Implementing High-Availability and Loop-Free Traffic Forwarding in a Tiered Data Center Using VRRP and MSTP

In a multi-tier data center deployment, ensuring link redundancy, eliminating broadcast domains, enforcing perimeter security, and maintaining scalable routing are fundamental design principles. The following architecture demonstrates how to integrate Virtual Router Redundancy Protocol (VRRP), Multiple Spanning Tree Protocol (MSTP), Open Shortest Path First (OSPF), and stateful firewall inspection within a three-layer topology.

Architectural Objectives

The network relies on distinct access, aggregation, and core layers. Key operational goals include:

  • Seamless upstream failover when an aggregation link drops.
  • Strict loop prevention between access and aggregation tiers.
  • Mandatory security policy evaluation for all east-west and north-south traffic exiting the core.
  • Dynamic routing convergence across Layer 3 boundaries.

Spanning Tree & Topology Control

MSTP partitions the network into independent spanning tree instances, allowing per-VLAN load balancing and deterministic root bridges. Domain membership requires synchronized region names, revision levels, and VLAN-to-instance mappings.

To establish predictable forwarding paths:

  • Instance 1 maps to VLAN 2, with AGG-CORE1 designated as the primary root and AGG-CORE2 as secondary.
  • Instance 2 maps to VLAN 3, reversing the hierarchy so AGG-CORE2 becomes primary and AGG-CORE1 secondary.
  • Legacy cost calculation ensures compatibility with existing infrastructure metrics.
  • Manual cost elevation (20000) on specific inter-switch links forces STP topology optimization.
  • Edge ports accelerate transition on server-facing interfaces.
# Global MSTP Region Configuration Template
[~AGG-CORE1] stp region-configuration
[~AGG-CORE1-mst-region] region-name DC-PROD
[*AGG-CORE1-mst-region] instance 1 vlan 2
[*AGG-CORE1-mst-region] instance 2 vlan 3
[*AGG-CORE1-mst-region] revision-level 1
[*AGG-CORE1-mst-region] commit
[*AGG-CORE1-mst-region] quit

# Root Bridge Assignment Per Instance
[~AGG-CORE1] stp instance 1 root primary
[*AGG-CORE1] stp instance 2 root secondary
[~AGG-CORE2] stp instance 1 root secondary
[*AGG-CORE2] stp instance 2 root primary

# Cost Standard & Manual Adjustments
[~AGG-CORE1] stp pathcost-standard legacy
[*AGG-CORE1] interface XGE1/1/2
[*AGG-CORE1-XGE1/1/2] description LINK-TO-ACC-NORTH1
[*AGG-CORE1-XGE1/1/2] stp instance 1 cost 20000
[*AGG-CORE1-XGE1/1/2] stp root-protection

Layer 2 Segmentation & VLAN Distribution

Creating isolated broadcast domains is critical before enabling redundant gateways. Trunk links must explictily permit only active VLANs, while access ports assign host traffic to the appropriate segment.

# Aggregation Tier VLAN Setup
[~AGG-CORE1] vlan batch 2 3 100 101
[~AGG-CORE2] vlan batch 2 3 100 101

# Interface Trunk Configuration
[~AGG-CORE1] interface XGE1/1/1
[*AGG-CORE1-XGE1/1/1] port link-type trunk
[*AGG-CORE1-XGE1/1/1] undo port trunk allow-pass vlan 1
[*AGG-CORE1-XGE1/1/1] port trunk allow-pass vlan 2
[~AGG-CORE1] interface XGE1/1/3
[*AGG-CORE1-XGE1/1/3] port trunk allow-pass vlan 2 3

# Access Tier Server Uplinks
[~ACC-NORTH1] interface XGE1/1/3
[*ACC-NORTH1-XGE1/1/3] port link-type access
[*ACC-NORTH1-XGE1/1/3] port default vlan 2
[*ACC-NORTH1-XGE1/1/3] stp edged-port enable

Gateway Redundancy via VRRP

Virtual Router Redundancy Protocol provides a floating IP address that survives physical link failures. Distributing Master/Backup responsibilities across different VLANs prevents bottleneck formation and enables utilization-based traffic distribution.

