Nexus-F5 & BGP

Just to background, we are having two data centres with 6509 switches as netwrok. In main data centre two F5 (BIG IP 3600) devices in active & standby mode (source nat mode). In the process of upgrading the entire infrastructure within next 3-6 moths in following manner
1. Replace two F5 in primary DC & installing new F5 in secondary DC (F5 will be in routed mode for certain rquirement of cisco ISE)
2. Replace Cisco6509 in primary DC with Nexus( 2x 7010, 3x 6004 & FEX, etc)
3. Look at Nexus for secondary DC.
Below are the question I am having is about F5-Route Health Injection (to have same VIP on primary & secondary DC) to work in Cisco environment.
1. Does this feature required to have BGP as routing protocol in the network ?
2. Currently OSPF is the IGP in our network, concerning about using BGP for DC this setup. Will this utilize high processng/memory resource of existing 6509s.
3. Is this a recommended/ best practice approach ?
4. When the Nexus switches comes will this work each other. I know 6500 & Nexus is completely two different platforms ?
5. Is there any references around this sort of design/guidelines ?
Thanks
Rasika

Similar Messages

Nexus 7010 bgp state change alert not triggered to NNM

Hi ,
BGP state change alert not triggered to NNM on Nexus -7010 for Monitoring.
Details of the Device:
Nexus 7010 :
Software
BIOS:      version 3.22.0
kickstart: version 5.1(3)
system:    version 5.1(3)
BGP neighbor status :
Neighbor        V    AS MsgRcvd MsgSent   TblVer InQ OutQ Up/Down State/PfxRcd
172.16.1.2      4 65505 5089234 5194515    51359    0    0     6w2d 391
172.16.1.3      4 65505 5044293 5146859    51359    0    0    30w4d 378
172.31.11.3     4 15404 120744 114811    51359    0    0     1w6d 1
172.31.42.3     4 65501 5261796 5264413    51359    0    0    2d06h 0
Snmp trap enabled:
snmp-server user admin network-admin auth md5 0x690c4ede8a88ba7f2de791dbe7a77f0a
priv 0x690c4ede8a88ba7f2de791dbe7a77f0a localizedkey
snmp-server host 172.30.0.55 traps version 2c xxxx
snmp-server enable traps bgp
Downloaded cisco-bgp4-mib version, bgp4-mib tried and performed snmpwalk as given below
nnmsnmpwalk.ovpl -c xxx 172.31.15.130 .1.3.6.1.4.1.9.9.187.0.6
Error : No MIB objects contained under subtree
nnmsnmpwalk.ovpl -v 2 -c xxx 172.31.15.130 .1.3.6.1.2.1.15.3.
No MIB objects contained under subtree
Kindly advise to resolve the issue
Regards
Hari

You can set an alert for Warning State. This is feasible.
Juke Chou
TechNet Community Support

How many BGP peers does the 3548 switch support?

Is it possible to run more than 40 peers on a single switch? What is the limitation if not?

Hi ,
You can have 40 BGP peers , IPV4 unicast routes handled by hardware is only 24000 .Enusre all your BGP peering routing updates is within this limits .
http://www.cisco.com/c/en/us/products/collateral/switches/nexus-3548-switch/data_sheet_c78-707001.html
Table 7. Hardware Specifications Common to Both Switches
Mode
Normal Mode
Warp Mode
Hardware tables and scalability
Number of MAC addresses
64,000
8000
Number of IPv4 unicast routes
24,000
4000
Number of IPv4 hosts
64,000
8000
Number of IPv4 multicast routes
8000
8000
Number of VLANS
4096
Number of ACL entries
4096
Number of spanning-tree instances
Rapid Spanning Tree Protocol (RSTP): 512
Multiple Spanning Tree (MST) Protocol: 64
Number of EtherChannels
24
Number of ports per EtherChannel
24
Buffer size
6 MB shared among 16 ports; 18 MB total
Boot flash memory
2 GB
HTH
Sandy

