Day 11: Single Point of Failure

Eighteen months at Halverton, and you are the Network Admin for HQ.

On Tuesday at 14:20, SW-CORE1 stopped working.
It is the only core switch in the building, and it routes between every VLAN. The offices, the server room, finance and the docks lost the network at the same moment.

It took 90 minutes to install a spare and configure it.

Figure 1 – Every VLAN at once

The Problem

Each VLAN at HQ has its own default gateway:

• floor 3 10.20.10.1

• the server room 10.20.8.1

• finance 10.20.12.1

• the docks 10.20.30.1

All four are configured on SW-CORE1. When it stopped, all four stopped with it, and nothing could leave its own VLAN.

HQ has always run on one core switch. That makes it a single point of failure.

Figure 2 – Everything at HQ goes through one switch

Sarah hands you the change:

"The second switch arrived this morning, racked and cabled. Work out what to do with it, then do it."

The second switch is in the rack, cabled to the three access switches, to SW-CORE1 and to R-HQ1.
Its VLANs and its trunks are done. It does not have an IP address on VLAN 8, 10, 12 and 30.

You are going to put the four gateways on both switches with HSRP.

The One Rule

Nothing changes on a host.
The PCs, the servers and the dock machines keep the gateway they have.

For example, on VLAN 10:

• SW-CORE1 takes 10.20.10.252

• SW-CORE2 takes 10.20.10.253

• 10.20.10.1 stays the gateway, shared by the two

Only the switch that is Active answers for 10.20.10.1.

Same on VLAN 8, 12 and 30.

The offices and the docks get their addresses from SW-CORE1: it is also the DHCP server of the building.
That is a second single point of failure. It is not today's change.

Table 1 – The four gateways after the change

Figure 3 – The two cores of HQ

You decide which switch answers while both are running.

Then you take it down and check: the four gateways still answer, and a PC on floor 3 still reaches a server on another VLAN.

Lab Instructions

You have the console on SW-CORE1, on SW-CORE2, and on PC1 on floor 3. A server in the server room answers on 10.20.8.10.

• Move the four gateways onto both switches

• Take the Active switch down, then ping the gateway and a server from PC1

• Save the configuration on both switches

You switched SW-CORE1 off yourself, once everything was in place. The monitoring raised one alert, for SW-CORE1. The four gateways kept answering.

Figure 4 – The same switch, one alert

On Monday the offices, the server room, finance and the docks all open on a gateway that no longer depends on one single switch.

It is the first thing at Halverton that you designed and built.