Brocade ICX Series (cheap & powerful 10gbE/40gbE switching)
- Thread starter fohdeesha
- Start date
Notice: Page may contain affiliate links for which we may earn a small commission through services like Amazon Affiliates or Skimlinks.
Just installed the MF60101V1-1000U-G99 today in parallel with the 3 sunon housing fans in my 7250-48. ASIC temps are about 2-3c better than stock fans at 52.4c and noise level hasn't increased over the sunon mf40201vx-1000u-g99 40mm fans. Very quiet at level 1.
I also installed a temporary cover made of thin ( mostly transparent to thermal) packing tape to check component/psu temps with my thermal camera. Psu and hotter ICs were at most low 40s.
Overall, very happy with result. All 4 fans were like $28+shipping, but it will save that or more in reduced energy use over life of switch.
Update: switch installed in wiring rack under stairs. ASIC temp has settled at 60c after 24hours under light load
Attachments
Last edited:
Hi all, I am looking at getting a Brocade ICX6610 for a rack that will have a 10Gb uplink. All incoming traffic is going to be tunneled via GRE from a third party DDoS protection service.
Can the Brocade handle a tunnel (just regular GRE, no encryption) that will have inbound traffic peaking at a few Gbps? I was looking at the Mikrotik CRS354 at first, but from my research none of the tunneling is offloaded from the CPU so the performance is bad.
Can the Brocade handle a tunnel (just regular GRE, no encryption) that will have inbound traffic peaking at a few Gbps? I was looking at the Mikrotik CRS354 at first, but from my research none of the tunneling is offloaded from the CPU so the performance is bad.
Brocade firmware Question: 7250 and 7150 currently on 8080 - if i wish to go to 8092; can I upgrade from 8080 to 8092 -or- must I upgrade to 8090 and then 8092 ? thanks
yes, I actually have an icx6610 doing exactly this in NYC (terminating a GRE tunnel from a ddos provider). it's all done in hardware at line rate. note than enabling gre tunnels disables a couple counter features like ipv6 ACLs. full details starting on page 103 of fastiron-08030mb-l3guide.pdf
Thank you so much! Glad to hear that I can do this without issue.
Question about the licensing - I just bought a BNIB one on eBay ( ICX6610-48-PI ) which has the Premium license. I saw somebody selling a license for the 10G upgrade on ebay so I bought that as well, but the listing says that the advanced license features are now included in the premium license. Can you confirm that or will I need to find an advances license to use GRE?
you don't need an advanced license, it's merged into premium, and as the first sentence of this thread says, the port license you just spent $$$ on are free
I must do something fundamental wrong in the L3 routing. I placed my question in a separate thread (see below). But maybe here in this Brocade thread I can find more guys that are familiar with FastIron.
What I want to achieve is to move the L3 routing between two networks (LAN and DMZ) from the firewall to the brocade switch. In theory this should work, but not with my config as linked below.
Any Idea where the mistake is?
What I want to achieve is to move the L3 routing between two networks (LAN and DMZ) from the firewall to the brocade switch. In theory this should work, but not with my config as linked below.
Any Idea where the mistake is?
did you configure your DHCP to provide 10.2 and 2.2 as the default gateway for your clients (per DHCP scope) ?
and you do not need 2x 0.0.0.0 routes as your brocade switch should be the router itself.. it will forward the traffic either to 192.168.2.1 (over interface ve1) or to 192.168.10.1 (over interface ve10) / choose one ..
(Client to Client example)
Client [10.x]--->>Brocade[192.168.10.2]--->>[192.168.2.2]--->>client2[192.168.2.x]
(internet example 1 - if you wish to keep the 10.1 route and drop the 2.1 route)
Client [10.x]--->>Brocade[192.168.10.2]--->>router[192.168.10.1]--->>internet
(internet example 2 - if you wish to keep the 2.1 route and drop the 10.1 route)
Client [10.x]--->>Brocade[192.168.10.2]--->>[192.168.2.2]-->>router[192.168.2.1]--->>internet
also make sure your router knows the route back to both interfaces.... either through the route on an interface or the static added route..
let's take 192.168.2.0/24 as the primary subnet (internet example 2) -.. then you'd need to add: 192.168.10.0/24 --> next-hop - 192.168.2.2 and your Brocade only has 1 default route of 0.0.0.0/0 --> 192.168.2.2
you cannot create an asynchronous routing - where a packet from 192.168.10.x to internet is routed through the Brocade to 192.168.2.2 - to 192.168.2.1 to internet.. and back via internet->192.168.10.1--> 192.168.10.x , bypassing the brocade router completely - most firewalls will block this and a lot of protocols cannot handle this.. so make sure your routing outbound passes the same routers as the return traffic
if you want to retain dual routing tables (also possible) - your clients will essentially have 192.168.2.1 and 192.168.10.1 as their default gateway (for 0.0.0.0/0 traffic) and you will manually have to add a route for 192.168.10.0/24 next-hop 192.168.2.2 on the 192.168.2.0/24 clients and 192.168.2.0/24 next-hop 192.168.10.2 for the 10.x clients..
and you do not need 2x 0.0.0.0 routes as your brocade switch should be the router itself.. it will forward the traffic either to 192.168.2.1 (over interface ve1) or to 192.168.10.1 (over interface ve10) / choose one ..
