Hot answers tagged

17

Of course, there's nothing like asking something publicly for you to realize your own mistake. The links to the VSS are a vPC, yet on the VSS side I had configured them as separate Etherchannels for each Nexus switch. It was now two logically different connections, which created the errors. Moving the links all into the same Etherchannel on the VSS ...


11

While it is certainly a good idea that a VPC has the same allowed VLAN list on all sides, it is not a requirement. Take a look at the output of "show vpc consistency-parameters global". switch# show vpc consistency-parameters global Legend: Type 1 : vPC will be suspended in case of mismatch Name Type Local Value ...


8

As the firewalls aren't part of a vPC they won't be part of the normal vPC loop prevention. The loop prevention only states that a packet cannot ingress on the peer link if it is destined to go out another vPC enabled port. Not too sure on the multicast front as we don't use it in our environment and I haven't really looked into its behaviour on the 7K's. ...


7

they seemed to choose to use 100.64.0.0/10 as their private network space, rather than 10.0.0.0/8 (or a subspace from it). What's the purpose? I don't see any obvious benefit, but I may miss some key points there. Can someone give some thoughts on this? The slide is very clear on why they are using this space. They are following the current best practice ...


6

The bug-id you are hitting is probably CSCuf56076, which is fixed in 6.0(2)N2(1). Unfortunately this is the best solution for this problem. Luckily it doesn't impact the traffic on the switches. For debugging you can see which part of the config is in the global database: show system internal csm info global-db seq-tbl and which part is in the synced ...


5

For your first question, enable 'peer-gateway' under the VPC domain settings. This allows for directed ping forwarding over the VPC peer-link. With core Nexus VPC peers, it is also recommended to set 'peer-switch' under the VPC domain settings and set their STP priorities for VPC vlans to the same values. For your second question, HSRP is configured ...


5

Geekman, If talking in Cisco terms, the main difference between vPC and basic stacking (StackWise, FlexStack) is excluding of splitbrain situation, when both members become a master and continue to forwarding. Juniper EX series currently do not support any technology like vPC, so MLAG can be completed only with Virtual Chassis which can be splitbrained. ...


5

First of all there is a big difference between VSS and VPC where Nexus vPC is introduced with Nexus 2,5 and 7K. The vPC is actually eliminate the need of STP on the member vPC ports and allow for efficient load sharing capabilities .The VSS on the other hand is a feature introduced with Cisco 6500 catalyst, its basically combines the Back plane throughput of ...


5

Spanning-tree port type network activates bridge assurance on the link. Since the 2960X doesn't support bridge assurance, you can't run this link as port type network. Just run it in normal mode. About the only place you want to run port type network is on the vPC peer-link where it is enabled by default. From the best practices design guide: Bridge ...


5

Based on the comments I think you are confused about guard root. You configure guard root on the downstream interfaces of all the switches, except the root switch. Basically, you are trying to protect the root interfaces on a switch (root switches do not have root interfaces) by preventing the other interfaces from becoming root interfaces. This will protect ...


5

I don't think that peer-gateway is needed on SW-3 at all, as it serves somewhat of a corner case (see below), only useful if the the given nexus has SVIs (interface vlan XXX) and acts as default gateway for the said VLANs and there are special devices in that VLAN. As I understand your diagram and text, this not the case for SW-3. While I suggest turning ...


4

Stack Wise is not possible without the use of stack ports and stack cables and the maximum stack cable length i deal with was CAB-SPWR-150CM which was 1.5 m . so you can't stack over this distance . and also you can make use of this discussion enter link description here


4

It depends on whether you have a vPC between the aggregation and core layers. If the connection between (A1, A2) and (C1, C2) is a vPC, then the switch always prefers "local forwarding". That is, any packet that is received on A1 will be sent to C1, and any packet that is received on A2 will be send to C2. The idea is to have the packet pass through only ...


