This topic explains how to configure the LAN side of the SteelConnect gateway. It includes these possible deployment scenarios:

This list of possible scenarios highlights some of the most common deployments, but is not an exhaustive list.

To learn more about how to create and configure sites and VLANS (zones) for your topology, see the SteelConnect Manager User Guide.

Spanning Tree Protocol (STP) is a Layer 2 protocol that passes data back and forth to find out how the switches and gateways are organized on the network and uses this information to create a logical spanning tree. Each site configures a different spanning tree.

STP is active by default on the SteelConnect gateway LAN ports and it prevents network malfunction by blocking ports that cause loops in redundant network paths.

STP is disabled on branch gateways configured for high availability. Due to the lack of STP, we recommend attaching only one switch to one gateway and avoiding mesh topologies with HA deployments.

The original version of Spanning Tree IEEE 802.1D takes between 30 to 50 seconds to converge in a network. Rapid Spanning Tree Protocol (RSTP) defined in 802.1w is an enhanced version with convergence time of 6 seconds (3x2 hello interval or even lower).

SteelConnect gateways and switches implement Multiple Spanning Tree (MST) protocol defined in IEEE 802.1s. MST uses the best features of PVST+ and RSTP, and MST can run a single instance of Spanning Tree Protocol for a group of VLANs. So in a network of 1000 VLANs you can group the first 500 VLANs into MST group 1 and the last 500 VLANs in MST group 2 and reduce 1000 VLAN instances in RPVST+ to just two logical instances.

All spanning tree operations include these four primary steps:

The election of a root bridge is the most crucial step and dictates the movement of Layer 2 traffic. A device with the lowest bridge priority becomes a root bridge in the network. If there is a tie with bridge priority, then the device with lowest MAC address becomes the root bridge. Unlike other vendors, we do not employ default bridge priority of 32768 because SteelConnect access points have the lowest MAC addresses of all Riverbed products.

All SteelConnect devices start with MAC address 6C:98:EB.

The following are the default priorities:

Although access points currently have higher priority, do not change the value or decrease the default priority, which would result in access points becoming a root bridge in your network.

For example, if you have a combination of S48 and S24 switches and a gateway, then the S48 switch will assume the role of root bridge.

When SteelConnect appliances are deployed in a multivendor environment where a root bridge is already elected, we recommend using Root Guard, BPDU Guard, or Loop Guard features or reducing the existing root bridge priority to less than 12288 to avoid or reduce downtime.

This deployment features switches with access port connections configured in a single zone.

This topology can have a SteelConnect gateway acting as a switch, a single switch, or a pair of switches.

 

In these topologies, Spanning Tree is active by default on the SteelConnect gateway LAN ports and prevents network malfunction by blocking ports that cause loops.

In this topology, you configure the switch uplink port as an access port.

The following SteelConnect gateways support this topology.

You can deploy the SteelConnect virtual gateway (SDI-VGW) on a universal customer premises equipment (uCPE) or a Riverbed SteelFusion appliance as long as physical ports are attached to the ports of the virtual appliance.

This deployment features switches with trunk port connections for multizone environments.

The following SteelConnect gateways support this topology.

High availability on the LAN provides network redundancy and reliability and maintains uninterrupted service in the event of a power, hardware, software, or WAN uplink failure. Gateways in an HA pair must be the same model.

LAN high-availability topology shows the two supported configurations. The interconnections between the SteelConnect HA pair and the Layer 2 switch can be configured as access mode (singlezone) or trunk/802.1q (multizone).

The Spanning Tree Protocol (STP) is disabled on branch gateways configured for high availability. Without STP, we recommend you attach only one switch to a gateway and avoid mesh topologies.

The HA pair uses the Dedicated Control Port to communicate with each other, and that port serves as the VRRP link between the two gateways.

For model SDI-1030 gateways, one port must be configured as the Dedicated Control Port by assigning the Control Port role.

You can use tracked ports to trigger failover if the network goes down on the LAN side of the gateway (for example, if a switch fails) to avoid a black hole situation.

The following SteelConnect gateways support this topology.

 

A typical use case for Enterprise networks uses a core Layer 3 switch (or a pair of switches) handling inter-VLAN routing for the local network.

You can configure static routes:

The following SteelConnect gateways support this topology.

An alternative to the previous configuration is to leverage dynamic routing protocols such as OSPF to discover subnets behind a Layer 3 switch.

In this deployment, you must configure OSPF on the Layer 3 switch as well as on the SteelConnect Manager so that:

The following SteelConnect gateways support this topology.

The SteelConnect gateway connects to its OSPF peer, in this case the Layer 3 switch on the LAN side, and starts discovering the LAN subnets.

Configure the HA pair and the pair’s connection to the Layer 3 switch or router in the same way you would for a Layer 2 topology. See Layer 2: High availability.

High-availability pair of gateways connected to a single Layer 3 switch or router and High-availability pair of gateways connected to two Layer 3 switches or routers illustrate two supported Layer 3 high-availability topologies.

The following SteelConnect gateways support these topologies.

LAN-side integration with firewalls is very similar to LAN topologies with Layer 3 switches. You can configure static routes or dynamic routing to reach subnets behind the firewalls.

 

If the firewall applies NAT-to-LAN traffic, the SteelConnect gateway only sees the firewall IP address, so there is no need to configure static routes or OSPF on the LAN side.

Firewall clusters typically operate in active/passive mode. Each appliance has the same configuration, and if one goes down the other activates and resumes operation with the same IP addresses. The gateways do not detect a traffic loop.

You can deploy SteelConnect gateways with SteelHeads for WAN optimization.

By default, SteelConnect appliances have the SteelHead compatibility feature on.

To enable SteelConnect compatibility on a SteelHead CX, enter this Riverbed command-line interface (CLI) command: steelhead steel-connect compatibility enable

See the SteelConnect Manager User Guide for more information about compatibility.

See the SteelHead Deployment Guide and SteelHead User Guide for more details about the SteelHead appliance configuration and deployment options.