How we ensure the fault tolerance of our clients' infrastructure
Good afternoon, dear Habrayuzer.
In this post, I would like to tell you more about how we ensure the resiliency of the infrastructure of our clients.
For example, the standard office (PC, IP-telephony, WiFi) is broken down into subsystems: ClientCloud, ClientLan, ClientPhone, ClientWiFi
The ClientLan subsystem is designed to organize PC access to other subsystems.
The ClientPhone subsystem is designed to organize access of IP phones to the ClientCloud subsystem (IP PBX).
The ClientWiFi subsystem is designed to organize guest access of mobile equipment (laptops, communicators, tablet computers) to the Internet.
Access from the ClientWiFi subsystem to all subsystems (ClientCloud, ClientLan, ClientPhone) is denied by the switch settings.
')
In order to ensure the fault tolerance of communication equipment with the client cloud subsystem, two communication lines are provided - the main (L2 channel) and the backup (VPN over the Internet). Equipment located on the LAN site in order to ensure uninterrupted network operation is connected to an uninterruptible power supply. To create a fault-tolerant system, switches are stacked - Stacking Switch.
The LAN node on the Site includes:
-active equipment switching level LAN;
-passive port crossing equipment;
-passive equipment for organizing the placement of patch cords;
-passive installation equipment
The object is connected to the network using two independent communication channels - L2 (main channel) and VPN over the Internet (backup). The logic diagram is shown in the figure. To ensure the greatest fault tolerance, L2 operators and the Internet operator are different, or independent (different) active operator equipment is used. Access to the Internet for PCs, printers, IP phones, a network of Wi-Fi devices and other devices occurs through this connection to the Internet.
When the main L2 channel disappears, the routing table on the switch of the third level is switched, and the traffic begins to pass through the backup channel - the VPN channel. This switching occurs through the dynamic routing protocol RIP version 2.
If a channel with access to the Internet is lost, the main channel remains in operation. The possibility of raising the backup VPN-channel, as well as access to the Internet for PC users and Wi-Fi network devices, disappears.
The organization of the VPN channel occurs through an existing connection to the Internet through a telecom operator. Secure VPN is organized through hardware implementation using Cisco ASA5505 equipment, utilizing Site-to-site, IPsec technologies.
Switch Failover Scheme
Switches located in the server rack, to ensure fault tolerance are combined into a stack StackingSwitch. This is achieved by cross-connecting the stacking ports so that if any switch fails, the others will be available for each other along an alternate path. Connections of the external L2 network and the VPN channel are connected to different switches, in order to maintain the connection to the network when the switch fails. Switching the traffic flow is fully automatic.
Access switches service the following subsystems: ClientLan, ClientPhone and ClientWiFi. Personal computers are connected to the Switch1 (Extreme Summit X440-48t) and Switch2 (Extreme Summit X440-48t) switches. IP phones using PoE technology are switched to Switch3 and Switch4 (Extreme Summit X440-48p). The ClientWiFi subsystem on these switches is logically present and is connected via the Wi-Fi controller to the Switch3 switch port.
Each subsystem has its own VLAN and its own subnet. Each subsystem has its own list of access to other subnets (subsystems).
If one of the switches fails, communication will be lost only on the PC directly connected to this switch, without affecting the operation of the others. If Switch1 (or L2 channel) fails, communication with the ClientCloud subsystem will remain over the VPN channel. If Switch2 fails, the main L2 channel will be used. If the Switch3 switch fails, some of the phones will be disconnected, however, it is stipulated by cross-linking that in the same cabinet the phones are cross-linked to different Switch3 and Switch4 switches, and therefore the cabinet will not remain without connection, i.e. some phones will work.
After replacing the released switch and putting it on the stack, a single stack configuration is applied to it. In case of failure of the switches or ports to which the trunk lines are connected, partner ports are provided in the stack, which will allow, manually switching the trunk cable, to resume operation through the required channel.
Connection diagram of subsystems to switches
Thus, the client connection scheme is built in such a way that each subsystem is allocated to its own VLAN and its own subnet, which guarantees protection from the negative impact of one network on another (virus, heavy load) and provides access control over networks.
I would like to note that in each case the client receives all the documentation with a detailed plan, wiring diagram, equipment placement and cross-connection, which are necessary for maintenance and further modernization.
Ps Free trial access with the advice of our technical experts is available for all Habr visitors.