# VRRP Group 1 on VLANIF 2 (Traffic destined for VLAN 2)
[~AGG-CORE1] interface Vlanif2
[*AGG-CORE1-Vlanif2] ip address 10.1.2.10 24
[*AGG-CORE1-Vlanif2] vrrp vrid 1 virtual-ip 10.1.2.100
[*AGG-CORE1-Vlanif2] vrrp vrid 1 priority 130
[*AGG-CORE1-Vlanif2] vrrp vrid 1 preempt-mode timer delay 15
[~AGG-CORE2] interface Vlanif2
[*AGG-CORE2-Vlanif2] ip address 10.1.2.11 24
[*AGG-CORE2-Vlanif2] vrrp vrid 1 virtual-ip 10.1.2.100

# VRRP Group 2 on VLANIF 3 (Traffic destined for VLAN 3)
[~AGG-CORE2] interface Vlanif3
[*AGG-CORE2-Vlanif3] ip address 10.1.3.10 24
[*AGG-CORE2-Vlanif3] vrrp vrid 2 virtual-ip 10.1.3.100
[*AGG-CORE2-Vlanif3] vrrp vrid 2 priority 130
[*AGG-CORE2-Vlanif3] vrrp vrid 2 preempt-mode timer delay 15
[~AGG-CORE1] interface Vlanif3
[*AGG-CORE1-Vlanif3] ip address 10.1.3.11 24
[*AGG-CORE1-Vlanif3] vrrp vrid 2 virtual-ip 10.1.3.100

Layer 3 Routing & Perimeter Security

OSPF facilitates rapid convergence across the aggregation and core tiers. To enforce zero-trust principles, all external-bound traffic is intercepted by a pair of Next-Generation Firewalls operating in active-active mode with Hot Standby Router Protocol (HRP) synchronization.

# OSPF Area 0 Advertisement
[~CORE-RTR1] ospf 1 router-id 10.99.1.1
[*CORE-RTR1-ospf-1] area 0
[*CORE-RTR1-ospf-1-area-0.0.0.0] network 10.1.2.0 0.0.0.255
[*CORE-RTR1-ospf-1-area-0.0.0.0] network 10.1.3.0 0.0.0.255
[*CORE-RTR1-ospf-1-area-0.0.0.0] network 172.20.0.0 0.0.0.255

# Firewall Interface & Zone Assignment
[~FW-PRIMARY] interface GE1/0/1
[*FW-PRIMARY-GE1/0/1] ip address 172.20.1.1 24
[~FW-PRIMARY] firewall zone trust
[*FW-PRIMARY-zone-trust] add interface GE1/0/1
[~FW-PRIMARY] firewall zone untrust
[*FW-PRIMARY-zone-untrust] add interface GE1/0/2
[~FW-PRIMARY] firewall zone dmz
[*FW-PRIMARY-zone-dmz] add interface Eth-Trunk 1

# HRP Stateful Failover Configuration
[~FW-PRIMARY] hrp enable
[*FW-PRIMARY] hrp interface Eth-Trunk1 remote 172.20.10.1
[*FW-PRIMARY] hrp mirror session enable
[*FW-PRIMARY] hrp track interface GE1/0/1
[*FW-PRIMARY] hrp adjust ospf-cost enable

Traffic Steering via Policy Routing

Standard routing would bypass the security appliances. To mandate inspection, explicit ACLs identify target subnets, and traffic behavior directives redirect matched packets to firewall next-hop addresses using weighted load balancing.

