-
Cisco MDS 9000 Family Configuration Guide, Release 2.x
-
New and Changed Information
-
Index
-
Preface
- Part 1 - Getting Started
- Part 2 - Cisco MDS SAN-OS Installation and Switch Management
- Part 3 - Switch Configuration
-
Part 4 - Fabric Configuration
-
Configuring and Managing VSANs
-
Creating Dynamic VSANs
-
Configuring Inter-VSAN Routing
-
Configuring Zones
-
Distributing Device Alias Services
-
Configuring Fibre Channel Routing Services and Protocols
-
Managing FLOGI, Name Server, FDMI, and RSCN Databases
-
Discovering SCSI Targets
-
Configuring FICON
-
Advanced Features and Concepts
-
- Part 5 - Security
- Part 6 - IP Services
- Part 7 - Intelligent Storage Services
- Part 8 - Network and Switch Monitoring
- Part 9 - Traffic Management
- Part 10 - Troubleshooting
-
Feedback
Table Of Contents
Management Interface Configuration
Configuring an IP Address in a VSAN
Displaying IP Interface Information
The Virtual Router Redundancy Protocol
Virtual Router Addition and Deletion
Virtual Router IP Address Addition
Priority for the Virtual Router
Time Interval for Advertisement Packets
Priority Based on Interface State
Displaying DNS Host Information
Configuring IP Services
Cisco MDS 9000 Family switches can route IP traffic between Ethernet and Fibre Channel interfaces. The IP static routing feature is used to route traffic between VSANs. To do so, each VSAN must be in a different IP subnetwork. Each Cisco MDS 9000 Family switch provides the following services for network management systems (NMS):
•
IP forwarding on the out-of-band Ethernet interface (mgmt0) on the front panel of the supervisor modules.
•
•
Switches are compliant with RFC 2338 standards for Virtual Router Redundancy Protocol (VRRP) features. VRRP is a restartable application that provides a redundant, alternate path to the gateway switch.
This chapter includes the following sections:
•
•
•
•
•
Traffic Management Services
In-band options are compliant with and use the RFC 2625 standards. An NMS host running IP protocol over a FC interface can access the switch using the IPFC functionality. If the NMS does not have a Fibre Channel HBA, in-band management can still be performed using one of the switches as an access point to the fabric (see Figure 36-1).
Figure 36-1 Management Access to Switches
Management Interface Configuration
On director class switches, a single IP address is used to manage the switch. The active supervisor module's management (mgmt0) interface uses this IP address. The mgmt0 interface on the standby supervisor module remains in an inactive state and cannot be accessed until a switchover happens. After a switchover, the mgmt0 interface on the standby supervisor module becomes active and assumes the same IP address as the previously-active supervisor module.
The management interface on the switch allows multiple simultaneous Telnet or SNMP sessions. You can remotely configure the switch through the management interface, but first you must configure some IP parameters (IP address, subnet mask) so that the switch is reachable. You can manually configure the management interface from the CLI.
Note
Note
To configure the mgmt0 Ethernet interface, follow these steps:
Default Gateway Configuration
The default gateway IP address should be configured along with the IP static routing commands (IP default network, destination prefix, and destination mask, and next hop address).
Tip
See the "Initial Setup Routine" section on page 4-2 for more information on configuring the IP addresses for all entries in the switch.
Use the IP default-gateway command to configure the IP address for a switch's default gateway and the show ip route command to verify that the IP address for the default gateway is configured.
To configure default gateways, follow these steps:
Step 1
switch# config t
Enters configuration mode.
Step 2
switch(config)# ip default-gateway 1.12.11.1
Configures the IP address for the default gateway.
Default Network Configuration
If you assign the IP default network address, the switch considers routes to that network as the last resort. If the IP default network address is not available, the switch uses the IP default gateway address. For every network configured with the IP default network address, the switch flags that route as a candidate default route, if the route is available.
Tip
See the "Initial Setup Routine" section on page 4-2 for more information on configuring the IP addresses for all entries in the switch.
When the Ethernet interface is configured, the switch should point to the gateway router for the IP network. The host accesses the gateway using a gateway switch. This gateway switch is configured as the default gateway. The other switches in the fabric that are connected to the same VSAN as the gateway switch can also be connected through the gateway switch. Every interface connected to this VSAN should be configured with the VSAN IP address of the gateway switch (see Figure 36-2).
Figure 36-2 Overlay VSAN Functionality
In Figure 36-2, switch A has the IP address 1.12.11.1, switch B has the IP address 1.12.11.2, switch C has the IP address 1.12.11.3, and switch D has the IP address 1.12.11.4. Switch A is the gateway switch with the Ethernet connection. The NMS uses the IP address 1.1.1.10 to connect to the gateway switch. Frames forwarded to any switch in the overlaid VSAN 1 are routed through the gateway switch. Configuring the gateway switch's IP address, 1.12.11.1, in the other switches enable the gateway switch to forward the frame to the intended destination. Similarly, if a non-gateway switch in the VSAN forwards a frame to the Ethernet world, the frame is routed through the gateway switch.
