11

I'm trying to help a friend with some Nexus issues.

The topology is like this:

Cat 3750 stack -> vPC -> 2x N7k -> LACP -> Fortigate firewall cluster

The 3750 stack is running OSPF to both the Nexuses. The adjacencies are up. From what I have read this is not a supported design. Loop prevention would prevent packets that come in on one Nexus but that is destined for another and then goes across the peer link. If this traffic exits another vPC it will be blocked due to the loop prevention mechanism.

In this case though the firewalls (cluster) are not connected via vPC. Will loop prevention still kick in?

Also I'm surprised that OSPF adjacencies are up and seem to be working. All routes are present but there are still reachability issues. Some OSPF packets would probably come in over the peer link. I can see how this could be an issue for the unicast packets that need to cross peer link and then exit vPC back to the stack which not be allowed.

How will the multicast be treated. I guess that should be received correctly?

So I guess they should maybe turn up new interfaces that are routed instead. Or would it be possible to run SVI which is point-to-point between each Nexus and the stack?

Improve this question
3
  • 2
    Can you help me a little here? Why are they running OSPF but peering everything with L2? This seems very counter productive to me. If you're using the 3750 stack as a router then why wouldn't you make the uplinks L3 ports and just allow routing to take its course? It seems like a much cleaner design that still utilizes all of your links.
    – bigmstone
    Commented May 11, 2013 at 11:54
  • Hi. This is not my network but I'm helping someone out. The reason they are running both L2 and L3 is that they plan to move the routing off the 3750 entirely and only route on the Nexuses. Until all VLANs have been moved they need to run a mix of L2 and L3 to the Nexus but as I've found out now it's not a supported design. They are looking at turning up a dedicated L3 link for now until everything has been migrated.
    – Daniel Dib
    Commented May 11, 2013 at 18:26
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Commented Jan 3, 2021 at 4:32

3 Answers 3

Reset to default
8

As the firewalls aren't part of a vPC they won't be part of the normal vPC loop prevention.

The loop prevention only states that a packet cannot ingress on the peer link if it is destined to go out another vPC enabled port.

Not too sure on the multicast front as we don't use it in our environment and I haven't really looked into its behaviour on the 7K's.

Usually if you are running a routing protocol down on the switch stack the recommended design would be to not have it as a member of a vPC and just use OSPF to give you the same advantages that vPC gives you at L2.

Improve this answer
1
  • Thanks David! I'm trying to understand in detail what is happening with OSPF. Adjacencies are up and I see no issues with it. The hashing will be a problem because some packets will enter the wrong Nexus. I can see how OSPF unicast packets would be an issue if it entered wrong Nexus because the correct Nexus could not send it back out the vPC. Strange that the database is properly poulated though and that there are no flapping sessions or anything.
    – Daniel Dib
    Commented May 8, 2013 at 8:21
1

Have a look at this : http://bradhedlund.com/2010/12/16/routing-over-nexus-7000-vpc-peer-link-yes-and-no/

Might help you :)

Improve this answer
1
  • Hi Gustav. I only checked that link and some presentations from Cisco Live. As I know now it's not a supported design due to loop prevention. In this case the traffic is exiting a non vPC link though so still not 100% sure why traffic is getting dropped.
    – Daniel Dib
    Commented May 11, 2013 at 18:27
1

What model of line cards are you using in your N7K chassis? M series or F series? There may be some hair-pinning happening within the interconnect architecture on the N7K if you are using F series cards that is being detrimental to routed traffic.

Also, make sure you have a port-channel between N7K for non-vpc vlans. Vlans to your firewall cluster should not cross the VPC peer-link. If you do not have a second port-channel between N7K's, then this could be your problem.

Improve this answer
1
  • suggestions: Consider asking clarifying questions in comments under the OP's question. Granted, the question seems rather large and open-ended, but also consider trying to answer the specific questions asked... provide additional clarification and details as you see fit.
    – Craig Constantine
    Commented May 13, 2013 at 16:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.