Port-channel with Private VLANs on Nexus1000v

Hi all,
It says that private vlans are not supported on port-channel ports ont Nexus 1000v L2 Switching Guide.
AFAIK, if you have two ports between ESX VEM and physical switch and both these ports are configured as 802.1Q and carrying the same VLANs, when the port which carries the traffic at the moment fails, the other port do not failover automatically. This is mentioned in "Nexus 1000v Deployment Guide version 2" as ,
"Individual Uplinks : A standard uplink is an uplink that is not a member of a PortChannel from the VEM to a physical switch. It provides
no capability to load balance across multiple standard uplink links and no high-availability characteristics. When a standard uplink fails, no secondary link exists to take over. Defining two standard uplinks to carry the same VLAN involves the risk of creating loops within the environment and is an unsupported configuration. Cisco NX-OS will post warnings when such a condition occurs. "
Does anyone have any idea in order for the attached topology to work. Do I have to forward each and every VLAN from different ports ? If I do that how am I going to manage different VLANs and still have that hosts in the same primary VLAN with same IP subnet ?
Thanks in advance.
Dumlu

Hi,
You can't have M and F ports in single port channel irrespective what code version you are running , it will throw error on you..
nor you can have m1 port channel one side and another f port channel other side , port channel

Similar Messages

How to configure a port channel with VLAN trunking (and make it work..)

We're trying to configure a port channel group with trunked ports to connect a NetApp HA pair. We want to create two data LIFs and connect them to the switch stack. We are trying to create 2 data lifs, one for cifs and one for nfs that are on different vlans.
We want the same ports to be able to allow multiple vlans to communicate. (trunked)
These data lifs should be able to fail over to different nodes in the HA pair and still be able to communicate on the network.
What this means is that we have to connect 4 ports each for each node in the NetApp HA Pair to the switches and create a port channel of some type that allows for trunked vlans. When we configure the ports, the configuration is as follows (below):
We are only able to configure an IP on one of the vlans.
When we configure an IP from another vlan for the data lif, it does not respond to a ping.
Does anyone have any idea what I'm doing wrong on the Cisco switch?
interface GigabitEthernet4/0/12
description Netapp2-e0a
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
channel-protocol lacp
channel-group 20 mode active
end
interface GigabitEthernet4/0/13
description Netapp2-e0c
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
channel-protocol lacp
channel-group 20 mode active
end
interface GigabitEthernet6/0/12
description Netapp2-e0b
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
channel-protocol lacp
channel-group 20 mode active
end
interface GigabitEthernet6/0/13
description Netapp2-e0d
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
channel-protocol lacp
channel-group 20 mode active
end
interface Port-channel20
description Netapp2-NFS
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
spanning-tree portfast
spanning-tree bpduguard enable
end

Our problem was fixed by the storage people. They changed the server end to trunk, and the encapsulation / etherchannel.
I like all the suggestions, and they probably helped out with the configuration getting this to work.
Thanks!
interface Port-channel20
description Netapp2-NFS
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
switchport mode trunk
interface GigabitEthernet4/0/12
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
switchport mode trunk
channel-protocol lacp
channel-group 20 mode active
interface GigabitEthernet4/0/13
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
switchport mode trunk
channel-protocol lacp
channel-group 20 mode active
interface GigabitEthernet6/0/12
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
switchport mode trunk
channel-protocol lacp
channel-group 20 mode active
interface GigabitEthernet6/0/13
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
switchport mode trunk
channel-protocol lacp
channel-group 20 mode active

Cisco MDS port channel with USC FI

Hello,
Can anyone help me to configure/troubleshoot Cisco MDS 9148 with Cisco USC ? M stuck in port channel..i have configured but interfaces are not coming UP.It is showing init state.
My Topology is like,
Nexus 5000-->USC FI (single FI) -->Cisco MDS 9148
                                                 --> Two Chassis
Any help would be highly appreciated...
Thanx