(Client to Client example)
Client [10.x]--->>Brocade[192.168.10.2]--->>[192.168.2.2]--->>client2[192.168.2.x]
(internet example 1 - if you wish to keep the 10.1 route and drop the 2.1 route)
Client [10.x]--->>Brocade[192.168.10.2]--->>router[192.168.10.1]--->>internet
(internet example 2 - if you wish to keep the 2.1 route and drop the 10.1 route)
Client [10.x]--->>Brocade[192.168.10.2]--->>[192.168.2.2]-->>router[192.168.2.1]--->>internet
also make sure your router knows the route back to both interfaces.... either through the route on an interface or the static added route..
let's take 192.168.2.0/24 as the primary subnet (internet example 2) -.. then you'd need to add: 192.168.10.0/24 --> next-hop - 192.168.2.2 and your Brocade only has 1 default route of 0.0.0.0/0 --> 192.168.2.2
you cannot create an asynchronous routing - where a packet from 192.168.10.x to internet is routed through the Brocade to 192.168.2.2 - to 192.168.2.1 to internet.. and back via internet->192.168.10.1--> 192.168.10.x , bypassing the brocade router completely - most firewalls will block this and a lot of protocols cannot handle this.. so make sure your routing outbound passes the same routers as the return traffic
if you want to retain dual routing tables (also possible) - your clients will essentially have 192.168.2.1 and 192.168.10.1 as their default gateway (for 0.0.0.0/0 traffic) and you will manually have to add a route for 192.168.10.0/24 next-hop 192.168.2.2 on the 192.168.2.0/24 clients and 192.168.2.0/24 next-hop 192.168.10.2 for the 10.x clients..
Last edited:
Thank you. I will go through your text in detail the next days.
The idea behind the two routes was that I wanted to use the bandwidth of three available ports at the OPNsense firewall by avoiding VLAN and LAG on firewall side. So, I connected LAN and DMZ network to separate interfaces on the firewall (untacked port at Bracade). This basically is the same configuration I am running with brocade as L2 switch and the firewall as only router. What I did for testing was adding ve on Brocade side to both VLAN, creating of ACLs, adding the routes mentioned above and manually change the default gateway on the clients to the brocade IP. Traffic to and from DMZ was supposed to take the ve10 and traffic two and from the LAN was supposed to take the other ve1. But this seems to be not possible in this way.
But for sure. If my idea was not good or wrong, any advice for best practice is welcome.
Sorry, to answer by two posts. But I first needed some time to understand your answer. This was very helpful for me.
What you described with dual routing tables seems to be exactly what I wanted to achieve. Now I know how to name it. Now it also is clear to me what I did wrong: Default gateway for clients to switch (.10.2 and 2.2) instead to firewall (10.1 and 2.1) and no next hop to the switch on the clients.
The need for a manual configuration of the next hop on the clients would be possible for me but seems to be not the "elegant way". The more common approach, if my understanding is correct, would be a set-up like shown below:
Networks 192.168.2.0/24 and 192.168.10.0/24 are present only on the L3 switch and the the L3 switch is default gateway for the clients. Default route on the switch for 0.0.0.0/0 trough tunnel network 192.168.1.0/30 to the firewall. For VLAN 20, 30 and 40 the switch is doing L2 switching only. No ve and no routing for these.
Or any better idea?
yups that works too.. all clients point to your switch, and your switch points to the router with the default route in the virtual router on the 192.168.1.0/30 subnet..
by not giving the 20/30/40 VLAN's an interface, you essentially take them out of the L3 option of the switch.. and they would be normal untagged or tagged traffic inside the switch..
by not giving the 20/30/40 VLAN's an interface, you essentially take them out of the L3 option of the switch.. and they would be normal untagged or tagged traffic inside the switch..
Is there a good source for newer firmware? The fohdeesha website for the ICX 7250 has 2019 Firmware. If I can find newer firmware is there any reason not to upgrade?
Just get a username and password to the brocade website and download whatever version you want.
Here is their site, just click on the Download tab and select the version you want. Go to that page and select download. Enter username and password to get it.
Ruckus ICX 7250 Campus Switches | Products | Ruckus Wireless Support
Here is their site, just click on the Download tab and select the version you want. Go to that page and select download. Enter username and password to get it.
Ruckus ICX 7250 Campus Switches | Products | Ruckus Wireless Support
So is the number the feature set followed by the security revision? I see 8.0.70h, released on Jan 18th 2021. So this would be a much older release with backported security fixes?
My main concern is the licensing. Is the "Honor system" still present even on .95?
I haven't tried 95, but 92 still works
I am not an expert, but from what I understand each 8.0.xx is a release train and the letters are different rev's of that release train.
.90 or higher was needed to work with Ruckus Unleashed, so I went with .92. Why-It was newer than .90 and older than .95 and seems to have been out long enough to have most of the bugs worked out.
I am not an expert, but from what I understand each 8.0.xx is a release train and the letters are different rev's of that release train.
.90 or higher was needed to work with Ruckus Unleashed, so I went with .92. Why-It was newer than .90 and older than .95 and seems to have been out long enough to have most of the bugs worked out.