Switch Management IP-Address / Virtual Routers

Stefan_K_ — Mon, 18 Jan 2021 18:18:50 GMT

Hi guys,

I need some input / ideas / confirmation from you. 🙂

Given is the following:

A Core-router (EXOS) at a remote location, with several interfaces with an IP-Address and ipforwarding enabled: e.g. Client-VLAN, Switch-Mgmt VLAN, Transfer-Net to the next router/firewall and so on
some Access-switches conntected to that router, which only have one IP-Address (on the Switch-Mgmt VLAN)
the Core-router is added to XMC with the IP-Address on the Switch-Mgmt VLAN. SSH-Access and SNMP is also done via this IP-Address/VLAN

Problem:

Some things (like SCP, TFTP, Archive via XMC, SNTP...) can't be configured to use a specific source IP-address (for radius you can luckily configure this IP)
the switch will use the IP-address of the interface where these packet egress the switch (in these cases the uplink to the next router/firewall)
this ip-address is most likely not reachable from the headquarter where the XMC and other servers are located, because the transfer-nets are usually not needed to be routed. Firmware Update and Switch backup fails because of this

On EOS you could define a Management-Address, but for EXOS this is not possible. Afaik the only solution would be to use a different VR that is only used for the Switch-Mgmt VLAN and only has one IP-Address. Is this correct or is this also not the solution?

So for a new router it's easy:

switch must support routing between VRs (I think Edge-License is sufficient, but X620 and X440G2 don't support routing between VRs at all - right?)
create new VR
create Switch-Mgmt VLAN on this VR
modify some scripts on XMC so that the switch uses this VR for backup / upgrade

For already existing routers it is a bit more complicated I guess:

switch must support routing between VRs
delete the existing Switch Mgmt-VLAN
create new VR
recreate the Switch Mgmt-VLAN on the new VR
Add this VLAN to the Downlinks to the Access-Switches
- For this you need to remove the Port from the VR because you can't add a VLAN with a different VR to a port with another VR (Why do ports even have VRs if VLANs also have a VR by default?)
- to remove the Port from a VR you need to remove all VLANs from the Port (why 😞 )
So: Remove all vlans on the downlinks, remove port VR, re-add all vlans
modify scripts on XMC

Did I understand this correctly? Is there anything to improve on my procedure for existing routers? Can I avoid removing all VLANs from a Port in order to achieve my goal? On some locations there are dozens vlans on these ports.
And I also fear that I might cut myself from the router somehow… and then I’m fcked because the router are all over the world. 😄

Best regards
Stefan

Re: Switch Management IP-Address / Virtual Routers

OscarK — Mon, 18 Jan 2021 22:25:52 GMT

Yes, creating a seperate VR for switch management would be the best option I think.

We do support inter VR routing (route leaking).

https://extremeportal.force.com/ExtrArticleDetail?an=000083084

Re: Switch Management IP-Address / Virtual Routers

Stefan_K_ — Mon, 18 Jan 2021 22:29:13 GMT

Hi Oscar,

thank you for your quick answer!

This won’t work for X620, right? I can’t activate ipforwarding for a VLAN on a VR other than VR-Default.

And there is no other way than deleting all VLANs from a port, deleting port-VR and readding the VLANs?

Best regards
Stefan

Re: Switch Management IP-Address / Virtual Routers

OscarK — Mon, 18 Jan 2021 22:44:02 GMT

Hi Stefan,

I think you are right about the X620.

Yes, you need to delete the vlans from the port, remove it from vr vr-default and add the vlans again.

Re: Switch Management IP-Address / Virtual Routers

Stefan_K_ — Mon, 18 Jan 2021 23:11:57 GMT

Thank you, Oscar, for your answers.

If anyone else has some experiences to share… I’m curious. 🙂

Best regards
Stefan

topic Re: Switch Management IP-Address / Virtual Routers in ExtremeSwitching (EXOS/Switch Engine)

Switch Management IP-Address / Virtual Routers

Re: Switch Management IP-Address / Virtual Routers

Re: Switch Management IP-Address / Virtual Routers

Re: Switch Management IP-Address / Virtual Routers

Re: Switch Management IP-Address / Virtual Routers