TMC-UCSFI-A-A(nxos)# sh interface brief
Interface Vsan   Admin Admin   Status          SFP    Oper Oper   Port
                  Mode   Trunk                          Mode Speed Channel
                         Mode                                 (Gbps)
fc1/31     1      NP     off     errDisabled      swl    --           --
fc1/32     1      NP     off     errDisabled      swl    --           --
Ethernet      VLAN   Type Mode   Status Reason                   Speed     Port
Interface                                                                   Ch #
Eth1/1        1      eth fabric up      none                        10G(D) --
Eth1/2        1      eth fabric up      none                        10G(D) --
Eth1/3        1      eth fabric up      none                        10G(D) --
Eth1/4        1      eth fabric up      none                        10G(D) --
Eth1/5        1      eth access down    SFP not inserted            10G(D) --
Eth1/6        1      eth access down    SFP not inserted            10G(D) --
Eth1/7        1      eth access down    SFP not inserted            10G(D) --
Eth1/8        1      eth access down    SFP not inserted            10G(D) --
Eth1/9        1      eth access down    SFP not inserted            10G(D) --
Eth1/10       1      eth access down    SFP not inserted            10G(D) --
Eth1/11       1      eth access down    SFP not inserted            10G(D) --
Eth1/12       1      eth access down    SFP not inserted            10G(D) --
Eth1/13       1      eth access down    SFP not inserted            10G(D) --
Eth1/14       1      eth access down    SFP not inserted            10G(D) --
Eth1/15       1      eth trunk up      none                        10G(D) 100
Eth1/16       1      eth trunk up      none                        10G(D) 100
Eth1/17       1      eth fabric up      none                        10G(D) --
Eth1/18       1      eth fabric up      none                        10G(D) --
Eth1/19       1      eth fabric up      none                        10G(D) --
Eth1/20       1      eth fabric up      none                        10G(D) --
Eth1/21       1      eth access down    SFP not inserted            10G(D) --
Eth1/22       1      eth access down    SFP not inserted            10G(D) --
Eth1/23       1      eth access down    SFP not inserted            10G(D) --
Eth1/24       1      eth access down    SFP not inserted            10G(D) --
Eth1/25       1      eth access down    SFP not inserted            10G(D) --
Eth1/26       1      eth access down    SFP not inserted            10G(D) --
Eth1/27       1      eth access down    SFP not inserted            10G(D) --
Eth1/28       1      eth access down    SFP not inserted            10G(D) --
Eth1/29       1      eth access down    SFP not inserted            10G(D) --
Eth1/30       1      eth access down    SFP not inserted            10G(D) --
output ommitted
TMC-UCSFI-A-A(nxos)#
Here it shows that Fc1/31- 32 which are in trunk , status is errdisabled and admin trunk mode is off

Multi-VRF CE with Private VLANs

Does anyone know if you can implement a VRF instance on a private vlan? I would assume so, and will lab it out as time permits, but was curious if anyone had tried it/knows one way or the other.

Since both the platforms support VRF lite and MPLS VPN, you can use Frame-Relay as the encapsulation for sub interfaces with local DLCI switching.
As the VRF configuration is not media dependent.
HTH-Cheers,
Swaroop
Router 1
interface Serial0/0
no ip address
encapsulation frame-relay
no keepalive
!--- This command disables LMI processing.
interface Serial0/0.1 point-to-point
!--- A point-to-point subinterface has been created.
ip address 172.16.120.105 255.255.255.0
ip vrf forwarding xxx
frame-relay interface-dlci 101
!--- DLCI 101 has been assigned to this interface
Router 2
interface Serial0/0
no ip address
encapsulation frame-relay
no keepalive
!--- This command disables LMI processing.
interface Serial0/0.1 point-to-point
!--- A point-to-point subinterface has been created.
ip vrf forwarding xxx
ip address 172.16.120.120 255.255.255.0
frame-relay interface-dlci 101
!--- DLCI 101 has been assigned to this interface

