Nexus vPC Print[1]

8/3/2019 Nexus vPC Print[1]

1/26

2009 FastLane, All rights reserved.

2008 Cisco Systems, Inc. All rights reserved. Course acronym vx.x#-1

NX/OS vPC

N7K 4.2(1)N5K 4.1(5)


Overview of vPC


2/26



A virtual port channel (vPC) allows links that are physicallyconnected to two different Cisco Nexus 7000 Series devices toappear as a standard single port channel by a third device

vPC overview


Differences between VSS and vPC

VSS (Cat6500)

Single control plane

Configuration on one device

Control plane crash affects bothchassis

Two supervisor engines max(active/standby)

Static/PAgP/PAgP+/LACP

vPC (Nexus)

Two independent controlplanes

Two configurations to manage

Up to 4 Supervisors (two in each

chassis) offering maximum HA

LACP/static


3/26



vPC overview

The third device can be a switch, server, or any other networking device.

You can configure up to 192 vPCs per device.

A vPC can provide Layer 2 multipathing, which allows you to createredundancy by increasing bisectional bandwidth by enabling multipleparallel paths between nodes and load balancing traffic wherealternative paths exist.


vPC Benefits

Allows a single device to use a port channel across two upstreamdevices

Eliminates Spanning Tree Protocol (STP) blocked ports

Provides a loop-free topology

Uses all available uplink bandwidth

Provides fast convergence if either the link or a device fails Provides link-level resiliency

Assures high availability


4/26



vPC limitations

You can use only Layer 2 port channels in the vPC.

All members in a single vPC on each device must belong to a single VDCon the device.

The vPC peer link must use 10-Gigabit Ethernet ports

Each VDC must be configured individually

Separate Peer links are required

Building a vPC between two VDCs on the same chassis is not supported

To ensure that you have the correct hardware to enable and run vPCbeginning with Cisco NX-OS Release 4.1(5), enter the show hardwarefeature-capability command. If you see an X across from vPC, yourhardware cannot enable the vPC feature. (an EPLD update may berequired)


vPC configuration

You configure the port channels by using one of the following:

No protocol - When you configure the port channels without usingLACP, each device can have up to eight active links in a single portchannel.

Link Aggregation Control Protocol (LACP) - When you configurethe port channels in a vPC using LACP, each device can have eight

active links and eight standby links in a single port channel.


5/26



vPC links

Peer-keepalive link - sends heartbeat messages between the two vPCpeer devices.

Peer link makes two linked Nexus devices to appear as one device toa third device.

Port channel recommended to use two or more of the 10-Gigabit Ethernet ports in dedicated mode. (on at least twodifferent N7K-M132XP-12 modules)

Recommend: you configure the Layer 2 port channels as atrunks


vPC Domain

vPC domain includes:

both vPC peer devices

vPC peer-keepalive link

the vPC peer link

all of the port channels in the vPC domain connected to the

downstream device vPC domain limitations:

You can have only one vPC domain ID on each device.

In this version, you can connect each downstream device to a singlevPC domain ID using a separate port channel.


6/26



vPC Interfaces in one VDC


vPC Terminology

vPCThe combined port channel between the vPC peer devices andthe downstream device.

vPC peer device One of a pair of devices that are connected withthe special port channel known as the vPC peer link.

vPC peer link The link used to synchronize states between the vPCpeer devices. Both ends must be on 10-Gigabit Ethernet interfaces.

vPC domain This domain is formed by the two vPC peer linkdevices. It is also a configuration mode for configuring some of the vPCpeer link parameters.

vPC peer-keepalive link The peer-keepalive link between vPC peerdevices to ensure that both devices are up. (IP connectivity)

vPC member port Interfaces that belong to the vPCs.


7/26



Invalid vPC Configurations

You can have only two devices as vPC peers

Each device/VDC can serve as a vPC peer to only one other vPC peer.

Note: The vPC peer devices can also have non-vPC links to other devices.


vPC peer link Primary / Secondary

When you configure the vPC peer link, the vPC peer devices negotiatethat one of the connected devices is the primary device and the otherconnected device is the secondary device.

The NX-OS software uses the lowest MAC address to elect the primarydevice.

If the primary device fails, the secondary device becomes the newprimary when the system recovers and the previously primary device isnow the secondary device.

You can also configure which of the vPC devices is primary. (Changingthe priority of the vPC peer devices can cause link flap.)


8/26


9/26



vPC synchronization

The software keeps the multicast forwarding state synchronized on bothof the vPC peer devices.

All MAC addresses for those VLANs configured on both devices aresynchronized between vPC peer devices.

The software uses CFSoE for these synchronizations.

