N5K FabricPath/vPC+
Hello,
I have problem with vPC`+ in N5K. I think that all my setup it's ok but my peers are not reachables in fabricpath in the vpc domain.
n5k-del-1(config)# show vpc
Legend:
(*) - local vPC is down, forwarding via vPC peer-link
vPC domain id : 21
vPC+ switch id : 121
Peer status : peer adjacency formed ok
vPC keep-alive status : peer is alive
vPC fabricpath status : peer is not reachable through fabricpath
Configuration consistency status : success
Per-vlan consistency status : success
Type-2 consistency status : success
vPC role : primary
Number of vPCs configured : 0
Peer Gateway : Disabled
Dual-active excluded VLANs : -
Graceful Consistency Check : Enabled
Auto-recovery status : Enabled (timeout = 240 seconds)
vPC Peer-link status
id Port Status Active vlans
1 Po1 up -
n5k-del-2(config)# show vpc
Legend:
(*) - local vPC is down, forwarding via vPC peer-link
vPC domain id : 21
vPC+ switch id : 121
Peer status : peer adjacency formed ok
vPC keep-alive status : peer is alive
vPC fabricpath status : peer is not reachable through fabricpath
Configuration consistency status : success
Per-vlan consistency status : success
Type-2 consistency status : success
vPC role : secondary
Number of vPCs configured : 0
Peer Gateway : Disabled
Dual-active excluded VLANs : -
Graceful Consistency Check : Enabled
Auto-recovery status : Enabled (timeout = 240 seconds)
vPC Peer-link status
id Port Status Active vlans
1 Po1 up -
n5k-del-1(config)# show run int port-channel 1
!Command: show running-config interface port-channel1
!Time: Tue Mar 3 12:31:16 2009
version 6.0(2)N2(3)
interface port-channel1
switchport mode fabricpath
spanning-tree port type network
vpc peer-link
n5k-del-1(config)# show port-channel summary
Flags: D - Down P - Up in port-channel (members)
I - Individual H - Hot-standby (LACP only)
s - Suspended r - Module-removed
S - Switched R - Routed
U - Up (port-channel)
M - Not in use. Min-links not met
Group Port- Type Protocol Member Ports
Channel
1 Po1(SU) Eth LACP Eth1/1(P) Eth1/2(P) Eth1/17(P)
Eth1/18(P)
n5k-del-2(config)# show run int port-channel 1
!Command: show running-config interface port-channel1
!Time: Tue Mar 3 12:33:57 2009
version 6.0(2)N2(3)
interface port-channel1
switchport mode fabricpath
spanning-tree port type network
vpc peer-link
n5k-del-2(config)# show port-channel summary
Flags: D - Down P - Up in port-channel (members)
I - Individual H - Hot-standby (LACP only)
s - Suspended r - Module-removed
S - Switched R - Routed
U - Up (port-channel)
M - Not in use. Min-links not met
Group Port- Type Protocol Member Ports
Channel
1 Po1(SU) Eth LACP Eth1/1(P) Eth1/2(P) Eth1/17(P)
Eth1/18(P)
n5k-del-1(config)# show run fabricpath
!Command: show running-config fabricpath
!Time: Tue Mar 3 12:32:02 2009
version 6.0(2)N2(3)
install feature-set fabricpath
feature-set fabricpath
vpc domain 21
fabricpath switch-id 121
interface port-channel1
switchport mode fabricpath
interface Ethernet1/1
switchport mode fabricpath
interface Ethernet1/2
switchport mode fabricpath
interface Ethernet1/17
switchport mode fabricpath
interface Ethernet1/18
switchport mode fabricpath
fabricpath domain default
fabricpath switch-id 21
n5k-del-2(config)# show run fabricpath
!Command: show running-config fabricpath
!Time: Tue Mar 3 12:31:17 2009
version 6.0(2)N2(3)
install feature-set fabricpath
feature-set fabricpath
vpc domain 21
fabricpath switch-id 121
interface port-channel1
switchport mode fabricpath
interface Ethernet1/1
switchport mode fabricpath
interface Ethernet1/2
switchport mode fabricpath
interface Ethernet1/17
switchport mode fabricpath
interface Ethernet1/18
switchport mode fabricpath
fabricpath domain default
fabricpath switch-id 22
n5k-del-1(config)# show run vpc
!Command: show running-config vpc
!Time: Tue Mar 3 12:36:23 2009
version 6.0(2)N2(3)
feature vpc
vpc domain 21
role priority 100
peer-keepalive destination 10.0.0.22 source 10.0.0.21
auto-recovery
fabricpath switch-id 121
ip arp synchronize
interface port-channel1
vpc peer-link
n5k-del-2(config)# show run vpc
!Command: show running-config vpc
!Time: Tue Mar 3 12:36:01 2009
version 6.0(2)N2(3)
feature vpc
vpc domain 21
role priority 110
peer-keepalive destination 10.0.0.21 source 10.0.0.22
auto-recovery
fabricpath switch-id 121
ip arp synchronize
interface port-channel1
vpc peer-link
any idea?