N7K Port Channel Layer 3 VLAN Question

I have 2 N7K switches and would like to connect them via port channel and put the channel in VLAN 101. I have the following config, does it make sense? Thanks in advance!
interface eth 3/1
switchport
channel-group 101 mode active
interface eth 3/2
switchport
channel-group 101 mode active
interface port-channel 101
switchport
switchport mode access
switchport access vlan 10
spanning-tree network type edge
interface vlan 10
ip address 10.1.1.1/24

Could be something like this in the both sides (if the port numbers match):
conf t
feature lacp
feature interface-vlan
interface eth 3/1
switchport
channel-group 101 mode active
interface eth 3/2
switchport
channel-group 101 mode active
interface port-channel 101
switchport
switchport mode access
switchport access vlan 101
spanning-tree port type network
interface vlan 101
ip address 10.1.1.1/24
no shut
end
vlan 101
end
*(This ip address will be available in only one box, you can use a FHRP as well, to increase the level of reachability)

Switches 2950 with private-vlan

Hi experts!
Do you know if switches 2950 suport private-vlan? I upgrade IOS and try to configure PVLAN, but this switch model dont have the interface mode command "switchport private-vlan".
best regards,
Rodrigo A.

See the below matix:-
http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a0080094830.shtml
HTH>

Write all digitall ports (Channels) with decimal value

Hi,
it is possible to write all digital port with a decimal value for a device with 96 channels in the same time?
I have a USB 6509 device and I want to write each bit whit value 1 in loop (for the first port I write 0,1,2,4,8,16, 32, 64 and 128) with line "Dev3/port0/line0:7", but if I want to write all the ports in the same time how to set the line and the "DAQmx write.vi"?
Thank you.
Solved!
Go to Solution.
Attachments:
Untitled 1.vi ‏13 KB

You can setup reading and writing in 8-bit ports with the 6509. So you could just write 128 to "Dev3/port0". If you want to write to all 12 ports, I recommend making a task that is multiple channels on the 6509 module, each channel in the task being a port. You can then use the Multiple Channel, Single Sample to write your values. Your values will need to be in an array of U8.
There are only two ways to tell somebody thanks: Kudos and Marked Solutions
Unofficial Forum Rules and Guidelines

SG-300 52p POE and the case of Native vlan forgotten on a Port-channel

Hi
We have recently changed our access switched to Cisco Small Business SG-300 52p on which is working firmware
SW version 1.3.5.58
We found out a very annoying problem on Port-channel and default vlan topic.
Our switch have a default vlan diffrent to the vlan 1 that depends on the floor they are, and this native vlan is at first defined on the portchannel of our central switch, a Cisco 3750
Example of a central switch port-channel with a define native vlan:
interface Port-channel2
description TO 1F
switchport trunk encapsulation dot1q
switchport trunk native vlan 6
switchport trunk allowed vlan 4-6,11,13
switchport mode trunk
on the SG300 side the configuration is this:
interface Port-channel2
description 1F
switchport trunk allowed vlan add 4-5,11,13
!next command is internal.
macro auto smartport dynamic_type switch
As you can see there is no "switchport trunk native vlan 6" simply because the SG300 once i write it on the command line, it accepts the command but the command sentence is not written on the conf (why?!)
the result is that everytime the SG300 is restarted on the port-channel i got two AUTO CREATED commands on the configuration "
switchport trunk native vlan 1
switchport default-vlan tagged
that let not work the network on that floor until i manually write on the SG300
no switchport default-vlan tagged
switchport trunk native vlan 6
These command, as said, works once i write them but are not viewed on a "sh run" and so saved on the conf so every time SG 300 is restarted i need to re-write them.
Is this a bug?
have i made some mistake?
Please let me know
regards
Pietro

Figure out!
the problem was on macro i have to write this:
macro auto processing type switch disabled
and then everything starts going as it should be
Regards
Pietro