In this post, I would like to tell you more about how we ensure the resiliency of the infrastructure of our clients.
For example, the standard office (PC, IP-telephony, WiFi) is broken down into subsystems: ClientCloud, ClientLan, ClientPhone, ClientWiFi
The ClientLan subsystem is designed to organize PC access to other subsystems.
The ClientPhone subsystem is designed to organize access of IP phones to the ClientCloud subsystem (IP PBX).
The ClientWiFi subsystem is designed to organize guest access of mobile equipment (laptops, communicators, tablet computers) to the Internet.
Access from the ClientWiFi subsystem to all subsystems (ClientCloud, ClientLan, ClientPhone) is denied by the switch settings.
')
In order to ensure the fault tolerance of communication equipment with the client cloud subsystem, two communication lines are provided - the main (L2 channel) and the backup (VPN over the Internet). Equipment located on the LAN site in order to ensure uninterrupted network operation is connected to an uninterruptible power supply. To create a fault-tolerant system, switches are stacked - Stacking Switch.
The LAN node on the Site includes:
-active equipment switching level LAN;
-passive port crossing equipment;
-passive equipment for organizing the placement of patch cords;
-passive installation equipment
The object is connected to the network using two independent communication channels - L2 (main channel) and VPN over the Internet (backup). The logic diagram is shown in the figure. To ensure the greatest fault tolerance, L2 operators and the Internet operator are different, or independent (different) active operator equipment is used. Access to the Internet for PCs, printers, IP phones, a network of Wi-Fi devices and other devices occurs through this connection to the Internet.
When the main L2 channel disappears, the routing table on the switch of the third level is switched, and the traffic begins to pass through the backup channel - the VPN channel. This switching occurs through the dynamic routing protocol RIP version 2.
If a channel with access to the Internet is lost, the main channel remains in operation. The possibility of raising the backup VPN-channel, as well as access to the Internet for PC users and Wi-Fi network devices, disappears.
The organization of the VPN channel occurs through an existing connection to the Internet through a telecom operator. Secure VPN is organized through hardware implementation using Cisco ASA5505 equipment, utilizing Site-to-site, IPsec technologies.
Switch Failover Scheme
Switches located in the server rack, to ensure fault tolerance are combined into a stack StackingSwitch. This is achieved by cross-connecting the stacking ports so that if any switch fails, the others will be available for each other along an alternate path. Connections of the external L2 network and the VPN channel are connected to different switches, in order to maintain the connection to the network when the switch fails. Switching the traffic flow is fully automatic.
Access switches service the following subsystems: ClientLan, ClientPhone and ClientWiFi. Personal computers are connected to the Switch1 (Extreme Summit X440-48t) and Switch2 (Extreme Summit X440-48t) switches. IP phones using PoE technology are switched to Switch3 and Switch4 (Extreme Summit X440-48p). The ClientWiFi subsystem on these switches is logically present and is connected via the Wi-Fi controller to the Switch3 switch port.
Each subsystem has its own VLAN and its own subnet. Each subsystem has its own list of access to other subnets (subsystems).
If one of the switches fails, communication will be lost only on the PC directly connected to this switch, without affecting the operation of the others. If Switch1 (or L2 channel) fails, communication with the ClientCloud subsystem will remain over the VPN channel. If Switch2 fails, the main L2 channel will be used. If the Switch3 switch fails, some of the phones will be disconnected, however, it is stipulated by cross-linking that in the same cabinet the phones are cross-linked to different Switch3 and Switch4 switches, and therefore the cabinet will not remain without connection, i.e. some phones will work.
After replacing the released switch and putting it on the stack, a single stack configuration is applied to it. In case of failure of the switches or ports to which the trunk lines are connected, partner ports are provided in the stack, which will allow, manually switching the trunk cable, to resume operation through the required channel.
Connection diagram of subsystems to switches
Thus, the client connection scheme is built in such a way that each subsystem is allocated to its own VLAN and its own subnet, which guarantees protection from the negative impact of one network on another (virus, heavy load) and provides access control over networks.
I would like to note that in each case the client receives all the documentation with a detailed plan, wiring diagram, equipment placement and cross-connection, which are necessary for maintenance and further modernization.
Ps Free trial access with the advice of our technical experts is available for all Habr visitors.
Source: https://habr.com/ru/post/184042/
All Articles