Best Regards
Hi,
The issue you have is that you don't have any VLANs configured and operating in FabricPath mode i.e.,
!vlan 100 mode fabricpath!
I just set this up using your configuration and see exactly the same behavior until a VLAN is created that then has mode fabricpath configured.
If you look at the peer-link state in the FabricPath topology and active the VLANs I think you'll see the forwarding state of the interface is DOWN and there are no active VLANs.
N5K-p10-1# sh fabricpath isis interface port-channel 101Fabricpath IS-IS domain: defaultInterface: port-channel101 Status: protocol-up/link-up/admin-up Index: 0x0001, Local Circuit ID: 0x01, Circuit Type: L1 No authentication type/keychain configured Authentication check specified Extended Local Circuit ID: 0x16000064, P2P Circuit ID: 0000.0000.0000.00 Retx interval: 5, Retx throttle interval: 66 ms LSP interval: 33 ms, MTU: 1500 P2P Adjs: 1, AdjsUp: 1, Priority 64 Hello Interval: 10, Multi: 3, Next IIH: 00:00:03 Level Adjs AdjsUp Metric CSNP Next CSNP Last LSP ID 1 1 1 20 60 00:00:35 ffff.ffff.ffff.ff-ff Topologies enabled: Topology Metric MetricConfig Forwarding 0 20 no DOWNN5K-p10-1# sh fabricpath topology interface port-channel 101Interface Topo-Description Topo-ID Topo-IF-State------------------- -------------------------------- ---------- -------------port-channel101 0 0 DownN5K-p10-1# sh fabricpath topology vlan activeTopo-Description Topo-ID Active VLAN List-------------------------------- --------- -------------------------------------0 0 --
If you then change the VLAN mode from mode ce to mode fabricpath (note that you need to exit the vlan configuration mode for the change to take effect), you should see the following SYSLOG message:
2014 Feb 3 12:50:23 N5K-p10-1 %ETHPORT-3-IF_ERROR_VLANS_REMOVED: VLANs 99-100 on Interface port-channel101 are removed from suspended state.2014 Feb 3 12:50:23 N5K-p10-1 %L3VM-5-FP_TPG_INTF_UP: Interface port-channel101 up in fabricpath topology 0
And then show vpc will indicate that the vPC fabricpath status as "peer is reachable through fabricpath"
N5K-p10-1# sh vpcLegend: (*) - local vPC is down, forwarding via vPC peer-linkvPC domain id : 21vPC+ switch id : 121Peer status : peer adjacency formed okvPC keep-alive status : peer is alivevPC fabricpath status : peer is reachable through fabricpath[snip]N5K-p10-1# show fabricpath isis interface port-channel 101
Fabricpath IS-IS domain: default
Interface: port-channel101
Status: protocol-up/link-up/admin-up
Index: 0x0001, Local Circuit ID: 0x01, Circuit Type: L1
No authentication type/keychain configured
Authentication check specified
Extended Local Circuit ID: 0x16000064, P2P Circuit ID: 0000.0000.0000.00
Retx interval: 5, Retx throttle interval: 66 ms
LSP interval: 33 ms, MTU: 1500
P2P Adjs: 1, AdjsUp: 1, Priority 64
Hello Interval: 10, Multi: 3, Next IIH: 00:00:01
Level Adjs AdjsUp Metric CSNP Next CSNP Last LSP ID
1 1 1 20 60 00:00:47 ffff.ffff.ffff.ff-ff
Topologies enabled:
Topology Metric MetricConfig Forwarding
0 20 no UP
TN5K-p10-1# show fabricpath topology vlan active
Topo-Description Topo-ID Active VLAN List
0 0 99-100
Regards
Similar Messages
-
FabricPath vPC port-channel err-disabled CE Vlan?
I have a pair of Nexus 56128 configured with fabric path and vpc+. The Nexus pair has UCS connected downstream using vpc port-channels. When a Vlan is in mode fabricpath, it's ok for the vpc+ peer-link and the vpc port-channel to UCS. However when I changed the vlan to classic Ethernet, it's err-diabled in the vpc port-channels.
Is this the normal behavior of fabric path domain? In other words, CE Vlans and fabric path Vlans cannot use the same Layer 2 path, correct?
