1

I'm struggeling with a VLAN mapping issue on a Nexus 3524 Switch.

My setup:

Downlink router<---Dot1Q 1901--->NX3524<---Dot1Q 493--->Uplink router

I already figured out that basic 1:1 VLAN ID mapping is not supported on the 3k Series nexus boxes, so i try to fix this job using the Private-Vlans feature. Unfortunately i can't change anything in this setup because the uplink Provider is has mapped his Service to this Tag and the donwnlink router is only reachable via VLAN tag 1901 through a metro provider network. i can only put my hands on the downlink router and the Nexus.

VLAN 493 should be my primary private VLAN and 1901 my secondary.

vlan 493
  private-vlan primary
  private-vlan association 1901
vlan 1901
  private-vlan community

in my understanding primary and secondary vlans are transported on normal trunk ports, so i configured vlans 493 and 1901 as allowed VLANs on a normal trunk port (eth1/1) that carries a lot of other tags facing the Metro network so there should be no needs to configure explicit

interface Ethernet1/1
  switchport mode trunk
  switchport trunk native vlan 1900
  switchport trunk allowed vlan add 493,1901
  no shutdown

i can't change a lot in the configuration here because there are several productive VLANs already configured on this port.

The Port facing the upstream router (Eth1/6) is configured as a promiscious private-vlan trunk port

interface Ethernet1/6
switchport mode private-vlan trunk promiscuous
switchport private-vlan trunk allowed vlan 493
switchport private-vlan mapping trunk 493 1901
no shutdown

Mac address-learning looks fine.

# sh mac address-table | i 493
*  493     00c1.xxxx.xxxx   dynamic  0         F      F    Eth1/1
*  493     dab1.xxxx.xxxx   dynamic  0         F      F    Eth1/6

but there is no ping possible between the two nodes due to incomplete ARP on the upstream router.

I'm also missing port Eth1/1 in following output.

# sh vlan private-vlan 
Primary  Secondary  Type             Ports 
-------  ---------  ---------------  ----------------------
493      1901       community        Eth1/6

I'm not sure if this is just a missing statement somewhere or if there is a mayor error in my thinking.

Using Q-in-Q tunneling unfortunately is not an alternative because the downstream router can not terminate Layer3 interfaces in a double-tagged VLAN :(

Improve this question
5
  • Are you trying to connect VLAN 493 and 1901 with each other? Are they using the same IP Address space? – Abu Zaid Feb 24 '20 at 10:41
  • no, not really, 1901 is my secondary community VLAN that is mapped ti Primary VLAN 493 on the promiscious port. – Andreas Schaefer Feb 24 '20 at 17:29
  • OK, so lets starts from the beginning. What is the 'job' that you are trying to fix? – Abu Zaid Feb 24 '20 at 19:07
  • quite simple, i have a uplink BGP Peer that is reachable via VLAN 493 and a downlink BGP Client that is reachable via VLAN 1901 Both VLANs are present on a Nexus 3524 with basic licensing. On a Nexus 5k or any other "bigger" switch, i would configure simple VLAN Tag rewriting on one port, but this is not supported on the NX3k. – Andreas Schaefer Feb 25 '20 at 20:34
  • @AndreasSchaefer I dont think this can be solved on a 3k, like you said you would need to rewrite the TAG’s but AFAIK thats not supported on the 3K, can you not ask the provider to change since that tag is only local to you anyway? – Matt Douhan Feb 29 '20 at 1:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.