EEM / IP SLA to shutdown lossy high RTT BGP neighbor

Hi,
I'm relatively new to the IP SLA procedure and very new to EEM. I'm searching for the most efficient way to monitor the availability (packet loss and latency) of a BGP neighbor from a router to actively shutdown the neighbor relationship in order to failover to a back up L2L VPN I have configured on an ASA. It's important that I'm able to continue monitoring the BGP neighbor so that when the neighbor becomes stable again, I can reenable the BGP neighbor relationship. I've put something quick together (below) but am not sure if it will do what I want. I'd appreciate any suggestions and feedback.
Thank you!
-Mike
ip sla 90
icmp-echo <neighbor_ip> source-ip <source_ip>
threshold 250
timeout 500
frequency 3
ip sla schedule 90 life forever start-time now
ip sla enable reaction-alerts
track 90 ip sla 90 reachability
delay down 3 up 180
event manager applet BGP_NEIGHBOR_DIRTY
description SHUT DOWN BGP NEIGHBOR IF RTT OVER 250 FOR 3 SECONDS
event syslog pattern "90 ip sla 90 reachability Up->Down"
action 1.0 cli command "enable"
action 1.1 cli command "configure term"
action 1.2 cli command "router bgp 63320"
action 1.3 cli command "neighbor <neighbor_ip> shutdown"
action 1.4 cli command "end"
event manager applet BGP_NEIGHBOR_CLEAN
description ENABLE BGP NEIGHBOR IF RTT UNDER 250 FOR 3 MINUTES
event syslog pattern "90 ip sla 90 reachability Down->Up"
action 1.0 cli command "enable"
action 1.1 cli command "configure term"
action 1.2 cli command "router bgp 63320"
action 1.3 cli command "no neighbor <neighbor_ip> shutdown"
action 1.4 cli command "end"

By chosing a target that is along your desired path, you can certainly have a more robust script. I would use loopback to loopback communication as well, this will force the traffic through the router, and also find any potential issues where the peer is alive and sending bgp but not actually passing traffic. You will definitely need some "fudge" factors in there to deal with routers have to process the ICMP packets (Any CoPP will really really skew the results you are getting). I have had experiences where testing to/from a Nexus device gives wildly different results vs testing through the boxes.
HTH

NX-OS vrf bgp local-as interaction with L3vpn

I use standard MPLS BGP-L3vpn to forward traffic between VRFs on Nexus 7k routers. All of my VRFs are within the same BGP process, so have the same local-as.
I'd like to bring-up an eBGP session from one VRF to a carrier, but the carriers requires that they peer with a specific BGP ASN (call it "65432"). It doesn't look like NX-OS supports the "router bgp 1234, vrf VRF1 neighbor w.x.y.z local-as 65432" command. However, it does appear to support "router bgp 1234, vrf VRF1, local-as 65432".
My limited understanding is that this would prepend "65432" onto all routes advertised to all VRF1 neighbors? And that all neighbors defined under VRF1 on this router would learn routes from me with as-path "^65432 1234 ..."?
If so, would this have any affect on routes exchanged with other VRFs using import/export rd?

It's tricky given that BGP's AD is always going to beat out EIGRP's all other things being equal. Most of the things you can do with BGP route-maps involve making one BGP route preferred over another.
You could inject the preferred path as a static route (AD = 1) to the firewall using an ip sla operation and having the static route track that. Once the ip sla operation fails, the static route is withdrawn and then the BGP-learned route (AD = 20) will take precedence.