CFSoE


Traffic flows in a vPC environment

An artificial "peer link traffic filter" was introduced between the lower vPCmember ports and the upper non-vPC ports (of course, this filter is just alogical representation that has no relation with the real hardwareimplementation.) Traffic that has crossed the peer link is tagged internallyand will not be allowed to be forwarded through the filter. Thismechanism will allow the traffic received from the vPC member port to belocally forwarded, while still providing connectivity to the ports that arenot part of a vPC.


10/26



Traffic Flows in a vPC environment

When switch B sends a frame to switch D, the destination address for switch D is unknownand the traffic must be flooded. Again, all the devices belonging to a vPC can be reacheddirectly and S1 replicates the frame to the vPC member ports leading to switches C and D.However, the frame must also be flooded to the non-vPC members. When it is sent on the peerlink, an internal header carrying a special bit is added to the frame in order to specify that thistraffic has already been sent to the vPC members. As a result, when vPC peer S2 receives theframe, the filter prevents it from being duplicated to its local vPC members and it is onlyforwarded to switch E. At the same time, a software update carried by CFS advertises to S2that MAC address B was learnt on vPC. This information will allow S2 to send the reply fromswitch D to switch B directly on its local vPC member port, even if S2 never received trafficfrom switch B on this port.


vPC Spanning Tree implementation

During the vPC domain setup, a vPC peer is elected as primary. The primary peer willbe responsible for running STP on all the vPC ports of the vPC domain. So logically, avPC is a simple channel located on the primary vPC peer switch from the perspectiveof STP. The state of the vPC member ports located on the secondary peer iscontrolled remotely by the primary.Still, BPDUs can be exchanged on all the physical links belonging to a vPC. Primaryswitch S1 can send and receive BPDUs on both paths available to bridge C. SwitchesS1 and S2 are programmed so that the BPDUs can be switched in hardware towardtheir final destination.


11/26



vPC / HSRP integration

An improvement was made tothe forwarding engine to allowlocal Layer 3 forwarding atboth the active HSRP peer andat the standby HSRP peer. Thisprovides in effect anactive/active HSRPconfiguration with no changesto current HSRP configurationrecommendations or bestpractices and no changes tothe HSRP protocol either. TheHSRP control protocol stillacts like an active/standbypair, such that only the activedevice responds to ARPrequests, but a packetdestined to the shared HSRPMAC address is accepted aslocal on either the active orstandby HSRP device.


vPC peer link failure

If the switch A vPC peer link fails ( ), the software checks the statusof the remote vPC peer B using the peer-keepalive link. If the vPC peerB is up, the secondary vPC A disables all vPC ports on its device, ( )to prevent loops and blackholing or flooding traffic. The data thenforwards down the remaining active links of the port channel.

keepalive

A B


12/26



vPC peer failure

The software learns of a vPC peer device failure when the keepalivemessages are not returned over the peer-keepalive link

You use a separate link (vPC peer-keepalive link) to send configurablekeepalive messages between the vPC peer devices. The keepalivemessages on the vPC peer-keepalive link determines whether a failureis on the vPC peer link only or on the vPC peer device. The keepalivemessages are used only when all the links in the peer link fail.

keepalive

A B


Features That You Must Manually Configure on the Primary andSecondary Devices

STP root Configure the primary vPC peer device as the highest STProot priority, and configure the secondary device with a lower rootpriority.

STP hello time Configure the STP hello time on both the primaryand secondary root switch to 4 seconds.

Layer 3 VLAN network interface Configure Layer 3 connectivity

from each vPC peer device by configuring a VLAN network interface forthe same VLAN from both devices.

HSRP active If you want to use HSRP and VLAN interfaces on thevPC peer devices, configure the primary vPC peer device with theHSRP active highest priority. Configure the secondary device to be theHSRP standby. And ensure that you have VLAN interfaces on eachvPC device.

Configure Unidirectional Link Detection (UDLD) on both sides of thevPC peer link.


13/26



Peer-Keepalive Link and Messages

The Cisco NX-OS software uses the peer-keepalive link between thevPC peers to transmit periodic, configurable keepalive messages.

You must use a Layer 3 link between the peer devices to transmit thesemessages

System cannot bring up the vPC peer link unless the peer-keepalive linkis configured

Configure a separate VRF and put a Layer 3 port from each vPC peerdevice into that VRF for the vPC peer-keepalive link.

If you do not configure a separate VRF, the system used themanagement VRF and management ports by default

The default keepalive interval time is 1 second ( b/w 400 and 10000 ms)

The default timeout value is 5 seconds ( b/w 3 and 20 seconds)


vPC Domain

You can use the vPC domain ID to identify the vPC peer links and theports that are connected to the vPC downstream devices.

