Hot answers tagged

7 votes
Accepted

Why did Netflix choose to use CIDR blocks of 100.64.0.0/10 as its private network IP space?

they seemed to choose to use 100.64.0.0/10 as their private network space, rather than 10.0.0.0/8 (or a subspace from it). What's the purpose? I don't see any obvious benefit, but I may miss some key ...
user avatar
  • 26.7k
6 votes
Accepted

spanning tree RootGuard question on vPC switches

Based on the comments I think you are confused about guard root. You configure guard root on the downstream interfaces of all the switches, except the root switch. Basically, you are trying to protect ...
user avatar
  • 93.5k
5 votes
Accepted

Gateway on Nexus 3500 with VPC

For your first question, enable 'peer-gateway' under the VPC domain settings. This allows for directed ping forwarding over the VPC peer-link. With core Nexus VPC peers, it is also recommended to ...
user avatar
5 votes
Accepted

Alternatives to VSS and vPC?

First of all there is a big difference between VSS and VPC where Nexus vPC is introduced with Nexus 2,5 and 7K. The vPC is actually eliminate the need of STP on the member vPC ports and allow for ...
user avatar
  • 3,404
5 votes
Accepted

Bridge Assurance with vPC on port type network

Spanning-tree port type network activates bridge assurance on the link. Since the 2960X doesn't support bridge assurance, you can't run this link as port type network. Just run it in normal mode. ...
user avatar
  • 66
5 votes

Does vPC peer-gateway cause unicast flooding

I don't think that peer-gateway is needed on SW-3 at all, as it serves somewhat of a corner case (see below), only useful if the the given nexus has SVIs (interface vlan XXX) and acts as default ...
user avatar
4 votes

Stacking Cisco Catalyst 3850 via Fibre?

Stack Wise is not possible without the use of stack ports and stack cables and the maximum stack cable length i deal with was CAB-SPWR-150CM which was 1.5 m . so you can't stack over this distance . ...
user avatar
  • 3,404
4 votes

vPC traffic flow question

It depends on whether you have a vPC between the aggregation and core layers. If the connection between (A1, A2) and (C1, C2) is a vPC, then the switch always prefers "local forwarding". That is, any ...
user avatar
  • 2,396
4 votes
Accepted

Cisco nexus vpc spanning-tree port type trunk question

SW3 is a switch. By first principle, portfast [trunk] or port type edge [trunk] should not be enabled on ports that connect to switches, lest you risk loops if that other switch connects to some other ...
user avatar
4 votes

vpc/mlag block half of uplink?

The whole point of MLAG / VPC is to have both link active, as in a standard link aggregation. Otherwise there would be little benefit over xSTP (spanning tree) (yes it converges faster but it's much ...
user avatar
  • 18.4k
4 votes
Accepted

Arista MLAG: should I have a separate L3 interface for keepalive like in Cisco's NX-OS?

Arista still does keepalives between peers. MLAG Documentation for the peer-link statement states that you don't have to use the same link. An MLAG is formed by connecting two switches through an ...
user avatar
  • 6,440
3 votes
Accepted

Understanding virtual port channel peer switch command

Under normal conditions only the root ID and bridge priority of the VPC primary will be sent via VPC downstream links. Within VPC links only the operational primary transmits or processes BPDU's (nb -...
user avatar
  • 6,028
3 votes

How can a Class B network be in the 10.0.0.0 space?

Just to add one footnote to @RonMaupin's answer: although classful routing is long dead, many people informally use the terms "Class A, B and C" as shorthand for subnet masks. So when someone calls ...
user avatar
  • 62.4k
3 votes

vPC over Dark Fiber

Three words: Don't do it. There are many reasons why, but the most important is that instead of making resilient links, you have made both data centers vulnerable to the same problem. If the VPC ...
user avatar
  • 62.4k
3 votes

Cisco ASA vPC configuration issue

This should work as long as you configure them properly. Below captures are from Best Practices for vPC on Cisco Nexus 7000 Series Switches
user avatar
  • 3,744
3 votes
Accepted

Regarding Tier0 switch to downstream servers connectivity

I think it’s mostly a cost and scaling issue. When operating in the scale those big networks operate, you don’t care about a single server losing connectivity, you think in scale of data centers ...
user avatar
  • 15.6k
3 votes

Is it possible to make a truly active\active L3 VRRP\HSRP configuration between two Nexus in a vPC

You actually don't have to do anything. VPC paired Nexus work exactly as you want them to. The prerequisite is that all systems involved (i.e. the servers) are attached to the Nexus over a VPC ...
user avatar
3 votes
Accepted

vPC between Cisco nexus 9236C and 9336C

Unfortunately, no, this can't be done. The models have to be the same even if they're models in the same family. Here's an answer from a Cisco forum entry on this topic and link to better explain ...
user avatar
  • 4,481
2 votes
Accepted

Nexus 5500 FEX Support

From the Cisco NX-OS 5.1(3)N1(1) release and later releases, each Cisco Nexus 5500 Series device can manage and support up to 24 FEXs without Layer 3. With Layer 3, the number of FEXs supported per ...
user avatar
  • 3,404
2 votes

Nexus 5500 FEX Support

You need to read the fine print in the Cisco documentation: Maximum Limits—Indicates the maximum scale capability tested for the corresponding feature individually. This number is the absolute ...
user avatar
  • 93.5k
2 votes

Stacking Cisco Catalyst 3850 via Fibre?

This answer probably won't very useful today, but it's possible to stack 2960X via fiber. You need C2960X-FIBER-STK.
user avatar
  • 21
2 votes

Is it possible to implement IPSec with failover between one pfSense firewall and Amazon VPC (no BGP)

I dont think it possible : Pfsense doc : Both locations must be using non-overlapping LAN IP subnets. And no "ip virtual-reassembly" seen. btw, pfsense 2.0.1 is outdated, and more recent support ...
user avatar
2 votes

Juniper equivalent to Cisco's vPC?

From EX9000 Series, Juniper does support MC-LAG
user avatar
2 votes
Accepted

Regarding traffic blackholing in case of vpc and hsrp

I'll answer Q2 first: Suppose a PC in VLAN 100 sends a packet to a PC in VLAN 200. Let's say the packet takes the VPC link to 7K2. Since the active SVI is on 7K1, the packet is forwarded across ...
user avatar
  • 62.4k
2 votes
Accepted

Etherchannel Basics

Q1: The primary device in the VPC pair is the only device in the VPC pair that can send, receive or respond to BPDUs. As such the secondary device will only forward them along to their destination. ...
user avatar
2 votes

How can a Class B network be in the 10.0.0.0 space?

First, classful routing has been dead for 20 years, replaced by CIDR and VLSM in 1995, and is really only useful as a historical reference. The class of an address is determined by the first bits of ...
user avatar
  • 93.5k
2 votes

Virtual port channel topology with firewall

I don't know what you mean "FW01 and FW02 as a single entity". In most scenarios, the FW cluster are composed by 2 independent firewall talking via 1 o 2 HA links where one keeps active and other are ...
user avatar
  • 1,152
2 votes

Single homed, dual homed and double sided vpc

You kind of answered it yourself. The advantage for each is an increased level of redundancy. The advantage of vPC is that is provides link redundancy as well as chassis redundancy. A dual-homed ...
user avatar
  • 949

Only top scored, non community-wiki answers of a minimum length are eligible