Port Channel 5548 with 6509

My company just purchased a Nexus 5548. I've been fooling around with the configurations and just getting familiar with this equipment. I've already configured a port channel using 2 10gig ports on our 3850 and its working fine.
Now, I'm trying to configure a second port channel with our 6509 1gig ports. Ports comes up. But I cannot communicate between these 2 devices.
Show CDP Neigh shows the other devices. Show Etherchannel summary is blank
This is the config on the 6509
interface Port-channel22
switchport
switchport trunk encapsulation dot1q
switchport mode trunk
interface GigabitEthernet9/7
switchport
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 22 mode on (I also tried using Active and desirable)
Config on 5548
Inteface Port-Channel 2
switchport
switchport mode trunk
speed 1000
interface ethernet1/32
switchport mode trunk
speed 1000
channel-group 22 mode on
I also have feature Lacp , interface vlan and vlan dot1q tag native enabled
Any ideas why I cannot communicate between these devices?

This is what is showing on the 5548
2015 Mar 18 08:18:09 DC-5548-01 %ETHPORT-5-SPEED: Interface Ethernet1/32, operat
ional speed changed to 1 Gbps
2015 Mar 18 08:18:09 DC-5548-01 %ETHPORT-5-IF_DUPLEX: Interface Ethernet1/32, op
erational duplex mode changed to Full
2015 Mar 18 08:18:09 DC-5548-01 %ETHPORT-5-IF_RX_FLOW_CONTROL: Interface Etherne
t1/32, operational Receive Flow Control state changed to off
2015 Mar 18 08:18:09 DC-5548-01 %ETHPORT-5-IF_TX_FLOW_CONTROL: Interface Etherne
t1/32, operational Transmit Flow Control state changed to off
2015 Mar 18 08:18:09 DC-5548-01 %ETHPORT-5-SPEED: Interface port-channel2, opera
tional speed changed to 1 Gbps
2015 Mar 18 08:18:09 DC-5548-01 %ETHPORT-5-IF_DUPLEX: Interface port-channel2, o
perational duplex mode changed to Full
2015 Mar 18 08:18:09 DC-5548-01 %ETHPORT-5-IF_RX_FLOW_CONTROL: Interface port-ch
annel2, operational Receive Flow Control state changed to off
2015 Mar 18 08:18:09 DC-5548-01 %ETHPORT-5-IF_TX_FLOW_CONTROL: Interface port-ch
annel2, operational Transmit Flow Control state changed to off
2015 Mar 18 08:18:09 DC-5548-01 %ETH_PORT_CHANNEL-5-PORT_UP: port-channel2: Ethe
rnet1/32 is up
2015 Mar 18 08:18:09 DC-5548-01 %ETH_PORT_CHANNEL-5-FOP_CHANGED: port-channel2:
first operational port changed from none to Ethernet1/32
2015 Mar 18 08:18:09 DC-5548-01 %ETHPORT-5-IF_UP: Interface Ethernet1/32 is up i
n mode trunk
2015 Mar 18 08:18:09 DC-5548-01 %ETHPORT-5-IF_UP: Interface port-channel2 is up
in mode trunk
My 6509 does not show anything. Now when I do a show etherchannel summary on the 6509, the protocol is lacp.

Private vlan with MVR or any related solution

I would like to enable MVR on C4507R+E on trunk port. Actually my current network setup is connecting two uplink from this switch to aggregation router as layer 2. And CPE is connected down this switch with private vlan configuration. I have attached interface configurations with this.
I have to apply “mvr vlan 101 receiver vlan 104” in gig 1/1 interface to map the MVR vlan. But that is not supporting when the link is configured as “switchport mode private-vlan trunk”. Only this command is allowing if I configured as “swithport mode trunk”. But if it is normal trunk, private vlan services are not working. Please suggest your solution for this problem.
According to cisco we can’t enable MVR in private vlan trunk port. Is there any other solution for this than ACL to block the stream from CPE to upwards at 4507 switch?
(mvr working, but private vlan is not working)
interface GigabitEthernet1/1
switchport private-vlan trunk allowed vlan 101-104
switchport private-vlan association trunk 200 102
switchport private-vlan association trunk 300 101
switchport mode trunk
mvr type source
mvr vlan 101 receiver vlan 104
mvr immediate
spanning-tree guard loop
end
(private vlan working, but mvr is not working)
interface GigabitEthernet1/2
description "connected to CPE"
switchport private-vlan trunk allowed vlan 101-104
switchport private-vlan association trunk 200 102
switchport private-vlan association trunk 300 101
switchport mode private-vlan trunk
mvr type receiver
mvr immediate
spanning-tree guard loop
end