If I need to transport CE Vlans and fabric path Vlans from Nexus (fabric path vpc+) to UCS, I have to use a separate non-vpc port-channel for the CE Vlans between each Nexus and UCS?
ThanksI have a pair of Nexus 56128 configured with fabric path and vpc+. The Nexus pair has UCS connected downstream using vpc port-channels. When a Vlan is in mode fabricpath, it's ok for the vpc+ peer-link and the vpc port-channel to UCS. However when I changed the vlan to classic Ethernet, it's err-diabled in the vpc port-channels.
Is this the normal behavior of fabric path domain? In other words, CE Vlans and fabric path Vlans cannot use the same Layer 2 path, correct?
If I need to transport CE Vlans and fabric path Vlans from Nexus (fabric path vpc+) to UCS, I have to use a separate non-vpc port-channel for the CE Vlans between each Nexus and UCS?
Thanks -
N5K - monitor vPC status via SNMP
Can I monitor a vPC via SNMP?
I'm interested in "Peer status", "vPC keep-alive status", "Configuration consistency status" and "vPC role".
N5K1(config-if)# show vpc
Legend:
(*) - local vPC is down, forwarding via vPC peer-link
vPC domain id : 1
Peer status : peer adjacency formed ok
vPC keep-alive status : peer is alive
Configuration consistency status: success
vPC role : primaryGood question, I also want to know how we can do that.
Sent from Cisco Technical Support iPad App -
"Peer-switch" command on vPC domain and spanning-tree priority interaction
Hi guy,
We have 2 N7K (N7KA and N7KB) which will be running vPC in hybird and pure vPC environment.
I have a question about the Hybird and pure vPC environment. With the "peer-switch" command enable, should i tune the spanning-tree priority to be the same for all the vlan running on vPC on both N7KA and N7KB? This way, when i enter the "sh spanning-tree vlan X(vPC vlan) detail" command on N7K, it will list both N7K announc itself as "We are the root of the spanning tree".Also the switch running spanning-tree with N7K vPC vlan (Hybird), will see both N7K has the same priority (4096), and it is not desirable for a spanning-tree environment. Therefore, i used the "spanning-tree pseudo-information" on N7KB to tune the spanning-tree priority to "8192" and the switch running spanning-tree with N7K will list N7KB has a priority of 8192(perfect).
However, I notice some strange "show" output on the switch running Port-channel with the N7KA and N7KB. The "Designated bridge" priority is flapping as show on the switch. It is constantly changing between "4096 and 8192" with the same vPC system wide mac address.
Entering the "sh spanning-tree vlan X detail" command repeatly on switch with port-channel toward N7KA and N7KB.
>>sh spanning-tree vlan 10 detail
Port 65 (Port-channel1) of VLAN10 is root forwarding
Port path cost 3, Port priority 128, Port Identifier 128.65.
Designated root has priority 4106, address 0013.05ee.bac8
Designated bridge has priority 4106, address 0013.05ee.bac8
Designated port id is 144.2999, designated path cost 0
Timers: message age 15, forward delay 0, hold 0
Number of transitions to forwarding state: 1
Link type is point-to-point by default
BPDU: sent 5, received 603
one sec later.
>>sh spanning-tree vlan 10 detail
Port 65 (Port-channel1) of VLAN10 is root forwarding Port path cost 3, Port priority 128, Port Identifier 128.65. Designated root has priority 4106, address 0013.05ee.bac8 Designated bridge has priority 8202, address 0013.05ee.bac8 Designated port id is 144.2999, designated path cost 0 Timers: message age 15, forward delay 0, hold 0 Number of transitions to forwarding state: 1 Link type is point-to-point by default BPDU: sent 5, received 603
Configuration:
N7KA
spanning-tree vlan 1-10 priority 4096
vpc domain 200
peer-switch
N7KB
spanning-tree vlan 1-10 priority 4096spanning-tree pseudo-information vlan 1-10 designated priority 8192
vpc domain 200
peer-switchWe have a issue similar to this in our environment. I am trying to upgrade the existing 3750 stack router with 2 Nexus 5596 running VPC between them. For the transition I have planned to create a channel between 3750 stack and 5596's. Once this environment is set, my plan is to migrate all the access switches to N5k.