The vPC domain is also a configuration mode that you use to configurethe keepalive messages, and configure other vPC peer link parameters.

To create a vPC domain, you must first create a vPC domain ID oneach vPC peer device using a number from 1 to 1000.

You can have only one vPC domain per VDC. You must explicitly configure the port channel that you want to act as

the peer link on each device.

You associate the port channel that you made a peer link on eachdevice with the same vPC domain ID to form a single vPC domain.

Within this domain, the system provides a loop-free topology and Layer2 multipathing.

You can only configure port channels and vPC peer links statically.


14/26



Compatibility Parameters for vPC Peer

Links that MUST match 1/4 Port-channel mode: on (static), passive or active (LACP)

Link speed per channel

Duplex mode per channel

Trunk mode per channel:

Native VLAN

Tagging of native VLAN traffic

Spanning Tree Protocol (STP) mode

STP region configuration for Multiple Spanning Tree

Enable/disable state per VLAN


Compatibility Parameters for vPC PeerLinks that MUST match (cont.) 2/4

STP global settings:

Bridge Assurance setting

Port type settingWe recommend that you set all vPC interfaces asnetwork ports.

Loop Guard settings

STP interface settings:

Port type setting

Loop Guard

Root Guard

Maximum Transmission Unit (MTU)


15/26



Compatibility Parameters for vPC Peer

Links that SHOULD match 3/4 MAC aging timers

Static MAC entries

VLAN interfaceEach device on the end of the vPC peer link must have aVLAN interface configured for the same VLAN on both ends and they must be inthe same administrative and operational mode. Those VLANs configured ononly one device of the peer link do not pass traffic using the vPC or peer link.You must create all VLANs on both the primary and secondary vPC devices, orthe VLAN will be suspended.

All ACL configurations and parameters

Quality of Service (QoS) configuration and parameters

STP interface settings:

BPDU Filter BPDU Guard

Cost

Link type

Priority

VLANs (Rapid PVST+)


Compatibility Parameters for vPC PeerLinks that SHOULD match (cont.) 4/4

VLANs allowed on trunk

Port security

Cisco Trusted Security (CTS)

Network Access Control (NAC)

Internet Group Management Protocol (IGMP) snooping

Hot Standby Routing Protocol (HSRP)

Protocol Independent Multicast (PIM)

Gateway Load-Balancing Protocol (GLBP)

All routing protocol configurations


16/26


17/26



vPC Peer Links and STP When you first bring up vPC, STP reconverges. STP treats vPC as a

special link and always includes vPCs in the STP active topology.

Set all the vPC peer link interfaces to the STP network port type so thatBridge Assurance is automatically enabled on all vPC peer links.

Do not enable any of the STP enhancement features on VPC peer links.

Configure the STP hello time on both the primary and secondary rootdevices to be 4 seconds.

STP is distributed; the protocol continues running on both vPC peerdevices. However, the configuration on the vPC peer device elected asthe primary device controls the STP process for the vPC interfaces onthe secondary vPC peer device.

The primary vPC device synchronizes the STP state on the vPCsecondary peer device using Cisco Fabric Services over Ethernet(CFSoE).


CFSoE

The Cisco Fabric Services over Ethernet (CFSoE) is a reliable statetransport mechanism that is used to synchronize the actions of the vPCpeer devices. CFSoE carries messages and packets for many featureslinked with vPC, such as STP and IGMP.

When you enable the vPC feature, the device automatically enablesCFSoE, and you do not have to configure anything.

The CFSoE transport is local to each VDC.

Cisco Fabric Services can also be used data over IP or IPv6 (bothunicast or multicast).


18/26



Virtualization Support All ports in a given vPC must be in the same VDC.

This version of the software supports only one vPC per VDC.

You can use the numbers from 1 to 4096 in each VDC to number thevPC and you can reuse these vPC numbers in a different VDC.


Guidelines and Limitations

All ports for a given vPC must be in the same VDC.

You must enable vPCs before you can configure them.

You must configure the peer-keepalive link and messages before thesystem can form the vPC peer link.

Only Layer 2 port channels can be in vPCs.

You must configure both vPC peer devices; the configuration is not sentfrom one device to the other.

Check that the necessary configuration parameters are compatible onboth sides of the vPC peer link.

You may experience minimal traffic disruption while configuring vPCs.

Configure all the port channels in the vPC using LACP with theinterfaces in active mode.


19/26



Configuring vPC


Enabling vPC

feature vpc

SwitchX(config)#

Enables vPCs on the device.

no feature vpc

SwitchX(config)#

Disables vPCs on the device.

You must enable the vPC functionality before you can configure anduse vPCs.

Ensure that you are in the correct VDC (or use the switchto vdccommand).