# ACL Definition for Outbound Inspection
[~CORE-RTR1] acl advanced 3000
[*CORE-RTR1-acl-adv-3000] rule 5 permit ip source 10.1.2.0 0.0.0.255
[*CORE-RTR1-acl-adv-3000] rule 10 permit ip source 10.1.3.0 0.0.0.255

# Classifier & Behavior Mapping
[~CORE-RTR1] traffic classifier c-firewall
[*CORE-RTR1-classifier-c-firewall] if-match acl 3000
[~CORE-RTR1] traffic behavior b-inspect
[*CORE-RTR1-behavior-b-inspect] redirect load-balance nexthop 172.20.1.1 172.20.1.2

# Policy Application
[~CORE-RTR1] traffic-policy p-steer inbound
[*CORE-RTR1-trafficpolicy-p-steer] classifier c-firewall behavior b-inspect
[*CORE-RTR1-trafficpolicy-p-steer] quit
[~CORE-RTR1] interface XGE1/1/1
[*CORE-RTR1-XGE1/1/1] traffic-policy p-steer inbound

Ingress Filtering & DoS Mitigation

Network perimeter defenses require rate-limiting protocols susceptible to amplification or scanning attacks. Built-in defense profiles automatically drop malformed or excessive traffic before it consumes upstream bandwidth.

# Default Security Posture
[~FW-PRIMARY] firewall defend syn-flood enable
[~FW-PRIMARY] firewall defend syn-flood zone untrust max-rate 25000
[~FW-PRIMARY] firewall defend udp-flood zone untrust max-rate 2000
[~FW-PRIMARY] firewall defend icmp-flood zone untrust max-rate 25000
[~FW-PRIMARY] firewall defend ip-sweep max-rate 5000
[~FW-PRIMARY] firewall defend port-scan max-rate 5000
[~FW-PRIMARY] firewall defend ip-fragment enable
[~FW-PRIMARY] firewall defend ip-spoofing enable

Validation Procedures

Confirming protocol state machine transitions guarantees design integrity. Execute the following diagnostics post-deployment.

# Verify VRRP Master/Backup Assignment
<AGG-CORE1> display vrrp verbose
  Vlanif2 | Virtual Router 1
    State : Master
    Virtual IP : 10.1.2.100
    PriorityRun : 130
    Preempt : YES   Delay Time : 15 s

  Vlanif3 | Virtual Router 2
    State : Backup
    Virtual IP : 10.1.3.100
    PriorityRun : 100

# Confirm OSPF Neighbor Adjacency
<AGG-CORE1> display ospf peer brief
Peers Internal: 2
Area 0.0.0.0 Total: 2

Referecne Configurations

Complete operational snapshots for all participating nodes.

sysname AGG-CORE1
vlan batch 2 3 100 101
stp region-configuration
 region-name DC-PROD
 instance 1 vlan 2
 instance 2 vlan 3
 revision-level 1
 commit
stp instance 1 root primary
stp instance 2 root secondary
stp pathcost-standard legacy
interface Vlanif2
 ip address 10.1.2.10 255.255.255.0
 vrrp vrid 1 virtual-ip 10.1.2.100
 vrrp vrid 1 priority 130
 vrrp vrid 1 preempt timer delay 15
interface Vlanif3
 ip address 10.1.3.11 255.255.255.0
 vrrp vrid 2 virtual-ip 10.1.3.100
interface XGE1/1/1
 description LINK-TO-ACC-NORTH1
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 2
 stp root-protection
interface XGE1/1/2
 description LINK-TO-CORE-RTR1
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 100
 stp instance 1 cost 20000
ospf 1
 area 0.0.0.0
  network 10.1.2.0 0.0.0.255
  network 10.1.3.0 0.0.0.255
  network 172.20.0.0 0.0.0.255
return

sysname AGG-CORE2
vlan batch 2 3 100 101
stp region-configuration
 region-name DC-PROD
 instance 1 vlan 2
 instance 2 vlan 3
 revision-level 1
 commit
stp instance 1 root secondary
stp instance 2 root primary
stp pathcost-standard legacy
interface Vlanif2
 ip address 10.1.2.11 255.255.255.0
 vrrp vrid 1 virtual-ip 10.1.2.100
interface Vlanif3
 ip address 10.1.3.10 255.255.255.0
 vrrp vrid 2 virtual-ip 10.1.3.100
 vrrp vrid 2 priority 130
 vrrp vrid 2 preempt timer delay 15
interface XGE1/1/1
 description LINK-TO-ACC-NORTH2
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 3
 stp root-protection
ospf 1
 area 0.0.0.0
  network 10.1.2.0 0.0.0.255
  network 10.1.3.0 0.0.0.255
  network 172.20.0.0 0.0.0.255
return