The issue is when I connect the 3750 port channel to both N5Ks, all the Vlans on 3750 started to flap. If I connect the port channel to only one N5K everything is normal; but when I connect the port channel to both N5K running VPC, vlans are flapping. Any idea what is going wrong here? Am I missing something? -
Help:cisco2960 connect to the N5K
i have a pair of cico 6504 running vss and layer3
a pair of n5k vpc to the 6504 and run as layer2 switch
one n2k and one cisco2960 dual-home upstream switch to the n5k with vpc.
first,let my laptop connect to the 2960 and ping the svi interface on 6504,reload one n5k,i got "Lost = 3 (6% loss)" ping timeout when it's up.
now let my laptop connect to the n2k,the same testing but no ping timeout
the delay restore time is 120s on n5k vpc domain
when the delay restore time modified to 90s or 30s,packets loss happened on n2k but nothings changed for 2960. like port-channel was up very early on 2960 during n5k start
but packets can not be forwarded. how to control port-channel forward packets to another n5k until reloading finished completelyHi,prkrishn
Symptom:
Broadcasts sent from vPC secondary to the peer-link will not transmit on the vPC primary destination vPC. This is usually seen when the secondary switch has orphan ports or L3 interfaces that are up while the vPCs are suspended.
The observed impact is noticed while vPC delay restore is in effect. Traffic must be successfully forwarded across the peer-link to transmit out the primary's vPCs. Since this is not happening properly, the delay restore timer affects the length of the outage.
Conditions:
This problem happens specifically on Nexus 5548 and 5596, but could not occur on Nexus 5010 or 5020.
Workaround:
Reduce the delay restore timer to minimize impact, but tune to give enough time for routing protocols to converge:
vpc domain [id]
delay restore 10
n5k version is 5.0(3)N2(1) for us
but what i don't understand is "broadcasts sent from vPC secondary" in my opinion,vpc "secondary" only on control layer,forwarding occurs at the same time between primary and secondary n5k.
actually,i want to know the difference between the port-channel on n2k and it's on 2960. -
I am currently deploying Nexus 5500 with Fabric path & deploying FEX as well. If you look at the FEX data sheet they talked about 4 different topology.
I have 2 question.
Please see link below:
http://www.cisco.com/c/en/us/products/collateral/switches/nexus-2000-series-fabric-extenders/data_sheet_c78-507093.html
With Fabricpath vPC+ I am seeing only Single Home FEX.
1 Does this mean only Single home FEX supported with Fabricpath vPC+ ?
2 Also I am seeing lot of debate on Single Home FEX vs Dual Home FEX & there is no right answer to the question what is better but for the design simplicity & troubleshooting I like the Single home FEX with Servers dual homed to the different FEX.
Thank in Advance
Sincerely
Viral PatelSimens,
Please check the below link if this is helpfull:
http://adamraffe.com/2013/08/23/anycast-hsrp-4-way-hsrp-with-fabricpath/ -
Hello,
I try to build virtual Portchannels on 2 Nexus 5548UP and 2 UCS 6248FI. With standalone links (without vPC) the communication between some ESX-Server and my Network is working. When I build vPCs on the N5k the vPC all portchannels (on N5K and FIs) are up.
The Portchannels are pinned to the vNICs and all looks fine. But there is no communication between my ESXs and my network. My configuration is like this:Hi Roberts,
Are the VLANs allowed on the peer link? because if they work in standalone then that means trunk is fine but if they don't have them allowed on the peer link then it will stay up but wont talk -
Here's the scenario:
We're working on a new DC design. Dual 6509VSS in core, dual Nexus 5k and 14 FEXs. The 2ks will be dual attached to the 5ks.
Now, I read somewhere else that the 5k is limited to a maximum of 16 vPCs.
So the question comes up... does that mean that the current design with a vPC to the core VSS, the peer vPC and all 14 vPCs to the FEX are topping us out?
Also, all of the designs I've seen have only 2 5ks peering together. Can you have 3 or 4 5ks peer together?
Thanks.I have to make the same design: VSS + 2x N5000. Currently i don't plan to connect the N5000 w. VPC upstream to C6500-VSS (i do plan VPC downstream). I plan to connect each N5000 individually to the VSS chassis with 2x 10G MEC. On the N5000, this is just a local portchannel. Since the connection between the N5000 is only used for VPC and is not considered as a real L2 link, there is no STP loop in this design.
If the downsteam devices alternate their active/passive links between N5-1 and N5-2, both N5s will carry traffic.
PS. i have more confidence in a simple portchannel. You don't want VPC problems (crash/early deployment problems) on the uplinks to VSS, basically isolating your datacenter or risking L2 loops.
