topic segmented management on 5520 running VOSS in ExtremeSwitching (VSP/Fabric Engine)

segmented management on 5520 running VOSS

Chi — Fri, 05 Mar 2021 01:16:25 GMT

Hi, has anybody gotten a 5520 running VOSS and acting as a router with two routed interfaces (VLANs with IPs) to have the segmented management VLAN be accessible from both sides of the router? I created VLANs A and B on the 5520, assigned (public, routable) IPs to them, and then created a segmented management VLAN, and gave it an IP on the same subnet as VLAN A, with VLAN A’s IP address as it’s default route.

I can SSH to the segmented management VLAN address, but ONLY when I’m physically connected to anything on VLAN A side of the router, including devices going through another router that connects the VLAN A. Anything on VLAN B or connected to the VLAN B side, cannot SSH to the segmented management VLAN address.

Re: segmented management on 5520 running VOSS

EXTR_Paul — Fri, 05 Mar 2021 01:27:42 GMT

With segmented mgmt with a VLAN the IP is treated just as a mgmt address. Not a routed address. You need to make sure that you give the MGMT VLAN IP a default route.

4901:1(mgmt:vlan)#ip route ?
{A.B.C.D/X} Ip address/subnet mask
{A.B.C.D} IP address
4901:1(mgmt:vlan)#ip route

Re: segmented management on 5520 running VOSS

EXTR_Paul — Fri, 05 Mar 2021 01:29:55 GMT

better example

mgmt vlan 192

ip address 192.168.2.7/24

ip route 0.0.0.0/0 next-hop 192.168.2.1 weight 200

enable

exit

Re: segmented management on 5520 running VOSS

Chi — Fri, 05 Mar 2021 01:32:58 GMT

Yes, I gave the VLAN A IP address as the default route for the segmented management VLAN interface. I could only SSH to the seg mgmt IP from the VLAN A IP and other networks connected to the VLAN A side. I could not SSH from the VLAN B IP nor any other network connected to the VLAN B side

Re: segmented management on 5520 running VOSS

EXTR_Paul — Fri, 05 Mar 2021 01:44:53 GMT

can you dump the config for us please?

Re: segmented management on 5520 running VOSS

Miguel-Angel_RO — Fri, 05 Mar 2021 05:29:08 GMT

Chi,

From the doc:

The mgmt IP and the VLAN A IP must match if I not mistaking.

The default gateway is the one defined on your switch and not the VLAN A’s IP

Mig

Re: segmented management on 5520 running VOSS

EXTR_Paul — Fri, 05 Mar 2021 05:47:54 GMT

just a thought….

if your network is routed, just use a CLIP for mgmt.

mgmt clip vrf GlobalRouter
ip address 172.17.49.1/32
enable

Re: segmented management on 5520 running VOSS

Ludovico_Steven — Mon, 08 Mar 2021 16:25:31 GMT

The point raised is that a mgmt VLAN IP cannot be reached if the same VSP is required to IP route the packet to the mgmt VLAN. This is documented as a limitation. The point is that if the VSP is acting as an IP router, then you should not be using a mgmt vlan IP but a mgmt clip instead.

See the attached slides, slide 19.

Re: segmented management on 5520 running VOSS

LionelH — Mon, 08 Mar 2021 18:48:52 GMT

Hello,

I’m in the exact same situation.

We have 2 VOSS VSP4900 acting as network core and L3 for all our VLAN.

We cannot access the VSP in the Vlan as before.

I understand we must now use CLIP mgmt, but is somebody know how to configure CLIP MGMT Interface ?

It as to be /32, and how the CLIP Mgmt IP can be reach from other Vlan ?

Thanks for explanation,

Regards,

Re: segmented management on 5520 running VOSS

LionelH — Mon, 08 Mar 2021 21:05:06 GMT

Hello,

I found my mistake, Router ISIS SPBM Ip wasn’t activate with IP shortcut as source.

Now Clip are working fine around the network.

Regards,

Re: segmented management on 5520 running VOSS

Chi — Wed, 07 Apr 2021 01:06:51 GMT

Both sides of the router have publicly routable IP addresses, so I would need to get another IP from the ISP and have them route to it. But the end customer doesn’t really want to do that.