Hey,
Correct, only one Isolated primary vlan is associated with Primary private vlan. Snippet from configuration guide:
"A primary VLAN can have one isolated VLAN and multiple community VLANs associated with it. An isolated or community VLAN can have only one primary VLAN associated with it."
HTH.
Regards,
RS

Private Vlan, Etherchannel and Isolated Trunk on Nexus 5010

I'm not sure if I'm missing something basic here however i though that I'd ask the question. I recieved a request from a client who is trying to seperate traffic out of a IBM P780 - one set of VIO servers/clients (Prod) is tagged with vlan x going out LAG 1 and another set of VIO server/clients (Test) is tagged with vlan y and z going out LAG 2. The problem is that the management subnet for these devices is on one subnet.
The infrastructure is the host device is trunked via LACP etherchannel to Nexus 2148TP(5010) which than connects to the distribution layer being a Catalyst 6504 VSS. I have tried many things today, however I feel that the correct solution to get this working is to use an Isolated trunk (as the host device does not have private vlan functionality) even though there is no requirement for hosts to be segregated. I have configured:
1. Private vlan mapping on the SVI;
2. Primary vlan and association, and isolated vlan on Distribution (6504 VSS) and Access Layer (5010/2148)
3. All Vlans are trunked between switches
4. Private vlan isolated trunk and host mappings on the port-channel interface to the host (P780).
I haven't had any luck. What I am seeing is as soon as I configure the Primary vlan on the Nexus 5010 (v5.2) (vlan y | private-vlan primary), this vlan (y) does not forward on any trunk on the Nexus 5010 switch, even without any other private vlan configuration. I believe this may be the cause to most of the issues I am having. Has any one else experienced this behaviour. Also, I haven't had a lot of experience with Private Vlans so I might be missing some fundamentals with this configuration. Any help would be appreciated.

Hello Emcmanamy, Bruce,
Thanks for your feedback.
Just like you, I have been facing the same problematic last months with my customer.
Regarding PVLAN on FEX, and as concluded in Bruce’s previous posts I understand :
You can configure a host interface as an isolated or community access port only.
We can configure “isolated trunk port” as well on a host interface. Maybe this specific point could be updated in the documentation.
This ability is documented here =>
http://www.cisco.com/en/US/docs/switches/datacenter/nexus5000/sw/layer2/513_N2_1/b_Cisco_n5k_layer2_config_gd_rel_513_N2_1_chapter_0101.html#task_1170903
You cannot configure a host interface as a promiscuous port.
You cannot configure a host interface as a private VLAN trunk port.
Indeed a pvlan is not allowed on a trunk defined on a FEX host interface.
However since NxOS 5.1(3)N2(1), the feature 'PVLAN on FEX trunk' is supported. But a command has to be activated before => system private-vlan fex trunk . When entered a warning about the presence of ‘FEX isolated trunks’ is prompted.
http://www.cisco.com/en/US/docs/switches/datacenter/nexus5000/sw/layer2/513_N2_1/b_Cisco_n5k_layer2_config_gd_rel_513_N2_1_chapter_0101.html#task_16C0869F1B0C4A68AFC3452721909705
All these conditions are not met on a N5K interface.
Best regards.
Karim

ASA 5585 port-channels

I want to create a port-channel with 2 10Gbs interfaces on 2 ASA 5585 firewalls, and set them up in a failover pair.
In order to do this, do I simply put two 10Gbs interfaces into a channel and then configure the IP addressing and failover address on the logical port-channel interface? (aka interface po1).
Any limitations with this?