Nexus5548 BGP soft-reconfiguration inbound

Hi,
I have a small problem when using Nexus5548 version 5.2(1)N1(2a) with BGP and "soft-reconfiguration inbound". The BGP config looks exactly like other Nexus implementations with BGP but with N5K im not able to see "show ip bgp neighbors x.x.x.x received-routes". I get the error message saying:
% Inbound soft reconfiguration for IPv4 Unicast not enabled on x.x.x.x
The BGP-config looks like this:
router bgp [ASN]
router-id 1.2.3.4
neighbor x.x.x.x remote-as [eBGP_ASN]
address-family ipv4 unicast
route-map BGP_prim in
soft-reconfiguration inbound
The neighbor looks like it supports this feature:
Neighbor capabilities:
Dynamic capability: advertised (mp, refresh, gr)
Dynamic capability (old): advertised
Route refresh capability (new): advertised received
Route refresh capability (old): advertised received
4-Byte AS capability: advertised received
Address family IPv4 Unicast: advertised received
Graceful Restart capability: advertised
Any idea where im going wrong or is it not possible to do this in N5K?
Cheers! // Mattias

Mattias,
I may be answering a slightly different question but here goes: Are you sure you need the soft-reconfiguration inbound? Are you perhaps confusing this feature with route refresh, a different feature?
It appears that most people do not differentiate between these two features. They provide the same functionality but use vastly different means of accomplishing them.
The soft-reconfig inbound is an ancient workaround about BGP's former inability to ask a neighbor to repeatedly resend a set of routes. Cisco devices have traditionally solved this problem by storing a separate, unfiltered copy of all routes received from a particular neighbor configured with the neighbor soft-reconfig inbound command. Every change on the inbound policy would then simply re-filter the routes from the unfiltered database maintained on a per-neighbor basis. An obvious disadvantage of this approach is the amount of wasted memory to keep unfiltered BGP databases for each neighbor for which you have configured the soft-reconfig inbound.
In RFC 2918 which is 15 years old by now, a new BGP message was standardized: the Route Refresh message. Using this message, a BGP router can ask its neighbor at any time to resend a particular family of routes (IPv4 routes, IPv6 routes, etc.). No storing of unfiltered databases is necessary anymore. In addition, this Route Refresh is negotiated and used automatically as soon as both routers support it.
Now, your Nexus tells you right away:
Route refresh capability (new): advertised received
Route refresh capability (old): advertised received
It is telling you that both your Nexus (advertised) and its neighbor (received) support the Route Refresh feature, and as a result, they will be using it automatically, without you configuring anything in particular.
If you configured soft-reconfig inbound for a neighbor, you would be losing the advantages of Route Refresh, as you would be forcing your router to store unfiltered routes from the neighbor even though both routers support the Route Refresh and storing the unfiltered database is entirely useless.
It is possible that NX-OS tries to do things the smart way, and when it finds out that both peers support Route Refresh, it uses it in place of soft-reconfig inbound even if you have it configured. I am not fluent in NX-OS so I cannot comment on that with certainty but it is a possibility.
In any case, to show the routes received from a neighbor, you should use just show ip bgp neighbor x.x.x.x received routes (not received-routes).
Would you mind trying this out? If this works for you then I suggest that you remove the soft-reconfig inbound from your configuration. It seems to be useless in your (and in most people's) case.
Best regards,
Peter

Nexus 7010 OSPF Equal Cost Paths

Hello,
I currently have two physical links connecting one data center to another. These are both 10Gb links and I have manually set the cost to the primary link to '1' and the secondary link to '10'. My question is, if I set the secondary link to '1' they would have equal cost routes. What is the selection process at this point? Will equal cost load balancing automatically kick in and use both links?
Thank you,
Scott

Scott
Haven't used Nexus switches but generally yes it should do depending on the routing protocol ie. statics, EIGRP, OSPF etc. will use equal cost paths if they are in the routing table.
BGP is different in that without further configuration it picks just one path so there is only one entry in the routing table.
By default it will use per destination load sharing and the default on Nexus is destination IP address and port number to choose which link to use.
"sh ip load-sharing"
will show you the current method it is using.
Jon

Nexus 7000 route leak from GRT (default VRF) to other VRF's

Hello
We have a Nexus 7000 infrastructure whereby we have had multiple VDC's and VRF's deployed. A requirement has now come about whereby one of these VRF's needs to be able to see our GRT (default VRF) so we need to leak the GRT routes into the VRF and vice versa.
I have been doing a lot of reading and I am happy with the how this works with inter-VRF route leaking but I seem to missing a few things in respect of how this works with the GRT.
I have also read on another forum that this is not supported. See link below.
https://supportforums.cisco.com/document/133711/vrf-configuration-and-verification-nexus-7000
Does anyone have experience of this? I can also see how this works in IOS and I have GNS3 and got this working.
We use BGP currently so we are able to use MP-BGP if required.
Any help would be very useful.

