Hot answers tagged

7

they seemed to choose to use 100.64.0.0/10 as their private network space, rather than 10.0.0.0/8 (or a subspace from it). What's the purpose? I don't see any obvious benefit, but I may miss some key points there. Can someone give some thoughts on this? The slide is very clear on why they are using this space. They are following the current best practice ...


6

The bug-id you are hitting is probably CSCuf56076, which is fixed in 6.0(2)N2(1). Unfortunately this is the best solution for this problem. Luckily it doesn't impact the traffic on the switches. For debugging you can see which part of the config is in the global database: show system internal csm info global-db seq-tbl and which part is in the synced ...


6

Based on the comments I think you are confused about guard root. You configure guard root on the downstream interfaces of all the switches, except the root switch. Basically, you are trying to protect the root interfaces on a switch (root switches do not have root interfaces) by preventing the other interfaces from becoming root interfaces. This will protect ...


5

For your first question, enable 'peer-gateway' under the VPC domain settings. This allows for directed ping forwarding over the VPC peer-link. With core Nexus VPC peers, it is also recommended to set 'peer-switch' under the VPC domain settings and set their STP priorities for VPC vlans to the same values. For your second question, HSRP is configured ...


5

Geekman, If talking in Cisco terms, the main difference between vPC and basic stacking (StackWise, FlexStack) is excluding of splitbrain situation, when both members become a master and continue to forwarding. Juniper EX series currently do not support any technology like vPC, so MLAG can be completed only with Virtual Chassis which can be splitbrained. ...


5

First of all there is a big difference between VSS and VPC where Nexus vPC is introduced with Nexus 2,5 and 7K. The vPC is actually eliminate the need of STP on the member vPC ports and allow for efficient load sharing capabilities .The VSS on the other hand is a feature introduced with Cisco 6500 catalyst, its basically combines the Back plane throughput of ...


5

Spanning-tree port type network activates bridge assurance on the link. Since the 2960X doesn't support bridge assurance, you can't run this link as port type network. Just run it in normal mode. About the only place you want to run port type network is on the vPC peer-link where it is enabled by default. From the best practices design guide: Bridge ...


5

I don't think that peer-gateway is needed on SW-3 at all, as it serves somewhat of a corner case (see below), only useful if the the given nexus has SVIs (interface vlan XXX) and acts as default gateway for the said VLANs and there are special devices in that VLAN. As I understand your diagram and text, this not the case for SW-3. While I suggest turning ...


4

Stack Wise is not possible without the use of stack ports and stack cables and the maximum stack cable length i deal with was CAB-SPWR-150CM which was 1.5 m . so you can't stack over this distance . and also you can make use of this discussion enter link description here


4

It depends on whether you have a vPC between the aggregation and core layers. If the connection between (A1, A2) and (C1, C2) is a vPC, then the switch always prefers "local forwarding". That is, any packet that is received on A1 will be sent to C1, and any packet that is received on A2 will be send to C2. The idea is to have the packet pass through only ...


4

This should work as long as you configure them properly. Below captures are from Best Practices for vPC on Cisco Nexus 7000 Series Switches


4

SW3 is a switch. By first principle, portfast [trunk] or port type edge [trunk] should not be enabled on ports that connect to switches, lest you risk loops if that other switch connects to some other upstream switch. There are exceptions to this rule, but they require solid knowledge and understanding by the network admin. Usually, deployment of edge ...


4

The whole point of MLAG / VPC is to have both link active, as in a standard link aggregation. Otherwise there would be little benefit over xSTP (spanning tree) (yes it converges faster but it's much more complex to setup and not interoperable between different brands). So if properly configured: when all links are up, you got the full bandwidth when a link ...


4

Arista still does keepalives between peers. MLAG Documentation for the peer-link statement states that you don't have to use the same link. An MLAG is formed by connecting two switches through an interface called a peer link. The peer link carries MLAG advertisements, keepalive messages, and data traffic between the switches. This information keeps the two ...