PPS. one remark i still have here is: on the N5K, you don't want to connect the uplinks towards VSS on adjacent ports using the same port-group. If the port-group ASIC fails, you will be blackholing traffic in the datacenter as the downstream interfaces will remain up. On C3750 switches, this is solved by Link State Tracking, however this is not supported on N5K, which i really regret. But Cisco says: we don't need Link State Tracking on N5K, as the N5K supports VPc to work around this....However, i feel this is not an excuse to not implement LinkStateTracking in N5K. VPc indeed is usefull if the upstream switches are L2 connected, however, if the upstreams are VSS switches a simple portchannel with link state tracking would suffice and have faster convergence....
regards,
Geert -
Hi All
I found following spec in 8510 controller data sheet
Interfaces and Indicators
• 2 x 10 Gigabit Ethernet interfaces
• Small Form-Factor Pluggable (SFP) options (only Cisco SFPs supported): SFP-10G-SR
• LED indicators: Network Link, Diagnostics
• 1x Service Port: 10/100/1000 Mbps Ethernet (RJ-45)
However, I need Long Range SFP, i.e SFP-10G-LR
Would that be supported?hehe. Me the same. I guess you also wanted to connect the controller to a physical diverse VSS or N7K or other system ? , now i am going to have it connected to two seperate N5K (no vpc) in Active/Standby mode.
-
Today I got this messages i my nexus log:
2013 Dec 16 05:51:24 sw39 %SYSMGR-FEX105-5-HEARTBEAT_LOSS: Service "ethpc" heartbeat loss 2 ,max 6 .
2013 Dec 16 05:51:29 sw39 %SYSMGR-FEX105-5-HEARTBEAT_LOSS: Service "ethpc" heartbeat loss 3 ,max 6 .
2013 Dec 16 05:51:44 sw39 %SYSMGR-FEX105-5-HEARTBEAT_LOSS: Service "ethpc" heartbeat loss 2 ,max 6 .
2013 Dec 16 05:51:49 sw39 %SYSMGR-FEX105-5-HEARTBEAT_LOSS: Service "ethpc" heartbeat loss 3 ,max 6 .
2013 Dec 16 05:51:54 sw39 %SYSMGR-FEX105-5-HEARTBEAT_LOSS: Service "ethpc" heartbeat loss 4 ,max 6 .
2013 Dec 16 05:52:09 sw39 %SYSMGR-FEX105-5-HEARTBEAT_LOSS: Service "ethpc" heartbeat loss 2 ,max 6 .
2013 Dec 16 05:52:14 sw39 %SYSMGR-FEX105-5-HEARTBEAT_LOSS: Service "ethpc" heartbeat loss 3 ,max 6 .
Been looking arround for any clue about this, and haven't found anything realted to my log message.
I found this treads, https://supportforums.cisco.com/thread/2249539 and https://supportforums.cisco.com/thread/2168211.
Is this also a bug-realted messages?
I'm running 2 N5K in vPC and this looks fine. The NXOS is 6.0(2)N2(2).
Br
GeirToday I got this messages i my nexus log:
2013 Dec 16 05:51:24 sw39 %SYSMGR-FEX105-5-HEARTBEAT_LOSS: Service "ethpc" heartbeat loss 2 ,max 6 .
2013 Dec 16 05:51:29 sw39 %SYSMGR-FEX105-5-HEARTBEAT_LOSS: Service "ethpc" heartbeat loss 3 ,max 6 .
2013 Dec 16 05:51:44 sw39 %SYSMGR-FEX105-5-HEARTBEAT_LOSS: Service "ethpc" heartbeat loss 2 ,max 6 .
2013 Dec 16 05:51:49 sw39 %SYSMGR-FEX105-5-HEARTBEAT_LOSS: Service "ethpc" heartbeat loss 3 ,max 6 .
2013 Dec 16 05:51:54 sw39 %SYSMGR-FEX105-5-HEARTBEAT_LOSS: Service "ethpc" heartbeat loss 4 ,max 6 .
2013 Dec 16 05:52:09 sw39 %SYSMGR-FEX105-5-HEARTBEAT_LOSS: Service "ethpc" heartbeat loss 2 ,max 6 .
2013 Dec 16 05:52:14 sw39 %SYSMGR-FEX105-5-HEARTBEAT_LOSS: Service "ethpc" heartbeat loss 3 ,max 6 .
Been looking arround for any clue about this, and haven't found anything realted to my log message.
I found this treads, https://supportforums.cisco.com/thread/2249539 and https://supportforums.cisco.com/thread/2168211.
Is this also a bug-realted messages?
I'm running 2 N5K in vPC and this looks fine. The NXOS is 6.0(2)N2(2).
Br
Geir -
WAN Router Connection to Data Center
We have a WAN router that needs to connect to our Data Center network. The Data Center consists of two N7K core switches, with a pair of N5K switches as aggregation, and each N5K has twelve N2K fabric extenders. The N2Ks are single-homed to the N5Ks. The N5Ks are vPC connected to the N7Ks.