When forwarding is disabled (default), IP frames are not sent from one interface to another. In these cases, the software performs local IP routing between two switches using the in-band option for Fibre Channel traffic and the mgmt0 option for Ethernet traffic.
When a VSAN is created, a VSAN interface is not created automatically. You need to specifically create the interface (see the "Configuring VSAN Interfaces" section on page 11-22).
Instead of the ip default-gateway command, use the ip default-network command when IP routing is enabled on the switch. Use the show ip route command to verify if the IP address for the default gateway is configured.
To configure default networks, follow these steps:
IPFC Configuration
Once the VSAN interface is created, you can specify the IP address for that VSAN.
Configuring an IP Address in a VSAN
To configure a VSAN interface and an IP address for that interface, follow these steps:
Enabling IP Routing
By default, the IP routing feature is disabled in all switches.
To enable the IP routing feature, follow these steps:
IPFC Configuration Example
This section describe an example configuration for IPFC. Figure 36-3 shows an example network.
The example network has the following links:
•
•
Figure 36-3 IPFC Example Network
The following steps show how to configure Switch_1 in the example network in Figure 36-3:
Step 1
switch_1# config tswitch_1(config)# interface vsan 1switch_1(config-if)#Step 2
switch_1(config-if)# ip address 10.1.1.1 255.0.0.0Step 3
switch_1(config-if)# no shutdownswitch_1(config-if)# exitswitch_1(config)#Step 4
switch_1(config)# ip routingswitch_1(config)# exitswitch_1#Step 5
switch_1# show ip routeCodes: C - connected, S - staticC 172.16.1.0/23 is directly connect, mgmt0C 10.0.0.0./8 is directly connected, vsan1The following steps show how to configure Switch_2 in the example network in Figure 36-3.
Step 1
Note
switch_2# config tswitch_2(config)# interface mgmt 0switch_2(config-if)# no shutdownswitch_2(config-if)# exitswitch_2(config)#Step 2
switch_2# config tswitch_2(config)# interface vsan 1switch_2(config-if)#Step 3
switch_2(config-if)# ip address 10.1.1.2 255.0.0.0Step 4
switch_2(config-if)# no shutdownswitch_2(config-if)# exitswitch_2(config)#Step 5
switch_2(config)# ip routingswitch_2(config)# exitswitch_2#Step 6
switch_2# show ip routeCodes: C - connected, S - staticC 10.0.0.0./8 is directly connected, vsan1Step 7
switch_2# ping 10.1.1.1PING 10.1.1.1 (10.1.1.1) 56(84) bytes of data.64 bytes from 10.1.1.1: icmp_seq=1 ttl=64 time=0.618 ms64 bytes from 10.1.1.1: icmp_seq=2 ttl=64 time=0.528 ms64 bytes from 10.1.1.1: icmp_seq=3 ttl=64 time=0.567 ms--- 10.1.1.1 ping statistics ---3 packets transmitted, 3 received, 0% packet loss, time 4998 msrtt min/avg/max/mdev = 0.528/0.570/0.618/0.057 msThe following steps show how to configure Switch_3 in the example network in Figure 36-3.
Step 1
Note
switch_3# config tswitch_3(config)# interface mgmt 0switch_3(config-if)# no shutdownswitch_3(config-if)# exitswitch_3(config)#switch_3# config tswitch_3(config)# interface vsan 1switch_3(config-if)#Step 2
switch_3(config-if)# ip address 10.1.1.3 255.0.0.0Step 3
switch_3(config-if)# no shutdownswitch_3(config-if)# exitswitch_3(config)#Step 4
switch_3(config)# ip routingswitch_3(config)# exitswitch_3#Step 5
switch_3# show ip routeCodes: C - connected, S - staticC 10.0.0.0./8 is directly connected, vsan1Step 6
switch_3# ping 10.1.1.1PING 10.1.1.1 (10.1.1.1) 56(84) bytes of data.64 bytes from 10.1.1.1: icmp_seq=1 ttl=64 time=1.19 ms64 bytes from 10.1.1.1: icmp_seq=2 ttl=64 time=0.510 ms64 bytes from 10.1.1.1: icmp_seq=3 ttl=64 time=0.653 ms--- 10.1.1.1 ping statistics ---3 packets transmitted, 3 received, 0% packet loss, time 2008 msrtt min/avg/max/mdev = 0.510/0.787/1.199/0.297 ms
Configuring IP Static Routes
Static routing is a mechanism to configure IP routes on the switch. You can configure more than one static route.