Hi,
In Table 14 of the Cisco Nexus 7000 Series NX-OS Verified Scalability Guide the verified limit is specified as 1000 per system i.e., across all VDCs for NX-OS release 5.2, 6.0 and 6.1.
There is a footnote associated with this number which states:
With each new VDC configured, the number of configurable VRFs per system is reduced by two as each VDC has a default VRF and management VRFs that are not removable. For example, with 8 configured VDCs on Cisco NX-OS Release 5.2, you can configure up to 984 VRFs per system (either all in one VDC or across VDCs).
Regards

Nexus 6001 native FC

Does the Nexus 6001 support native FC? I'm having issues changing the port type;
show ver
Cisco Nexus Operating System (NX-OS) Software
TAC support: http://www.cisco.com/tac
Documents: http://www.cisco.com/en/US/products/ps9372/tsd_products_support_series_home.html
Copyright (c) 2002-2014, Cisco Systems, Inc. All rights reserved.
The copyrights to certain works contained herein are owned by
other third parties and are used and distributed under license.
Some parts of this software are covered under the GNU Public
License. A copy of the license is available at
http://www.gnu.org/licenses/gpl.html.
Software
BIOS: version 1.5.0
loader: version N/A
kickstart: version 7.0(5)N1(1)
system: version 7.0(5)N1(1)
Power Sequencer Firmware:
Module 1: version v4.0
Module 2: version v4.0
Fabric Power Sequencer Firmware: Module 1: version v4.0
Microcontroller Firmware: version v1.2.0.5
QSFP Microcontroller Firmware:
Module 2: v1.3.0.0
SFP Microcontroller Firmware:
Module 1: v1.1.0.0
BIOS compile time: 12/29/2012
kickstart image file is: bootflash:///n6000-uk9-kickstart.7.0.5.N1.1.bin
kickstart compile time: 10/29/2014 22:00:00 [10/30/2014 11:46:56]
system image file is: bootflash:///n6000-uk9.7.0.5.N1.1.bin
system compile time: 10/29/2014 22:00:00 [10/30/2014 11:47:58]
Hardware
cisco Nexus 6001 Chassis ("Nexus 64 Supervisor")
Intel(R) Xeon(R) CPU @ 2.00 with 8238120 kB of memory.
Processor Board ID FOC181506P3
Device name: xxxxxxxxxxxxxx
bootflash: 7823360 kB
Kernel uptime is 3 day(s), 17 hour(s), 25 minute(s), 49 second(s)
Last reset at 642096 usecs after Fri Feb 27 15:24:40 2015
Reason: Disruptive upgrade
System version: 6.0(2)N2(3)
Service:
plugin
Core Plugin, Ethernet Plugin, Fc Plugin
xxxxxx# conf t
Enter configuration commands, one per line. End with CNTL/Z.
xxxxxx(config)# slot 1
xxxxxx# port 47-48 type fc
ERROR: Module type doesn't support this CLI
Any help would be appreciated. Thanks

Sorry, should have mentioned that I'd already enabled feature fcoe;
xxxxx(config)# show feature
Feature Name          Instance State
Flexlink              1         disabled
amt                   1         disabled
bfd                   1         disabled
bfd_app               1         disabled
bgp                   1         disabled
bulkstat              1         disabled
cable-management      1         disabled
cts                   1         disabled
dhcp                  1         disabled
dot1x                 1         disabled
eigrp                 1         disabled
eigrp                 2         disabled
eigrp                 3         disabled
eigrp                 4         disabled
eth_port_sec          1         disabled
evmed                 1         disabled
extended_credit       1         disabled
fabric-access         1         disabled
fabric-binding        1         disabled
fabric_mcast          1         disabled
fc-port-security      1         disabled
fcoe                  1         enabled
xxxxxxxxx(config)# slot 1
xxxxxxxxx(config-slot)# port 47-48 type fc
ERROR: Module type doesn't support this CLI

