2

I have this scenario and trying to configure vPC for Cisco ASA 5585 (Active-Standby)

enter image description here

Nexus vPC config:

interface port-channel1
  switchport mode trunk
  switchport trunk allowed vlan 10
  speed 10000
  mtu 9216
  vpc 1

Nexus vPC output

# show vpc brief
Legend:
                (*) - local vPC is down, forwarding via vPC peer-link

vPC domain id                     : 1
Peer status                       : peer adjacency formed ok
vPC keep-alive status             : peer is alive
Configuration consistency status  : success
Per-vlan consistency status       : success
Type-2 consistency status         : success
vPC role                          : primary
Number of vPCs configured         : 3
Peer Gateway                      : Enabled
Dual-active excluded VLANs        : -
Graceful Consistency Check        : Enabled
Auto-recovery status              : Enabled, timer is off.(timeout = 240s)
Delay-restore status              : Timer is off.(timeout = 30s)
Delay-restore SVI status          : Timer is off.(timeout = 10s)

vPC Peer-link status
---------------------------------------------------------------------
id   Port   Status Active vlans
--   ----   ------ --------------------------------------------------
1    Po999  up     10,100

vPC status
----------------------------------------------------------------------
id   Port   Status Consistency Reason                     Active vlans
--   ----   ------ ----------- ------                     ------------
1    Po1    up     success     success                    10

Cisco ASA config:

# sh run int po1
!
interface Port-channel1
 lacp max-bundle 8
 no nameif
 no security-level
 no ip address
!
interface TenGigabitEthernet0/8
 channel-group 1 mode active
 no nameif
 no security-level
 no ip address
!
interface TenGigabitEthernet0/9
 channel-group 1 mode active
 no nameif
 no security-level
 no ip address
!

Port-channel summary

# show port-channel summary
Flags:  D - down        P - bundled in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        U - in use      N - not in use, no aggregation/nameif
        M - not in use, no aggregation due to minimum links not met
        w - waiting to be aggregated
Number of channel-groups in use: 1
Group  Port-channel  Protocol  Span-cluster  Ports
------+-------------+---------+------------+------------------------------------
1      Po1(N)            LACP          No     Te0/8(P)   Te0/9(P)

Question:

  • Why port channel showing Po1(N) N - not in use, no aggregation/nameif?

  • How vPC work in Active-Standby mode?

  • I haven't see any document related vPC with ASA so far so does this solution going to work or i am wasting my time?

I found link here but not useful: https://www.fir3net.com/Switches/Cisco/design-caveats-active-standby-network-devices-connected-via-vpc.html

  • 2
    If you have no name or security level on the port channel interface, how do you expect the ASA to treat it? – Ron Trunk Mar 12 '18 at 20:04
  • Here i am confused, on Nexus switch i have created vpc 1 on po1 and vpc 2 on po2 now how does cisco ASA understand that? because on Cisco they are configured for HA so and both hardware ports are controlled by cluster active node – Satish Mar 12 '18 at 20:17
  • Have you tried channel-group 1 mode on? Have you enabled feature lacp on nexus? – Datagram.Network Mar 12 '18 at 23:09
  • 1
    @RonTrunk was right here, as soon as i created int po1.100 and set nameif inside it changed LACP status fo U (in-used) – Satish Mar 13 '18 at 3:59
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Apr 1 '18 at 22:34
4

This should work as long as you configure them properly.

Below captures are from Best Practices for vPC on Cisco Nexus 7000 Series Switches

enter image description here

enter image description here

enter image description here

| improve this answer | |
0

Satish,

We have similar setup with two Nexus 7K switches, We are not using VPC, we are using HSRP in layer two to cross connect our Nexus switches. From there we cross connect our distribution and access switches using trunk port for fault tolerance.

If one ASA is backing up another ASA, you should investigate creating HA option within ASA. Your ASA's will be cross connected with each other as an active and stand-by mode, you may need license on your ASA to use this feature on ASA

| improve this answer | |
  • I am using vPC for everything so try to make it unified, I don't think its licence issue. I believe it's just config issue. – Satish Mar 12 '18 at 20:33
  • I am trying to say that you can connect your SW1 to ASA firewall 1. Connect SW2 to ASA firewall 2. You will not connect ASA firewall 1 to SW2 and vice a versa, Instead you will connect ASA firewall 1 to ASA firewall 2 for heart beat check and use HA option of the Cisco ASA. This option only gives you firewall backup – user44647 Mar 12 '18 at 20:44
  • I did cross connect because i want to utilize my both link SW1 and SW2, if i put fw-1 to sw1 then it won't to load sharing between two switches – Satish Mar 12 '18 at 21:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.