Moving some connections to the New PA

[MP18]

We have this setup for one site 

------Dis sw--------------Edge switch stack of 3 ----------40 users 

we need to move few users behind the PA  .

what can be best design for this as we only need to have 5 to 10 users behind the PA  850.?

Should we connect small switch to the existing stack of switch ?

[OtakarKlier]

Hello,

How about a vlan and/or a subnet that routes via the PAN?

I'm sure there are many different options. I would also love to hear what the community has to say.

Regards,

[BPry]

@MP18 ,

A dedicated VLAN that routes through the PA would be what I would do, as it doesn't require any additional hardware and should be easy to maintain and update. It also doesn't require that you have someone on-site to migrate connections over to the new switch, you simply update the port configuration and assign it to the new VLAN. 

[MP18]

can we put this PA in vwire mode between the switches?

curently edge switch has 2 upliks that go to dis switch.

for the vwire to work it work in pairs

can i work with single connection for send and receive traffic?

[OtakarKlier]

Hello,

Can you provide a basic diagram? Somthing like:

switch-->router-->PAN

Please advise,

[BPry · Accepted solution]

@MP18,

If you only have a single connection to use on the PA you would be looking at doing a network TAP, which has limited capabilities, so I would really recommend the vwire setup if you want to do that. 

[MP18]

But for Vwire I will need to set of cables right  but in current setup it is not possible right?

here is diagram attached

[MP18]

how can i add visio or pdf diagram ?

system does not allow me

[MP18]

scrren shot of diagram

[OtakarKlier]

Hello,

Where is the PAN located in the diagram or is that your question?

Please advies,

[MP18]

PAN will come between the edge switches and Dis switch.

[MP18]

I have attached the diagram.

PA will be in between edge and dis switch.

Currenly edge switch only has 1 layer 3 interface which is for sw management access.

config on switch 

ip static-route 0.0.0.0/0 gateway 10.10.230.50-------------------------management network

10.10.230.x has vlan interface 3100

Edge switch has trunk interface  with link agg to dis switch  carrying below vlans

show 802.1q 1

Tagged VLANS Internal Description
-------------+------------------------------------------+
851 Raw 192.168.200.0
3100 mgmt-subnet 10.10.230.0
3203 corp-data-subnet 10.63.24.0
3303 voice-subnet 10.63.26.0
3403 corp-video-subnet 10.63.25.0

what config i will need on PA to allow traffic from edge switch to dis switch carrying trunk port with lacp?

[BorisJones]

I have same problems. Who can help me?

[MP18 · Accepted solution]

Seems best way to do is 

create vwire for both uplink connections.

here we will have 2 pair of vwires- Vwire INT and Vwire EXT

Two Zones trust and untrust

PA will pass all the LAG traffic  to dis switch from both zone trust zones.

As PA is passing traffic from both source interfaces of trust Zone and allowing return traffic from 2 dis switches we need to enable the option where PA allows asymm traffic

set deviceconfig setting tcp asymmetric-path bypass
# set deviceconfig setting session tcp-reject-non-syn no

[MP18]

did the vwire setup and it worked great.