DOM support for 40G transponders on the Nexus 3172PQ switch

I have a new Nexus 3172PQ system which supports 40G transponders, but when the "sh inter ether 1/49 trans det" command is executed, the system responds with DOM is not enabled. I have transponders that support DOM in the system (QSFP-40G-LR4). IOS is 6.0.2. Question is does the 3172 support DOM for the 40G transponders?

FEX dual home is planned for mid next year.
MP BGP VPN V4 not supported on the platform. Not sure about the roadmap item either.

Catalyst 6500 - Nexus 7000 migration

Hello,
I'm planning a platform migration from Catalyst 6500 til Nexus 7000. The old network consists of two pairs of 6500's as serverdistribution, configured with HSRPv1 as FHRP, rapid-pvst and ospf as IGP. Futhermore, the Cat6500 utilize mpls/l3vpn with BGP for 2/3 of the vlans. Otherwise, the topology is quite standard, with a number of 6500 and CBS3020/3120 as serveraccess.
In preparing for the migration, VTP will be discontinued and vlans have been manually "copied" from the 6500 to the N7K's. Bridge assurance is enabled downstream toward the new N55K access-switches, but toward the 6500, the upcoming etherchannels will run in "normal" mode, trying to avoid any problems with BA this way. For now, only L2 will be utilized on the N7K, as we're avaiting the 5.2 release, which includes mpls/l3vpn. But all servers/blade switches will be migrated prior to that.
The questions arise, when migrating Layer3 functionality, incl. hsrp. As per my understanding, hsrp in nxos has been modified slightly to better align with the vPC feature and to avoid sub-optimal forwarding across the vPC peerlink. But that aside, is there anything that would complicate a "sliding" FHRP migration? I'm thinking of configuring SVI's on the N7K's, configuring them with unused ip's and assign the same virtual ip, only decrementing the prio to a value below the current standby-router. Also spanning-tree prio will, if necessary, be modified to better align with hsrp.
From a routing perspective, I'm thinking of configuring ospf/bgp etc. similar to that of the 6500's, only tweaking the metrics (cost, localpref etc) to constrain forwarding on the 6500's and subsequently migrate both routing and FHRP at the same time. Maybe not in a big bang style, but stepwise. Is there anything in particular one should be aware of when doing this? At present, for me this seems like a valid approach, but maybe someone has experience with this (good/bad), so I'm hoping someone has some insight they would like to share.
Topology drawing is attached.
Thanks
/Ulrich

In a normal scenario, yes. But not in vPC. HSRP is a bit different in the vPC environment. Even though the SVI is not the HSRP primary, it will still forward traffic. Please see the below white paper.
http://www.cisco.com/en/US/prod/collateral/switches/ps9441/ps9402/white_paper_c11-516396.html
I will suggest you to set up the SVIs on the N7K but leave them in the down state. Until you are ready to use the N7K as the gateway for the SVIs, shut down the SVIs on the C6K one at a time and turn up the N7K SVIs. When I said "you are ready", it means the spanning-tree root is at the N7K along with all the L3 northbound links (toward the core).
I had a customer who did the same thing that you are trying to do - to avoid down time. However, out of the 50+ SVIs, we've had 1 SVI that HSRP would not establish between C6K and N7K, we ended up moving everything to the N7K on a fly during of the migration. Yes, they were down for about 30 sec - 1 min for each SVI but it is less painful and waste less time because we don't need to figure out what is wrong or any NXOS bugs.
HTH,
jerry

Why does Android Reader smart zoom not work as described on Google Nexus 7 2013 tablet?