We would like to attach the WAN router to both N7K switches in the Data Center. The N7K switches only have 10G ports in them, so we can't terminate the WAN router directly to the N7Ks.
I was considering creating one dedicated VLAN on each N7K, and assigning an SVI to each VLAN, to correspond to the L3 connections between the N7Ks and the WAN router. Then, we could trunk these VLANs to each of the N5Ks, and configure one 1G port on each N5K for the VLAN, and connect the WAN router to the N5Ks.
Two questions regarding this design:
1) Is there a problem in connecting the L3 WAN router to the N7K via the N5K?
2) Does vPC connectivity between the N7K and N5K pose a problem for the proposed WAN connectivity?
Thanks in advance for any feedback.
-rbThe vPC between N5K and N7K is the catch here. Layer-3 routing over vPC member ports is currently not supported so I will advise you to stay away from this approach.
Atif -
Nexus 5000 vpc and fabricpath considerations
Hello community,
I'm currently in the process of implementing a fabricpath environment which includes Nexus 5548UP as well Nexus 7009
NX OS on N5K is 6.0(2)N1(2)
Regarding the FP config on the N5K I wonder what is the best practice for the peer-link. Is it necessary to configure the Portchannel like below:
interface port-channel2
description VPC+ Peer Link
switchport mode fabricpath
spanning-tree port type network
vpc peer-link
There are several VLANs configured as FP.
As I understand we can remove the command:
spanning-tree port type network
Can anyone confirm this ?
Also I noticed a "cosmetic" problem. On two port 1/9 and 1/10 on both N5K it isn't possible to execute the command "speed"?!
When the command speed is executed I receive the following error:
ERROR: Ethernet1/9: Configuration does not match the port capability
Also please notice after the vPC and FP configuration we don't do a reload!
Thanks
UdoHi Simon -
Have done some testings in the lab on ISSU with FEXes either in Active/Active and Straight-through fashion, and it works.
Disabling BA on N5K(except the vPC peer link) is one of the requirements for ISSU .
In a lately lab testing with the following topo, BA is configured on the vpc 101 between the N5Ks and Cat6k. We have a repeated regular ping between the SVI interfaces of c3750 and Cat6K.
c3750
||
vPC
||
N5K =====vPC====== N5K
||
vpc 101
||
Cat6k
When we changed the network type to disable BA, we observed some ping drops, which around 20-30.
I am not sure what your network looks like, hopefully this will give you some ideas about the ISSU. As a general recommendation, schedule a change window for some changes or even ISSU.
regards,
Michael -
Packet drops caused by flapping FabricPath SSID's in MAC entries on N5K.
Hi there,
I have a strange issue in flapping MAC entries caused by ARP replies from the OTV AED for the HSRP vip address. Our Datacenter Infrastructure is build with N7K in the core with 2 VDC's, one for OTV and one for Fabricpath and vPC's. The access layer is build with N5K with Fabricpath between N7K and N5K. Routing occurs in the N7K with HSRP in both datacenters with vlan stretching and FHRP filtering in OTV, so active routers in both datacenters. The N7K is in a vPC domain and the N5K in another vPC domain. The OTV layer is connected via vPC uplinks.Traffic forwarding (when routed) from host connected to N5K is based on MAC entries in N5K for the HSRP vip address. In the sample below you see a fabricpath destination for HSRP vip entries. These entries are build based on ARP replies from the active HSRP router. The entry with SSID=12 is based on a ARP reply from the OTV AED, caused by the proxy-arp nature from OTV. These entries are changing continously for all vlans. Most of the time the SSID =0, but sometimes there changing. When i set up a ping to a host behind the N5K, there are time-outs occuring. At that moment the reply from the host is seen on the uplink to the OTV AED.
bornsw244_005# sh mac address-table | i 0000.0c9f.
* 105 0000.0c9f.f069 dynamic 0 F F 1001.0.65535
* 102 0000.0c9f.f066 dynamic 0 F F 1001.0.65535
* 101 0000.0c9f.f065 dynamic 0 F F 1001.12.65535
* 100 0000.0c9f.f064 dynamic 0 F F 1001.0.65535
I did not found any familiair problems on forums. I want to block the ARP replies on the uplink to the OTV AED, but don't know if there's already a solution for this? So please help!
