此产品的文档集力求使用非歧视性语言。在本文档集中,非歧视性语言是指不隐含针对年龄、残障、性别、种族身份、族群身份、性取向、社会经济地位和交叉性的歧视的语言。由于产品软件的用户界面中使用的硬编码语言、基于 RFP 文档使用的语言或引用的第三方产品使用的语言,文档中可能无法确保完全使用非歧视性语言。 深入了解思科如何使用包容性语言。
思科采用人工翻译与机器翻译相结合的方式将此文档翻译成不同语言,希望全球的用户都能通过各自的语言得到支持性的内容。 请注意:即使是最好的机器翻译,其准确度也不及专业翻译人员的水平。 Cisco Systems, Inc. 对于翻译的准确性不承担任何责任,并建议您总是参考英文原始文档(已提供链接)。
本文档介绍 Cisco Nexus 9000 (9k) 系列交换机上用于虚拟端口通道 (vPC) 的最佳实践
此基础许可证还包括热备份路由器协议 (HSRP)、虚拟路由器冗余协议 (VRRP)、链路汇聚控制协议 (LACP)。
开放最短路径优先 (OSPF) 协议或中间系统到中间系统 (ISIS) 协议等第 3 层功能需要 LAN_ENTERPRISE_SERVICES_PKG 许可证。
本文档中的信息基于以下软件和硬件版本:
本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始(默认)配置。如果您的网络处于活动状态,请确保您了解所有命令的潜在影响。
vPC 交换矩阵对等连接提供增强型双宿主接入解决方案,无需为 vPC 对等链路浪费物理端口,从而避免产生相应开销。
本文档适用于:
本文档还介绍了与 vPC 相关的服务中软件升级 (ISSU) 操作,并提供了有关最新 vPC 增强功能(延迟恢复、网络虚拟接口 [NVE] 接口计时器)的详细信息。
vPC 是一种虚拟化技术,用于使两台 Cisco Nexus 9000 系列配对设备对接入层设备或终端呈现为一个唯一性第 2 层逻辑节点。
vPC 属于多机箱 EtherChannel (MCEC) 技术系列。利用虚拟端口通道 (vPC),可以使以物理方式连接到两台不同 Cisco Nexus 9000 系列设备的链路对第三台设备呈现为单个端口通道。
第三台设备可以是交换机、服务器或支持链路汇聚技术的任何其他网络设备。
vPC 具有以下技术优势:
通过使用 vPC,用户可立即获得以下运维和架构优势:
vPC 通过以下方法同时利用硬件和软件冗余特性:
从 STP 的角度来说,vPC 可以消除 STP 阻塞端口并使用所有可用的上行链路带宽。STP 用作故障安全机制,并且不指定用于 vPC 连接设备的第 2 层路径。
在 vPC 域中,用户可以通过多种方式连接接入设备:通过端口通道利用主用/主用行为的 vPC 连接、包括 STP 的主用/备用连接,以及在接入设备上运行的不带 STP 的单个连接。
在图中,主机连接到一对具有 vPC 域 ID 的 Nexus 9000 交换机,但主机配置的交换机本身不运行 vPC。接入交换机/主机在不了解 vPC 的情况下将上行链路注册为简单端口通道。
Leaf-1
vlan 2
vn-segment 10002
vlan 10
vn-segment 10010
route-map PERMIT-ALL permit 10
vrf context test
vni 10002
rd auto
address-family ipv4 unicast
route-target both auto
route-target both auto evpn
interface nve1
no shutdown
host-reachability protocol bgp
source-interface loopback1
member vni 10002 associate-vrf
member vni 10010
suppress-arp
mcast-group 239.1.1.1
interface loopback0
ip address 10.1.1.1/32
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
no shutdown
interface loopback1
ip address 10.2.1.1/32
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
no shutdown
Leaf-2
vlan 2
vn-segment 10002
vlan 10
vn-segment 10010
route-map PERMIT-ALL permit 10
vrf context test
vni 10002
rd auto
address-family ipv4 unicast
route-target both auto
route-target both auto evpn
interface nve1
no shutdown
host-reachability protocol bgp
advertise virtual-rmac
source-interface loopback1
member vni 10002
associate-vrf member
vni 10010
suppress-arp
mcast-group 239.1.1.1
interface loopback1
ip address 10.2.1.4/32
ip address 10.2.1.10/32 secondary
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
icam monitor scale
interface loopback0
ip address 10.1.1.4/32
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
no shutdown
Leaf-2(config-if)# show run vpc
feature vpc
vpc domain 1
peer-switch
peer-keepalive destination 10.201.182.26 source 10.201.182.25
peer-gateway
ip arp synchronize
interface port-channel10
vpc peer-link
interface port-channel20
vpc 20
Leaf-3
vlan 2
vn-segment 10002
vlan 10
vn-segment 10010
route-map PERMIT-ALL permit 10
vrf context test
vni 10002
rd auto
address-family ipv4 unicast
route-target both auto
route-target both auto evpn
interface nve1
no shutdown
host-reachability protocol bgp
advertise virtual-rmac
source-interface loopback1
member vni 10002
associate-vrf member
vni 10010
suppress-arp
mcast-group 239.1.1.1
interface loopback1
ip address 10.2.1.3/32
ip address 10.2.1.10/32 secondary