The smart zoom feature in Android Acrobat Reader allows you to double tap on a text column and the reader will zoom up to the column in improve readability. This feature works great on the Samsung Galaxy Note 2 smart phone, but only appears to zoom half way on the Google Nexus 7 2013 tablet.
Is this a bug?
Thanks in advance for your replies.
Regards,
Jim Savitz

Would it be possible for you to share the problematic pdf and OS information with us at [email protected] so that we may investigate?
Thanks,
Adobe Reader Team

Diff b/w Nexus 5548P and 5548UP

What is the
Diff b/w Nexus 5548P and 5548UP
regards.

Hi,
A UP or Unified ports allow you to configure ports as Ethernet, native Fibre Channel or Fibre Channel over Ethernet (FCoE) ports. By default, the ports are Ethernet ports but you can change the port mode to Fibre Channel on the following unified ports:
Any port on the Cisco Nexus 5548UP switch or the Cisco Nexus 5596UP switch.
The ports on the Cisco N55-M16UP expansion module that is installed in a Cisco Nexus 5548P switch.
More details:
http://www.cisco.com/web/techdoc/dc/reference/cli/nxos/commands/l2/port.html
Comapre 5548 and 5548:
http://www.cisco.com/en/US/products/ps9670/prod_models_comparison.html
./Abhinav

Error on nexus 7k series " operation failed.the fabric is already locked"

getting following error on nexus 7k series switch: error is " operation failed.the fabric is already locked", while removing ntp commands (no ntp server 10.101.1.1) from switch. Please help.

I had the same error message, only in my situation Outlook would only open successfully every 4 or 5 attempts. When Outlook would open (versus just hanging at the splash screen), I would get two dialog boxes with the warning/error message.
After I clicked okay I could get into Outlook.
Previously I experienced this problem running my Office 2010 client with my Exchange 2007 mailbox on my old laptop. The problem followed my mailbox through an Exchange 2010 migration (so new Exchange org), client upgrade to Outlook 2013, and a new
laptop (so I knew it wasn't a corrupt profile). This led me to the conclusion that it was a corrupt item(s) in my mailbox.
To resolve the issue, I archived *everything* in my mailbox to a PST file, ran SCANPST to fix the corruption, and then uploaded everything back into my Exchange mailbox one folder at a time, stopping after each folder to close and restart Outlook so I could
narrow down which folder had the corrupt item if the problem recurred. I'm happy to say my issue is now resolved.

Can i return my nexus 7 it keeps restarting but i bought it 9 months ago

so i bought a nexus 7 about 9 months ago i was excited to own my first tablet so i ignored the restarting in the beginning i figured google should send a patch of some sort but till this day it actually got worse i have a receipt its a really faded but i have it i also have the box.
So main question can i return it?

Hey mark79,
Welcome to the BestBuy forums! You ask a great question. avm5689 has answered most of it and gave you the information you needed.
Just for further assistance I am going to link you to the troubleshooting/helpful tip area for nexus 7 tablets
https://support.google.com/nexus/answer/4582729?hl=en
You may also join the Nexus Google Forums and ask there for further assistance.
https://productforums.google.com/forum/#!forum/nexus
Just curious, is this restarting constantly, or only when you do a certain item ( such as updating )
Are you able to boot your device into safe mode?
Ensure your device's screen is on, then press & hold the Power button.
Touch & hold the Power off option in the dialog box.
Touch OK in the following dialog to start safe mode.
Does the problem persist while in safe mode?
A good piece of advice though is that there are some 3rd party apps that really mess up the nexus operating system so just a FYI.
If this only restarts while the wifi is in 5ghz that is a well known issue as well.
I am not affiliated with Best Buy nor have I ever been employed by Best Buy. All of my thoughts and posts are of my own opinion and personal experience.
I may not always know the right answer, but I will always tell you what I do know. I also do free computer analysis and consultation via private message.

Nexus-F5 & BGP

Similar Messages

Maybe you are looking for