Yes, that is exactly what you do..
Create portchannel on switch and ASA
Trunk the vlan on switch side
Create logical interfaces on ASA

ACE - Port-channel High Availability

We have configured two ACEs with high Availability. ACEs link with our cores, switches cat6500, through a port-channel, ACE’s ports G1/1 and G1/2. High availability works fine if some vlan down but it doesn’t work if an interface down, only if both interfaces get down because then, all vlans of the channel port get down two.
If possible get an interface port-channel high availability?
Thanks for your help in advance.

Thanks for your answer. I have two Cat6500, no VSS possibility. I have two ACEs so each one has configured a port-channel with one Cat6500 (two ports). It works fine. Any problem with that. My issue is when one port-channel of both port is down, failover doesn’t works then, only if both ports are down or vlans are down. I think high availability is only possible in vlan interfaces, not in physical interfaces.
Regards my friend.

FEX-2232 FCoE Port channel limitation

Hi all,
i havea single FEX 2232 single homed to nexus 5020 via port-channel. at the FEX 2232, i connected a server which have 2 X CNA and running two vlans: vlan 200 for ethernet and vlan 300 for FCoE.
i connected the server to the single fex via port-channel and allowed vlan 200 & 300. at the N5K i bounded single vfc interface to this port-channel.
when i am issuing the show flogi database i see only single PWWN.
as i understand, a single vfc interface can only see single PWWN, is this correct ?
if it does, how can i have my setup running in a way that ethernet traffic will used port-channel and for fcoe traffic i will see two PWWN ?
please advise,
Avi.

It is not necessary to create another FCoE Vlan if the logins are coming on the same n5k. If there is a requirement for multiple fcoe logins on the same n5k, then it will need to be single link port channels instead of multiple links in the port channel. That way we acquire the ability to bind each physical port via port-channel into a separate vfc. In your case ideally you can have two n5ks with two n2232s single homed to each n5k and the server dual homed with 1 port each connected to two separate 2232s in active-active teaming. That way you can bind the physical interfaces into single virtual port channel on the respective n5ks. at that point, you can separate the san traffic into different vsan/vlan and make sure you dont trunk the fcoe vlan over the vpc peer link.
Hope this helps, Vinayak.

Private vlan question

I am replacing a standard set of switches out with ones that can support PVLAN's. All our switches currently have their ip address on vlan 1 and that is the subnet which the default gateway resides. The second switch acts as a redundant switch and will need the same vlans as the primary. Currently they are etherchanneled together. I want to setup a single private vlan with one isolated vlan and several community vlans. My question is where do I put the IP address? Do I still setup a vlan 1 interface as I have done all along? Or do I put the addrss on the primary private vlan? And I assume I will need to setup a trunk between the two switches, vs. etherchannel?

Private VLANs provide Layer 2 isolation between ports within the same private VLAN. There are three types of private VLAN ports:
PromiscuousA promiscuous port can communicate with all interfaces, including the community and isolated ports within a private VLAN.
IsolatedAn isolated port has complete Layer 2 separation from other ports within the same private VLAN except for the promiscuous port. Private VLANs block all traffic to isolated ports except traffic from promiscuous ports. Traffic received from an isolated port is forwarded only to promiscuous ports.
CommunityCommunity ports communicate among themselves and with their promiscuous ports. These interfaces are isolated at Layer 2 from all other interfaces in other communities or isolated ports within their private VLAN.
PVLANS are also knows as secondary vlans, they are always associated to primary vlans so they can communicate to other devices outside their subnet through the default gateway. The management ip address or sc0 if it's CAtOS will always be in primary vlan or if native IOS and it's interface vlan it will always be the primary vlan. so, to answer your question, the management ip address will be in primary vlan.
You cannot use the inband port, sc0, in a private VLAN.
Note: With software release 6.3(1) and later releases, you can configure the sc0 port as a private VLAN port; however, you cannot configure the sc0 port as a promiscuous port.

Port-channel with Private VLANs on Nexus1000v

Similar Messages

Maybe you are looking for