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
icam monitor scale
interface loopback0
ip address 10.1.1.3/32
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
Leaf-3(config-if)# show run vpc
feature vpc
vpc domain 1
peer-switch
peer-keepalive destination 10.201.182.25 source 10.201.182.26
peer-gateway
ip arp synchronize
interface port-channel10
vpc peer-link
interface port-channel20
vpc 20
Spine-1
interface loopback0
ip address 10.3.1.1/32
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
Host-1
interface Vlan10
no shutdown
vrf member test
ip address 172.16.1.101/25
Host-2
interface Vlan10
no shutdown
vrf member test
ip address 172.16.1.102/25
使用本部分可确认配置能否正常运行。
ip interface Status for VRF "test"(3) Interface ip Address Interface Status |
IP Interface Status for VRF "test"(3) interface IP Address Interface Status |
本部分提供的信息可用于对配置进行故障排除。
Leaf-2(config-if)# show vpc bri vPC status ---------------------------------------------------------------------------- Please check "show vpc consistency-parameters vpc <vpc-num>" for the consistency reason of down vpc and for type-2 consistency reasons for |
Leaf-3(config-if)# show vpc bri Virtual-peerlink mode : Disabled vPC status ---------------------------------------------------------------------------- Please check "show vpc consistency-parameters vpc <vpc-num>" for the consistency reason of down vpc and for type-2 consistency reasons for |
Leaf-2
Leaf-2(config-vpc-domain)# show run vpc
feature vpc
vpc domain 1
peer-switch
peer-keepalive destination 10.201.182.26
virtual peer-link destination 10.1.1.3 source 10.1.1.4 dscp 56
peer-gateway
ip arp synchronize
interface port-channel10
vpc peer-link
interface Ethernet1/46
mtu 9216
port-type fabric
ip address 192.168.2.1/24
ip ospf network point-to-point
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
no shutdown
Leaf-3
Leaf-3(config-vpc-domain)# show run vpc
feature vpc
vpc domain 1
peer-switch
peer-keepalive destination 10.201.182.25
virtual peer-link destination 10.1.1.4 source 10.1.1.3 dscp 56
peer-gateway
ip arp synchronize
interface port-channel10
vpc peer-link
interface Ethernet1/47
mtu 9216
port-type fabric
ip address 192.168.1.1/24
ip ospf network point-to-point
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
no shutdown
使用本部分可确认配置能否正常运行。
show vpc brief
show vpc role
show vpc virtual-peerlink vlan consistency
show vpc fabric-ports
show vpc consistency-para global
show nve interface nve 1 detail
Leaf-2
Leaf-2(config-if-range)# show run vpc
feature vpc
vpc domain 1
peer-switch
peer-keepalive destination 10.201.182.26 source 10.201.182.25
peer-gateway
ip arp synchronize
interface port-channel10
vpc peer-link
interface port-channel20
vpc 20
interface port-channel40
vpc 40
Leaf-3
Leaf-3(config-if-range)# show run vpc
feature vpc
vpc domain 1
peer-switch
peer-keepalive destination 10.201.182.25 source 10.201.182.26
peer-gateway
ip arp synchronize
interface port-channel10
vpc peer-link
interface port-channel20
vpc 20
interface port-channel40
vpc 40
Leaf-4
Leaf-4(config-if)# show run vpc
feature vpc
vpc domain 2
peer-switch
peer-keepalive destination 10.201.182.29 source 10.201.182.28
peer-gateway
interface port-channel10
vpc peer-link
interface port-channel20
vpc 20
interface port-channel40
vpc 40
Leaf-5
Leaf-5(config-if)# show running-config vpc