3

Under normal conditions only the root ID and bridge priority of the VPC primary will be sent via VPC downstream links. Within VPC links only the operational primary transmits or processes BPDU's (nb - the secondary forwards rather than proxies). In the case of non-VPC links the actual ID's and priorities will be sent, thus allowing STP to continue to ...


3

Three words: Don't do it. There are many reasons why, but the most important is that instead of making resilient links, you have made both data centers vulnerable to the same problem. If the VPC link goes down, both data centers will think they're active. That almost certainly means that nothing will work until you restore the link. Not exactly a ...


3

Just to add one footnote to @RonMaupin's answer: although classful routing is long dead, many people informally use the terms "Class A, B and C" as shorthand for subnet masks. So when someone calls a network a Class A network, they simply mean it has a mask of /8 or 255.0.0.0. Similarly, when they call something a Class B or Class C network, they merely ...


3

The - character indicates VTP is disabled. As Fizzle says, show vtp status should reveal the discrepancy. There is a bug on the N3K that causes this behavior even if they're currently set the same if you have ever enabled VTP the box still thinks its on. Perhaps that bug also exists on N5K if show vpc status shows the same state. In any case since its ...


3

I think it’s mostly a cost and scaling issue. When operating in the scale those big networks operate, you don’t care about a single server losing connectivity, you think in scale of data centers going offline. Why invest in more switch ports to increase availability of one single server when you can load balance that traffic over tens of thousands of ...


3

You actually don't have to do anything. VPC paired Nexus work exactly as you want them to. The prerequisite is that all systems involved (i.e. the servers) are attached to the Nexus over a VPC enabled port channel of that given Nexus pair. https://community.cisco.com/t5/networking-documents/peer-gateway-feature-on-the-nexus-7000/ta-p/3113290 Please note: ...


3

Unfortunately, no, this can't be done. The models have to be the same even if they're models in the same family. Here's an answer from a Cisco forum entry on this topic and link to better explain and detail the requirements. No, it is not supported to have vPC between different families of Nexus, not even between different models from the same family: The ...


2

This answer probably won't very useful today, but it's possible to stack 2960X via fiber. You need C2960X-FIBER-STK.


2

I dont think it possible : Pfsense doc : Both locations must be using non-overlapping LAN IP subnets. And no "ip virtual-reassembly" seen. btw, pfsense 2.0.1 is outdated, and more recent support IPSec+L2TP


2

From EX9000 Series, Juniper does support MC-LAG


2

First, classful routing has been dead for 20 years, replaced by CIDR and VLSM in 1995, and is really only useful as a historical reference. The class of an address is determined by the first bits of the address. Some people mistakenly have decided that any /8 is a Class A, any /16 is a Class B, and any /24 is a Class C. It's true those are the default ...


2

From the Cisco NX-OS 5.1(3)N1(1) release and later releases, each Cisco Nexus 5500 Series device can manage and support up to 24 FEXs without Layer 3. With Layer 3, the number of FEXs supported per Cisco Nexus 5500 Series device is 8. With Enhanced vPC and a dual-homed FEX topology each FEX is managed by both Cisco Nexus 5000 Series devices. As a result, one ...


2

You need to read the fine print in the Cisco documentation: Maximum Limits—Indicates the maximum scale capability tested for the corresponding feature individually. This number is the absolute maximum currently supported by Cisco NX-OS Release 5.0(3)N1(1b) software for the corresponding feature. If the hardware is capable of a higher scale, future ...


2

I'll answer Q2 first: Suppose a PC in VLAN 100 sends a packet to a PC in VLAN 200. Let's say the packet takes the VPC link to 7K2. Since the active SVI is on 7K1, the packet is forwarded across the peer link to 7K1. 7K1 would want to forward it to the right-hand access switch, but it can't because of the loop avoidance rule. So the packet gets dropped....


Only top voted, non community-wiki answers of a minimum length are eligible