Switch virtualisation: StackWise, VSS, StackWise Virtual and multichassis EtherChannel

Why make many switches act as one

Redundant designs normally have two distribution switches with uplinks from every access switch to both. Spanning tree blocks one of those uplinks, first-hop redundancy protocols such as HSRP are needed for the gateway, and engineers manage two separate devices. Switch virtualisation joins physical switches into one logical switch with one configuration and one control plane. The access switch then sees a single neighbour and can bundle its uplinks.

Stacking at the access layer

Stackable switches, such as those using Cisco StackWise, connect through dedicated stack cables on the back, forming a ring. One member is elected active and runs the control plane for the whole stack, another is standby ready to take over, and the rest are members. You manage the stack through one IP address, and interfaces are numbered by member, such as GigabitEthernet3/0/12 for port 12 on switch 3.

switch 1 priority 15
switch 2 priority 14
show switch
show switch stack-ports

Higher priority decides which member becomes active. A cross-stack EtherChannel, with uplinks from member 1 and member 3, keeps the closet connected if one switch fails. Some ranges also share power between members (StackPower). Keep members on the same software version, or they will not join.

VSS and StackWise Virtual

Larger chassis and distribution switches cannot use stack cables. The Virtual Switching System (VSS), introduced on the Catalyst 6500 and later used on the 4500-E and 6800, joins exactly two switches over a virtual switch link (VSL), an EtherChannel of ordinary 10 Gb/s or faster ports. One chassis has the active control plane and the other is hot standby, but both forward traffic. On current Catalyst 9000 switches the same idea is called StackWise Virtual (SVL).

stackwise-virtual
 domain 10
interface range TenGigabitEthernet1/0/47 - 48
 stackwise-virtual link 1
interface TenGigabitEthernet1/0/46
 stackwise-virtual dual-active-detection

The configuration is applied on both switches before a reload, after which they boot as one. Exact commands depend on the platform and release, so follow the vendor guide for your model.

Multichassis EtherChannel and dual-active detection

Once two switches form one logical switch, an access switch can bundle one uplink to each into a multichassis EtherChannel (MEC). Both links forward, spanning tree sees one link, and if a distribution switch fails the access switch simply loses half its bandwidth. The pair also provides a single gateway address, so HSRP or VRRP is no longer needed.

The danger is the VSL failing while both switches stay up. Each would believe the other has died and become active with the same addresses, a split brain that can disrupt the whole network. Dual-active detection uses a separate path, such as a dedicated direct link or enhanced PAgP messages through an access switch, to notice this. The previously active switch then shuts down its interfaces until the link is fixed.

Data centre Nexus switches use a different approach, vPC (virtual port channel), where the two switches keep separate control planes but still present one EtherChannel to downstream devices.

Real-world example: an office building upgrade

An insurance company's office had two distribution switches running HSRP and Rapid PVST+, with half the access uplinks blocked. During a refresh the team installed two Catalyst 9500 switches as a StackWise Virtual pair with a two-port 40 Gb/s link and a dedicated dual-active detection link. Each floor's access stack now has a four-link MEC, two links to each core member. In a later test, the team powered off one core switch: the floors lost no sessions, and video calls continued with only a brief pause.