feature vpc
vpc domain 2
peer-switch
peer-keepalive destination 10.201.182.28 source 10.201.182.29
peer-gateway
interface port-channel10
vpc peer-link
interface port-channel20
vpc 20
interface port-channel40
vpc 40
在双面vPC中,两台Nexus 9000交换机都运行vPC。Nexus 9000 交换机的每个 vPC 对都连接到具有唯一 vPC 的汇聚 vPC 对。
Leaf-2
Leaf-2(config-if-range)# show run vpc
feature vpc
vpc domain 1
peer-switch
peer-keepalive destination 10.201.182.26
virtual peer-link destination 10.1.1.3 source 10.1.1.4 dscp 56
peer-gateway
ip arp synchronize
interface port-channel10
vpc peer-link
interface port-channel20
vpc 20
interface port-channel40
vpc 40
Leaf-3
Leaf-3(config-if-range)# show run vpc
feature vpc
vpc domain 1
peer-switch
peer-keepalive destination 10.201.182.25
virtual peer-link destination 10.1.1.4 source 10.1.1.3 dscp 56
peer-gateway
ip arp synchronize
interface port-channel10
vpc peer-link
interface port-channel20
vpc 20
interface port-channel40
vpc 40
Leaf-4 and Leaf-5 configuration is similar as double-sided vPC.
本部分提供了可用于对配置进行故障排除的信息。
Leaf-4(config-if)# show spanning-tree VLAN0010 Spanning tree enabled protocol rstp Root ID Priority 32778 Address 0023.04ee.be01 Cost 5 Port 4105 (port-channel10) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32778 (priority 32768 sys-id-ext 10) Address 0023.04ee.be02 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Interface Role Sts Cost Prio.Nbr Type ---------------- ---- --- --------- -------- -------------------------------- Po10 Root FWD 4 128.4105 (vPC peer-link) Network P2p Po20 Desg FWD 1 128.4115 (vPC) P2p Po40 Root FWD 1 128.4135 (vPC) P2p VLAN0020 Spanning tree enabled protocol rstp Root ID Priority 32788 Address 0023.04ee.be02 This bridge is the root Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32788 (priority 32768 sys-id-ext 20) Address 0023.04ee.be02 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Interface Role Sts Cost Prio.Nbr Type ---------------- ---- --- --------- -------- -------------------------------- Po10 Root FWD 4 128.4105 (vPC peer-link) Network P2p Po20 Desg FWD 1 128.4115 (vPC) P2p Po40 Desg FWD 1 128.4135 (vPC) P2p |
Leaf-5(config-if)# show spanning-tree VLAN0010 Spanning tree enabled protocol rstp Root ID Priority 32778 Address 0023.04ee.be01 Cost 1 Port 4135 (port-channel40) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32778 (priority 32768 sys-id-ext 10) Address 0023.04ee.be02 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Interface Role Sts Cost Prio.Nbr Type ---------------- ---- --- --------- -------- -------------------------------- Po10 Desg FWD 4 128.4105 (vPC peer-link) Network P2p Po20 Desg FWD 1 128.4115 (vPC) P2p Po40 Root FWD 1 128.4135 (vPC) P2p VLAN0020 Spanning tree enabled protocol rstp Root ID Priority 32788 Address 0023.04ee.be02 This bridge is the root Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32788 (priority 32768 sys-id-ext 20) Address 0023.04ee.be02 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Interface Role Sts Cost Prio.Nbr Type ---------------- ---- --- --------- -------- -------------------------------- Po10 Desg FWD 4 128.4105 (vPC peer-link) Network P2p Po20 Desg FWD 1 128.4115 (vPC) P2p Po40 Desg FWD 1 128.4135 (vPC) P2p Leaf-5(config-if)# |