20/26



Creating a vPC Domain and Entering the

vpc-domain Mode

vpc domain domain-id

SwitchX(config)#

This example shows how to create or enter a vPC domain:

switch# config t

switch(config)# vpc domain 5

switch(config-vpc-domain)#

Creates a vPC domain on the device and enters the vpc-domainconfiguration mode for configuration purposes. There is no default; therange is 1 to 1000


Configuring the vPC Keepalive Link

peer-keepalive destination ip [hold-timeout secs| interval msecs {timeout secs} | {precedence {prec-value| network | internet | critical | flash-override | flash| immediate priority | routine}} | tos {tos-value |max-reliability |max-throughput |min-delay |min-monetary-cost | normal}} |tos-byte tos-byte-value}| source ip | vrf {name |management vpc-keepalive}]

SwitchX(config-vpc-domain)#

This example shows how to configure the destination IP address for the link:

switch# config t

switch(config)# feature vpc

switch(config)# vpc domain 100

switch(config-vpc-domain)# peer-keepalive destination 10.1.152.91

Configures the IPv4 address for the remote end of the vPC peer-keepalive link.


21/26



Creating the vPC Peer Link

vpc peer-link

SwitchX(config-if)#

This example shows how to configure a vPC peer link:switch# config t

switch(config)# interface port-channel 20

switch(config-if)# vpc peer-link

switch(config-vpc-domain)#

Configures the selected port channel as the vPC peer link andenters the vpc-domain configuration mode.


Configuration Compatibility on a vPCPeer Link

show vpc consistency-parameters {global | interface port-channel channel-number}

SwitchX(config)#

After you have configured the vPC peer link on bothvPC peer devices, check that the configurations areconsistent on all vPC interfaces.

Displays the status of those parameters that must be consistentacross all vPC interfaces.


22/26



Moving Other Port Channels into a vPC

To connect to the downstream device, you create a port channelfrom the downstream device to the primary vPC peer device andyou create another port channel from the downstream device to thesecondary peer device. Finally, working on each vPC peer device,you assign a vPC number to the port channel that connects to thedownstream device. You will experience minimal traffic disruptionwhen you are creating vPCs.

The vPC number that you assign to the port channel connecting tothe downstream device from the vPC peer device mustbe identicalon bothvPC peer devices.

switch# config tswitch(config)# interface port-channel 20switch(config-if)# vpc 5


Verifying the vPC Configuration


23/26



vPC Example Configuration

Step 1 Enable vPC.

switch# config tswitch(config)# feature vPC

Step 2(Optional) Configure interface that you want to be peer link to dedicated mode.

switch(config)# interface ethernet 7/1, 7/3, 7/5, 7/7switch(config-if)# shutdownswitch(config-if)# exitswitch(config)# interface ethernet 7/1switch(config-if)# rate-mode dedicatedswitch(config-if)# no shutdown

Step 3 Configure interface that you want to be peer link to be an active Layer 2

LACP port channel and create the vPC domain.

switch(config)# interface ethernet 7/1switch(config-if)# switchport mode trunkswitch(config-if)# allowed vlan 1-50switch(config-if)# native vlan 20switch(config-if)# channel-group 20 mode active


vPC Example Configuration (cont.)

Step 5 Configure the vPC peer link.

switch(config)# interface port-channel 20switch(config-if)# vpc peer-link

Step 6 Add the port channels that connect to the downstream device to the vPC.

switch(config)# interface port-channel 50switch(config-if)# vpc 3

Step 7 Save the configuration ;)

switch(config)# copy running-config startup-config

Step 4 Configure the vPC domain and keepalive link.

switch(config)# vpc domain 77switch(config-if)#peer keepalive destination ip 1.1.1.1


24/26



Default Settings


vPC 9 vPC 5

NX 6A

NX 6BNX 8B

NX 8A

NX 9A NX 5A

vPC Domain 8 vPC Domain 6

I part


25/26



vPC 9 vPC 5

vPC 62

vPC 61

NX 6A

NX 6BNX 8B

NX 8A

NX 9A NX 5A


II part1/11/1

1/1

1/1

1/2

10/1

10/2

9/1

1/25

9/25

9/25

10/25

1/25 2/25

1/25 2/25

9/9 9/1


vPC 9 vPC 5

NX 6A

NX 6BNX 8B

NX 8A

NX 9A NX 5A


III part1/11/1

1/2

1/2

1/1

10/1

10/2

9/1

1/25

9/25

9/25

10/25

1/25 2/25

1/25 2/25

9/9 1/9

vPC8

1/17

2/17

2/17

10/17

1/99/9

vPC6


26/26


Documents

Nexus vPC Print[1]