4

This should work as long as you configure them properly. Below captures are from Best Practices for vPC on Cisco Nexus 7000 Series Switches


4

SW3 is a switch. By first principle, portfast [trunk] or port type edge [trunk] should not be enabled on ports that connect to switches, lest you risk loops if that other switch connects to some other upstream switch. There are exceptions to this rule, but they require solid knowledge and understanding by the network admin. Usually, deployment of edge ...


4

The whole point of MLAG / VPC is to have both link active, as in a standard link aggregation. Otherwise there would be little benefit over xSTP (spanning tree) (yes it converges faster but it's much more complex to setup and not interoperable between different brands). So if properly configured: when all links are up, you got the full bandwidth when a link ...


3

Under normal conditions only the root ID and bridge priority of the VPC primary will be sent via VPC downstream links. Within VPC links only the operational primary transmits or processes BPDU's (nb - the secondary forwards rather than proxies). In the case of non-VPC links the actual ID's and priorities will be sent, thus allowing STP to continue to ...


3

The - character indicates VTP is disabled. As Fizzle says, show vtp status should reveal the discrepancy. There is a bug on the N3K that causes this behavior even if they're currently set the same if you have ever enabled VTP the box still thinks its on. Perhaps that bug also exists on N5K if show vpc status shows the same state. In any case since its ...


3

Just to add one footnote to @RonMaupin's answer: although classful routing is long dead, many people informally use the terms "Class A, B and C" as shorthand for subnet masks. So when someone calls a network a Class A network, they simply mean it has a mask of /8 or 255.0.0.0. Similarly, when they call something a Class B or Class C network, they merely ...


3

First, classful routing has been dead for 20 years, replaced by CIDR and VLSM in 1995, and is really only useful as a historical reference. The class of an address is determined by the first bits of the address. Some people mistakenly have decided that any /8 is a Class A, any /16 is a Class B, and any /24 is a Class C. It's true those are the default ...


3

Three words: Don't do it. There are many reasons why, but the most important is that instead of making resilient links, you have made both data centers vulnerable to the same problem. If the VPC link goes down, both data centers will think they're active. That almost certainly means that nothing will work until you restore the link. Not exactly a ...


3

I think it’s mostly a cost and scaling issue. When operating in the scale those big networks operate, you don’t care about a single server losing connectivity, you think in scale of data centers going offline. Why invest in more switch ports to increase availability of one single server when you can load balance that traffic over tens of thousands of ...


3

You actually don't have to do anything. VPC paired Nexus work exactly as you want them to. The prerequisite is that all systems involved (i.e. the servers) are attached to the Nexus over a VPC enabled port channel of that given Nexus pair. https://community.cisco.com/t5/networking-documents/peer-gateway-feature-on-the-nexus-7000/ta-p/3113290 Please note: ...


2

From the Cisco NX-OS 5.1(3)N1(1) release and later releases, each Cisco Nexus 5500 Series device can manage and support up to 24 FEXs without Layer 3. With Layer 3, the number of FEXs supported per Cisco Nexus 5500 Series device is 8. With Enhanced vPC and a dual-homed FEX topology each FEX is managed by both Cisco Nexus 5000 Series devices. As a result, one ...


2

You need to read the fine print in the Cisco documentation: Maximum Limits—Indicates the maximum scale capability tested for the corresponding feature individually. This number is the absolute maximum currently supported by Cisco NX-OS Release 5.0(3)N1(1b) software for the corresponding feature. If the hardware is capable of a higher scale, future ...


2

This answer probably won't very useful today, but it's possible to stack 2960X via fiber. You need C2960X-FIBER-STK.


2

I dont think it possible : Pfsense doc : Both locations must be using non-overlapping LAN IP subnets. And no "ip virtual-reassembly" seen. btw, pfsense 2.0.1 is outdated, and more recent support IPSec+L2TP


2

From EX9000 Series, Juniper does support MC-LAG


Only top voted, non community-wiki answers of a minimum length are eligible