This is the (hopefully) solution i intend to apply:
mac access-list HSRP_VMAC
10 deny 0000.0c07.ac00 0000.0000.00ff any 0x806
20 deny 0000.0c9f.f000 0000.0000.0fff any 0x806
30 permit any any
interface port-channel 3
mac port access-group HSRP_VMAC
interface port-channel 4
mac port access-group HSRP_VMAC
Regards,
Frans BragonjeHi,
if you remove "encryption mode ciphers aes-ccm tkip" from the radio interface does it help?
it should remain like this:
interface Dot11Radio0
no ip address
no ip route-cache
encryption vlan 1 mode ciphers aes-ccm tkip
ssid WLAN_Corporate
ssid WLAN_HartKitGuest
HTH,
Tiago
If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it. -
VPC N5k Switch Failure causes connectivity disruption
Hello,
I have configured enhanced vPC on 2 n5k and B22 FEXs (vPC from 5k to B22, and vPC from B22 to blade servers).
Everything is running smoothly, except when I power off one of the 5k, the connectivity to the blade servers is lost, comes back up for a short while, loses connectivity again, and after a few minutes comes back up for good.
From the logs I can see that all the port-channels (peer-link, to the FEXs and port-channels to other switches in network) get in down state, then fizical interfaces start coming backup in fabric mode, then port-channels, see FEXs starting to get online then all the port-channels go down again and then whole thing starts again.(all of this is hapenig with one of the 5k powerd off, same thing hapens with promary and secondary vpc).
Connectivity is lost in the same way when the 5k is started again, but just once.
I am running NX OS version 5.2.1N1.3.
I have no idea what could cause this behavior.
Any help would be appreciated.
Regards,
BogdanHi Reza,
Below you can find my run-config.
version 5.2(1)N1(3)
feature fcoe
install feature-set virtualization
feature-set virtualization
logging level feature-mgr 0
hostname N5k_1
feature npiv
feature telnet
cfs eth distribute
feature udld
feature interface-vlan
feature lacp
feature vpc
feature lldp
feature vtp
feature fex
fex 107
pinning max-links 1
description "FEX0107"
fcoe
fex 108
pinning max-links 1
description "FEX0108"
slot 1
port 31-32 type fc
vpc domain 1
role priority 1000
peer-keepalive destination 1.1.1.2
auto-recovery
vsan database
vsan 50 name "VSAN_A"
fcdomain fcid database
interface port-channel100
description Po Synch N5k
switchport mode trunk
spanning-tree port type network
logging event port link-status
logging event port trunk-status
speed 10000
vpc peer-link
interface port-channel107
switchport mode fex-fabric
fex associate 107
vpc 107
interface port-channel108
switchport mode fex-fabric
fex associate 108
vpc 108
interface port-channel111
switchport mode trunk
interface vfc111
bind interface Ethernet107/1/1
no shutdown
vsan database
vsan 50 interface vfc111
vsan 50 interface fc1/31
vsan 50 interface fc1/32
interface fc1/31
no shutdown
interface fc1/32
no shutdown
interface Ethernet1/1
description Synch N5k
switchport mode trunk
logging event port link-status
logging event port trunk-status
udld aggressive
channel-group 100 mode active
interface Ethernet1/2
description Synch N5k
switchport mode trunk
logging event port link-status
logging event port trunk-status
udld aggressive
channel-group 100 mode active
interface Ethernet1/3
description Synch N5k
switchport mode trunk
logging event port link-status
logging event port trunk-status
udld aggressive
channel-group 100 mode active
interface Ethernet1/4
description Synch N5k
switchport mode trunk
logging event port link-status
logging event port trunk-status
udld aggressive
channel-group 100 mode active
interface Ethernet1/5
switchport mode fex-fabric
fex associate 107
channel-group 107
interface Ethernet1/6
switchport mode fex-fabric
fex associate 107
channel-group 107
interface Ethernet1/7
switchport mode fex-fabric
fex associate 108
channel-group 108
interface Ethernet1/8
switchport mode fex-fabric
fex associate 108
channel-group 108
interface Ethernet107/1/1
switchport mode trunk
channel-group 111 mode active
interface Ethernet108/1/1
switchport mode trunk
channel-group 111 mode active
version 5.2(1)N1(3)
feature fcoe
install feature-set virtualization
feature-set virtualization
logging level feature-mgr 0
hostname N5k_2
feature npiv
feature telnet
cfs eth distribute
feature udld
feature interface-vlan
feature lacp
feature vpc
feature lldp
feature vtp
feature fex
fex 107
pinning max-links 1
description "FEX0107"
fex 108
pinning max-links 1
description "FEX0108"
fcoe
slot 1
port 31-32 type fc
vpc domain 1
role priority 1000
peer-keepalive destination 1.1.1.1
auto-recovery
vsan database
vsan 51 name "VSAN_B"
fcdomain fcid database
interface port-channel100
description Po Synch N5k
switchport mode trunk
spanning-tree port type network
logging event port link-status
logging event port trunk-status
speed 10000
vpc peer-link
