Layer 2 fault isolation and resiliency
Requirement / business driver
Bound the blast radius of L2 faults and make the access/distribution layer resilient - without the "redundancy" secretly being a single failure.
The four levers (blueprint 2.5)
- Fate sharing - the subtle one. Two uplinks down the same conduit, or a shared control plane (VSS/StackWise) on a "redundant" pair, fail together. Real redundancy needs independent failure modes (see Layer 2 multipath and switch clustering and the physical view in Transport resiliency, diversity, and migration).
- Redundancy - dual homing (MLAG/vPC), redundant supervisors/power, first-hop redundancy (HSRP/VRRP) at the L2/L3 boundary.
- Segmentation - smaller VLANs and PVLAN / VRF / SGT (Infrastructure segmentation) shrink and separate failure/security domains.
- Virtualization - logical separation on shared hardware; useful, but remember virtual instances on one box still share physical fate.
First-hop redundancy: protocol choice and placement
"Place FHRP correctly" means three concrete things. Protocol: HSRP (Cisco) and VRRP (standard) both give an active/standby virtual gateway - one router forwards, the other waits; GLBP (Cisco) instead load-shares per host across multiple gateways under one virtual IP, so both uplinks carry traffic. Alignment: in a Layer 2 access design (Network hierarchy and topologies) the FHRP active should be the same distribution switch as the STP root (and the primary forwarding path), or gateway traffic tromboned across the inter-switch link. Tracking: the active gateway must track its uplink and decrement priority (with preempt enabled) when that uplink fails, so it hands active to the peer - otherwise the gateway stays "alive" while its path to the core is down and black-holes the subnet. Tune sub-second timers (or use BFD) for fast failover. The cleaner escape from all of this is routed access - push L3 to the edge and FHRP disappears entirely.
Preemption timing and GLBP's topology dependence
Two second-order FHRP behaviours decide whether the design survives its own recovery. Preemption is what re-aligns the active gateway with the STP root after a failed switch returns - but a box preempts as soon as the FHRP state machine allows, which can be before it can actually forward (linecards initialising, STP converging, IGP still filling the FIB). The result is a second, self-inflicted black-hole window on every recovery; the countermeasure is a preempt delay long enough for L1 -> L2 -> L3 readiness (the platform's boot profile dictates the value, commonly minutes). GLBP has a subtler dependency: it load-shares by answering ARP with different virtual MACs round-robin, so with spanned VLANs roughly half the hosts are bound to the distribution switch whose access uplink STP is blocking (Spanning Tree - types, tuning, and loop mitigation) - their traffic permanently detours access -> forwarding uplink -> inter-distribution trunk -> gateway, unless per-VLAN STP-cost gymnastics accompany it. GLBP's benefit is real only in loop-free topologies (VLAN-per-switch, no blocked uplinks); where VLANs span, prefer HSRP/VRRP aligned to the STP root.
Recommendation / justification
Shrink L2 domains, route between them (Network hierarchy and topologies), and make redundancy genuinely independent. Prefer designs whose failure modes don't correlate - and where the SLA is strict, avoid shared-control-plane clustering. Justify each "redundant" element by asking what single event takes both halves down?
What would change this (mid-scenario twist)
- Discover a shared conduit/upstream behind "diverse" links -> re-path for true diversity.
- Strict availability target -> MLAG (independent CP) over VSS; smaller domains.
Validation checks
- For every redundant pair: what one failure takes both? (conduit, power, control plane, upstream).
- Are failure domains bounded (VLAN size, segmentation) and FHRP placed correctly?
IPv6 / dual-stack note
Apply the same domain-bounding to v6; FHRP (HSRPv6/VRRPv3) and ND scope follow the L2 domain size.
Related
- Layer 2 multipath and switch clustering
- Network hierarchy and topologies
- Infrastructure segmentation
- Transport resiliency, diversity, and migration
Spaced repetition
The one question that validates any "redundant" Layer 2 element is [...].
The one question that validates any "redundant" Layer 2 element is what single event takes both halves down? (conduit, power, shared control plane, shared upstream).
Name the four fault-isolation levers from blueprint 2.5.
Fate sharing, redundancy, segmentation, virtualization.
Why can a "redundant" VSS/StackWise pair still be a single point of failure?
They share one control plane, so a software bug or upgrade can take both halves down (shared fate).
HSRP/VRRP vs GLBP for the first-hop gateway?
HSRP (Cisco) and VRRP (standard) are active/standby - one gateway forwards, the other waits. GLBP load-shares per host across multiple gateways under one virtual IP, so both uplinks carry traffic.
Two FHRP design rules that prevent tromboning and black-holing?
Align the FHRP active with the STP root / primary forwarding path (else traffic trombones across the interlink), and make the active track its uplink and decrement priority with preempt (else it keeps active with a dead upstream and black-holes the subnet).
Why does FHRP preemption need a delay, and where does GLBP quietly underperform?
Preempting before the recovered switch can forward (linecards/STP/IGP not ready) opens a second black-hole window on every recovery - delay until L1-L3 are up. And GLBP's round-robin vMACs bind ~half the hosts to the distribution behind an STP-blocked uplink when VLANs span, forcing a permanent two-hop path - GLBP fits loop-free, VLAN-per-switch designs.
Sources
- Cisco Live BRKCRS-2031 (Cisco Plus Canada 2012): Multilayer Campus Architectures and Design Principles - preempt delay, GLBP under spanned VLANs / blocked uplinks
- Cisco Press, The Art of Network Architecture; Cisco LAN Switching.