1 within the same switch, However in case of VSX you only see your own interfaces within the local scope of the switch, unless you ask it exclusively with "VSX" command(show interface brief vsx-peer ). So interfaces are not shared.
First of all, thank you very much for these comments. Your explanation is spot on and that's exactly how it works. the terminology shared ethernet was meant to explain it correctly. But understood your point and if it brings confusion than we need to use some other terminology. What would your recommendation be?
Thanks alot for you sharing, can I ask if my 8325 switch configure vsx, the Vlans do I need to configure activate gateway?
Good job with the tutorial.
how come both VSX switches have the same IP address?
"Show" commands for active-gateway status and IPs?
I'm searching and searching the internet but not finding a way to verify "fhrp" IP applied outside "show run" output.
Any assistance you can provide is appreciated.
where did the vsx active-gateway address & mac come from?
How do i avoid loops over the VSX ISL link? I know with MCLAG it should not be a problem. But my distribution switches cant do MCLAG and i have 6 of them connected using VLT (but there is a maximum of 2 members). So i can't prevent a loop forming. Spanning-tree protocols does not match either... I Tried to only allow a specific vlan over the VSX ISL link but that makes all the switches connect to a random 8320 even though keepalive is up and running (so it does not work in that situation). But a loop starts as soon as i allow all vlans over the VSX link and i can't tun on loop-protection because the switches tells me that, that is not something you should do....
Thank you!
What does vsx-sync vlans do on "lag 1" and "lag 2"?
Hi, if I do a ssh to the active Gateway ip (with vsx) is supposed to reply the primary switch ???
Hi, you might end up on the primary or on the secondary. The active gateway functionality uses a hashing mechanism that allows you to load balance clients between both switches (primary and secondary). Based on the hashing mechanism, you either take the route through the primary or the secondary switch. If you need to make sure that you are ssh'ing into the primary or secondary switch, you have to ssh to the IP address that is configured on the VLAN interface instead of the active gateway IP address and you'll be fine.
Excellent.