interface port-channel107
switchport mode fex-fabric
fex associate 107
vpc 107
interface port-channel108
switchport mode fex-fabric
fex associate 108
vpc 108
interface port-channel111
switchport mode trunk
interface vfc111
bind interface Ethernet108/1/1
no shutdown
vsan database
vsan 51 interface vfc111
vsan 51 interface fc1/31
vsan 51 interface fc1/32
interface fc1/31
no shutdown
interface fc1/32
no shutdown
interface Ethernet1/1
description Synch N5k
switchport mode trunk
logging event port link-status
logging event port trunk-status
udld aggressive
channel-group 100 mode active
interface Ethernet1/2
description Synch N5k
switchport mode trunk
logging event port link-status
logging event port trunk-status
udld aggressive
channel-group 100 mode active
interface Ethernet1/3
description Synch N5k
switchport mode trunk
logging event port link-status
logging event port trunk-status
udld aggressive
channel-group 100 mode active
interface Ethernet1/4
description Synch N5k
switchport mode trunk
logging event port link-status
logging event port trunk-status
udld aggressive
channel-group 100 mode active
interface Ethernet1/5
switchport mode fex-fabric
fex associate 107
channel-group 107
interface Ethernet1/6
switchport mode fex-fabric
fex associate 107
channel-group 107
interface Ethernet1/7
switchport mode fex-fabric
fex associate 108
channel-group 108
interface Ethernet1/8
switchport mode fex-fabric
fex associate 108
channel-group 108
interface Ethernet107/1/1
switchport mode trunk
channel-group 111 mode active
interface Ethernet108/1/1
switchport mode trunk
channel-group 111 mode active -
Hi,
I'm trying to find a Cisco based alternative to a customer based HP Mesh network.
The customer have a flat L2 1GbE network: 8 locations, with 2 Core/Spine switches and 36 edge switches per location. The each 36 edge switches/location are connecting 16 different offices in a redundant way (2 switches per office are connected to the 2 core/spine switches in the corresponding location).
All the 8 core/Spine switches are in a partial Mesh connected, running HP Mesh protocol with no need for STP.
My questions are:
can I have, in the Spine, a FabricPath configuration with 8 Nexus 5500 Series (2 per location) and FabricPath enabled on 1GbE Ports, or the "FabricPath ports" must be 10GbE?
can I design a vPC+ between the Nexus 5500 Series in the spine and a pair of Catalyst 2960S (also 1GbE based connections), for example, on the edge site?
Any suggestions will be much appreciated.
Thank you for your help,
DanielHi,
I'm trying to find a Cisco based alternative to a customer based HP Mesh network.
The customer have a flat L2 1GbE network: 8 locations, with 2 Core/Spine switches and 36 edge switches per location. The each 36 edge switches/location are connecting 16 different offices in a redundant way (2 switches per office are connected to the 2 core/spine switches in the corresponding location).
All the 8 core/Spine switches are in a partial Mesh connected, running HP Mesh protocol with no need for STP.
My questions are:
can I have, in the Spine, a FabricPath configuration with 8 Nexus 5500 Series (2 per location) and FabricPath enabled on 1GbE Ports, or the "FabricPath ports" must be 10GbE?
can I design a vPC+ between the Nexus 5500 Series in the spine and a pair of Catalyst 2960S (also 1GbE based connections), for example, on the edge site?
Any suggestions will be much appreciated.
Thank you for your help,
Daniel
Maybe you are looking for
-
Problem in reading client certificate
Hi, I am developing an web app. where client will use smart card for authentication. And server will read the clients certificate. All the application will run in https. So please guide me to develop such a system. I am using tomcat 6x and have creat
-
End of Stream has been reached error CS4
After transcoding the main video file during the build, Encore then prepares "Planning audio for movie" at which case the error "end of stream has been reached" pop up window appears and the burn subsequently fails. There are no errors within the pro
-
I have a freind who is having this problem. In her iMovie when she clicks on her Photos tab a number of images do not show up. The Title is there, there is a space for them but no images. She clicks on the space and it doesn't show up in Ken Burns it
-
Messge "You are currently restricted from purchasi...
Hi, When I want to buy skype credit I get the message You are currently restricted from purchasing services or redeeming vouchers. Could you help me to enable me buying credit? Thanks, M
-
My iphone wont turn on, my iphone wont turn on
my iphone wont turn on, my iphone wont turn onmy iphone wont turn on, my iphone wont turn onmy iphone wont turn on, my iphone wont turn onmy iphone wont turn on, my iphone wont turn onmy iphone wont turn on, my iphone wont turn onmy iphone wont turn