sysname ACC-NORTH1
vlan batch 2
stp region-configuration
 region-name DC-PROD
 instance 1 vlan 2
 instance 2 vlan 3
 revision-level 1
 commit
stp pathcost-standard legacy
interface XGE1/1/1
 description LINK-TO-AGG-CORE1
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 2
interface XGE1/1/2
 description LINK-TO-AGG-CORE2
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 2
 stp instance 1 cost 20000
interface XGE1/1/3
 description LINK-SRV-GW
 port default vlan 2
 stp edged-port enable
return

sysname ACC-NORTH2
vlan batch 3
stp region-configuration
 region-name DC-PROD
 instance 1 vlan 2
 instance 2 vlan 3
 revision-level 1
 commit
stp pathcost-standard legacy
interface XGE1/1/1
 description LINK-TO-AGG-CORE2
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 3
interface XGE1/1/2
 description LINK-TO-AGG-CORE1
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 3
 stp instance 2 cost 20000
interface XGE1/1/3
 description LINK-SRV-GW
 port default vlan 3
 stp edged-port enable
return

sysname CORE-RTR1
vlan batch 100 101 102 103
acl advanced 3000
 rule 5 permit ip source 10.1.2.0 0.0.0.255
 rule 10 permit ip source 10.1.3.0 0.0.0.255
traffic classifier c-firewall
 if-match acl 3000
traffic behavior b-inspect
 redirect load-balance nexthop 172.20.1.1 172.20.1.2
traffic-policy p-steer inbound
 classifier c-firewall behavior b-inspect precedence 5
interface Vlanif100
 ip address 10.1.6.10 24
interface Vlanif102
 ip address 172.20.1.2 24
interface Vlanif103
 ip address 172.20.2.2 24
interface XGE1/1/1
 description LINK-TO-AGG-CORE1
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 100
 traffic-policy p-steer inbound
ospf 1
 router-id 10.99.1.1
 area 0.0.0.0
  network 10.1.6.0 0.0.0.255
  network 172.20.1.0 0.0.0.255
  network 172.20.2.0 0.0.0.255
return

sysname FW-PRIMARY
hrp enable
hrp interface Eth-Trunk1 remote 172.20.10.1
hrp mirror session enable
hrp track interface GE1/0/1
hrp adjust ospf-cost enable
firewall zone trust
 set priority 85
 add interface GE1/0/1
add interface GE1/0/3
firewall zone untrust
 set priority 5
 add interface GE1/0/2
add interface GE1/0/4
firewall zone dmz
 set priority 50
 add interface Eth-Trunk1
firewall packet-filter default permit interzone local dmz direction inbound
firewall defend syn-flood enable
firewall defend syn-flood zone untrust max-rate 25000
firewall defend udp-flood zone untrust max-rate 2000
firewall defend icmp-flood zone untrust max-rate 25000
firewall defend ip-sweep enable
firewall defend port-scan enable
ips enable
policy interzone trust untrust outbound
 policy 1
  action permit
  profile ips default
  policy source 10.1.2.0 mask 24
  policy source 10.1.3.0 mask 24
policy interzone trust untrust inbound
 policy 1
  action permit
  profile ips default
  policy service http ftp
  policy destination 10.1.2.0 mask 24
  policy destination 10.1.3.0 mask 24
ospf 1 router-id 172.16.100.1
 area 0.0.0.0
  network 172.20.1.0 0.0.0.255
ospf 2 router-id 172.16.100.2
 area 0.0.0.0
  network 172.20.2.0 0.0.0.255
return

Tags: VRRP MSTP OSPF Data Center Networking High Availability

Posted on Fri, 11 Sep 2026 16:54:04 +0000 by iamchris

Hot Tags

©2026 Freaks City