Leaf-2(config-if-range)# show spanning-tree VLAN0001 Spanning tree enabled protocol rstp Root ID Priority 32769 Address 0023.04ee.be01 Cost 0 Port 0 () Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32769 (priority 32768 sys-id-ext 1) Address 003a.9c28.2cc7 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Interface Role Sts Cost Prio.Nbr Type ---------------- ---- --- --------- -------- -------------------------------- Eth1/47 Desg FWD 4 128.185 P2p VLAN0010 Spanning tree enabled protocol rstp Root ID Priority 32778 Address 0023.04ee.be01 This bridge is the root Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32778 (priority 32768 sys-id-ext 10) Address 0023.04ee.be01 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Interface Role Sts Cost Prio.Nbr Type ---------------- ---- --- --------- -------- -------------------------------- Po10 Desg FWD 4 128.4105 (vPC peer-link) Network P2p Po40 Desg FWD 1 128.4135 (vPC) P2p Eth1/47 Desg FWD 4 128.185 P2p Leaf-2(config-if-range)# |
Leaf-3(config-if-range)# show spanning-tree VLAN0010 Spanning tree enabled protocol rstp Root ID Priority 32778 Address 0023.04ee.be01 This bridge is the root Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32778 (priority 32768 sys-id-ext 10) Address 0023.04ee.be01 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Interface Role Sts Cost Prio.Nbr Type ---------------- ---- --- --------- -------- -------------------------------- Po10 Root FWD 4 128.4105 (vPC peer-link) Network P2p Po40 Desg FWD 1 128.4135 (vPC) P2p Leaf-3(config-if-range)# |
本节介绍无中断软件升级的最佳实践,在配置vPC域时使用思科ISSU。vPC系统NX-OS升级(或降级)vPC功能与思科ISSU完全兼容。
在 vPC 环境中,建议使用 ISSU 对系统进行升级。vPC 系统可以在不中断流量的情况下独立升级。升级为序列化操作,一次只能运行一个升级操作。ISSU 期间的配置锁定可防止两台 vPC 对等设备同步升级(启动 ISSU 时,在另一台 vPC 对等设备上会自动锁定配置)。要执行 ISSU 操作,只需 1 个旋钮。
注意:采用 FEX 的 vPC(主机 vPC)也完全支持 ISSU。当升级的vPC域具有FEX时,数据包丢失为零。通过标准端口通道双连接到两个不同FEX的服务器不知道升级操作发生在网络中。
switch#install all nxos bootflash:
vPC 对等设备 1 (9K1)(首先在主 vPC 对等设备还是辅助 vPC 对等设备上加载代码无关紧要)使用 ISSU。请注意,另一台 vPC 对等设备 (9K2) 已锁定其配置,以防止对交换机进行任何操作。
注意:从7.x升级到9.3.8/9.3.9导致vPC上的40g端口关闭。如果对等链路使用40 G连接,建议将两台交换机都升级至9.3.8/9.3.9以启用40G或需要遵循的路径:I7(7)- 9.3(1)- 9.3(9)。
show version
show module
show spanning-tree summary
show vlan summary
show ip interface brief
show port-channel summary
show vpc
show vpc brief
show vpc role
show vpc peer-keepalives
show vpc statistics peer-keepalive
show vpc consistency-parameters global
show vpc consistency-parameters interface port-channel<>
show vpc consistency-parameters vlans
show run vpc all
show hsrp brief
show hsrp
show run hsrp
show hsrp interface vlan
Show vrrp
Show vrrp brief
Show vrrp interface vlan
Show run vrrp
确保通过冗余交换机上的共享命令将流量转移到冗余交换机。
show vpc
show vpc statistics
show ip route vrf all summary
show ip mroute vrf all summary
show ip interface brief
show interface status
show port-channel summary
show hsrp brief
Show vrrp brief
确保替换设备已设置正确的映像和许可证。
show version
show module
show diagnostic results module all detail
show license
show license usage
show system internal mts buffer summary|detail
show logging logfile
show logging nvram
如果启用了自动恢复,请在更换期间将其禁用。
Leaf-2(config)# vpc domain 1
Leaf-2(config-vpc-domain)# no auto-recovery
Leaf-2(config-if)# show vpc bri
Legend:
(*) - local vPC is down, forwarding via vPC peer-link
vPC domain id : 1
Peer status : peer adjacency formed ok
vPC keep-alive status : peer is alive
Configuration consistency status : success
Per-vlan consistency status : success
Type-2 consistency status : success
vPC role : primary
Number of vPCs configured : 1
Peer Gateway : Enabled
Dual-active excluded VLANs : - Graceful Consistency Check : Enabled
Auto-recovery status : Disabled
Delay-restore status : Timer is off. (timeout = 30s)
Delay-restore SVI status : Timer is off (timeout = 10s)
Delay-restore Orphan-port status : Timer is off.(timeout = 0s)
Operational Layer3 Peer-router : Disabled
Virtual-peerlink mode : Disabled
确保粘滞位设置为 False。
Leaf-5(config-vpc-domain)# show sys internal vpcm info all | i i stick
OOB Peer Version: 2 OOB peer was alive: TRUE Sticky Master: FALSE
show version
show module
show diagnostics result module all detail
show environment
show license usage
show interface status
show ip interface brief
show interface status err-disabled
show cdp neighbors
show redundancy status
show spanning-tree summary
show port-channel summary
show vpc
show vpc brief
show vpc role
show vpc peer-keepalives
show vpc statistics peer-keepalive
show vpc consistency-parameters global
show vpc consistency-parameters interface port-channel1
show vpc consistency-parameters vlans
show hsrp brief
show vrrp brief
在 vPC VXLAN 上,如果 SVI 的数量增加,建议在 vPC 配置下增加 delay restore interface-vlan(延迟恢复接口 VLAN)计时器。例如,如果有1000个VNI和1000个SVI,建议将延迟恢复接口vlan计时器增加到45秒。
switch(config-vpc-domain)# delay restore interface-vlan 45
Leaf-2(config-if-range)# show nve interface nve 1 detail
Interface: nve1, State: Up, encapsulation: VXLAN
VPC Capability: VPC-VIP-Only [notified]
Local Router MAC: 003a.9c28.2cc7
Host Learning Mode: Control-Plane
Source-Interface: loopback1 (primary: 10.1.1.41.1.4, secondary: 10.1.1.10)
Source Interface State: Up
Virtual RMAC Advertisement: Yes
NVE Flags:
Interface Handle: 0x49000001
Source Interface hold-down-time: 180
Source Interface hold-up-time: 30
Remaining hold-down time: 0 seconds
Virtual Router MAC: 0200.1401.010a
Interface state: nve-intf-add-complete
Fabric convergence time: 135 seconds
Fabric convergence time left: 0 seconds
vPC 对等交换机功能允许一对 vPC 对等设备在第 2 层拓扑中显示为单个生成树协议根(它们具有相同的网桥 ID)。 两台 vPC 对等设备上必须配置 vPC 对等交换机,才能正常运行。命令如下:
N9K(config-vpc-domain)# peer-switch
利用 vPC 对等网关,vPC 对等设备可以充当发往另一台对等设备路由器 MAC 的数据包的活动网关。它持续将本地流量转发到 vPC 对等设备,并避免使用对等链路。激活对等网关功能不会对流量和功能产生影响。
N9k-1(config)# vpc domain 1
N9k-1(config-vpc-domain)# peer-gateway
引入了 Layer3 peer-router 命令,可用于在 vPC 上启用路由。
N9k-1(config)# vpc domain 1
N9k-1(config-vpc-domain)# layer3 peer-router
N9K-1(config-vpc-domain)# exit
N9K-1# sh vpc
Legend:(*)
- local vPC is down, forwarding via vPC peer-link
vPC domain id : 100
Peer status : peer adjacency formed ok
vPC keep-alive status : peer is alive
Configuration consistency status : success
Per-vlan consistency status : success
Type-2 consistency status : success
vPC role : secondary, operational primary
Number of vPCs configured : 2
Peer Gateway : Enabled
Peer gateway excluded VLANs : -
Peer gateway excluded bridge-domains : -
Dual-active excluded VLANs and BDs : -
Graceful Consistency Check : Enabled
Auto-recovery status : Enabled (timeout = 240 seconds)
Operational Layer3 Peer-router : Enabled
版本 | 发布日期 | 备注 |
---|---|---|
2.0 |
06-Dec-2023 |
添加了Alt文本。
已更新样式要求、参与者列表和格式。 |
1.0 |
19-Oct-2022 |
初始版本 |