If your configuration does not need an external router, you can use static routing.
If a VSAN has multiple exit points, configure static routes to direct traffic to the appropriate gateway switch. IP routing is disabled by default on any gateway switch between the out-of-band management interface and the default VSAN, or between directly connected VSANs.
To configure a static route, follow these steps:
Displaying and Clearing ARPs
Address Resolution Protocol (ARP) entries in Cisco MDS 9000 Family switches can be displayed, deleted, or cleared. The ARP feature is enabled on all switches.
•
switch# show arpProtocol Address Age (min) Hardware Addr Type InterfaceInternet 171.1.1.1 0 0006.5bec.699c ARPA mgmt0Internet 172.2.0.1 4 0000.0c07.ac01 ARPA mgmt0•
switch(config)# no arp 172.2.0.1•
switch# clear arp-cacheDisplaying IP Interface Information
Use the following show commands to view configured IP interface information (see Examples 36-1 to 36-4).
Example 36-1 Displays the VSAN Interface
switch# show interface vsan1vsan1 is up, line protocol is upWWPN is 10:00:00:05:30:00:59:1f, FCID is 0x9c0100Internet address is 10.1.1.1/24MTU 1500 bytes, BW 1000000 Kbit0 packets input, 0 bytes, 0 errors, 0 multicast0 packets output, 0 bytes, 0 errors, 0 dropped
Note
Example 36-2 Displays the Connected and Static Route Details
switch# show ip route Codes: C - connected, S - static Default gateway is 172.22.95.1 C 172.22.95.0/24 is directly connected, mgmt0 C 10.1.1.0/24 is directly connected, vsan1Example 36-3 Displays Configured Routes
switch# show ip route configuredDestination Gateway Mask Metric Interfacedefault 172.22.95.1 0.0.0.0 0 mgmt010.1.1.0 0.0.0.0 255.255.255.0 0 vsan1172.22.95.0 0.0.0.0 255.255.255.0 0 mgmt0Example 36-4 Displays the IP Routing Status
switch# show ip routingip routing is disabledOverlay VSAN Configuration
VSANs enable deployment of larger SANs by overlaying multiple logical SANs, each running its own instance of fabric services, on a single large physical network. This partitioning of fabric services reduces network instability by containing fabric reconfiguration and error conditions within an individual VSAN. VSANs also provide the same isolation between individual VSANs as physically separated SANs. Traffic cannot cross VSAN boundaries and devices may not reside in more than one VSAN. Because each VSAN runs separate instances of fabric services, each VSAN has its own zone server and can be zoned in exactly the same way as SANs without VSAN capability.
To configure an overlay VSAN, follow these steps:
Step 1
Step 2
Step 3
Step 4
Figure 36-4 Overlay VSAN Configuration Example
Note
The following procedure configures an overlay VSAN in one switch. This procedure must be repeated for each switch in the fabric.
To configure an overlay VSAN in one switch (using the example in Figure 36-4), follow these steps:
To configure the NMS station displayed in Figure 36-4, follow this step:
Multiple VSAN Configuration
More than one VSAN can be used to segment the management network in multiple subnets. An active interface must be present on the switch for the VSAN interface to be enabled.
To configure multiple VSANs, follow these steps:
Step 1
Step 2
Step 3
Step 4
Figure 36-5 Multiple VSANs Configuration Example
To configure an overlay VSAN (using the example in Figure 36-5), follow these steps:
The Virtual Router Redundancy Protocol
Cisco MDS 9000 Family switches are compliant with RFC 2338 standards for Virtual Router Redundancy Protocol (VRRP) features. This section provides details on the VRRP feature.
VRRP Features
VRRP provides a redundant alternative path to the gateway switch, which has connectivity to the NMS. VRRP has the following characteristics and advantages:
•
•
•
•
•
•
•
VRRP Functionality
In Figure 36-6, switch A is the VRRP master and switch B is the VRRP backup switch. Both switches have IP address to VRRP mapping configured. The other switches set switch A as the default gateway. If switch A fails, the other switches don't have to change the routing configurations as switch B automatically becomes the master and takes over the function of a gateway.
Figure 36-6 VRRP Functionality
In Figure 36-7, the fabric example has two virtual router groups (VR1 and VR 2) because a virtual router cannot span across different types of interfaces. In both switch 1 and switch 2, the Ethernet interface is in VR 1 and the FC interface is in VR 2. Each virtual router is uniquely identified by the VSAN interface and the VR ID.
Figure 36-7 Redundant Gateway
Virtual Router Addition and Deletion
All VRRP configurations should be replicated across switches in a fabric that runs VRRP.
To create or remove a VR, follow these steps:
Virtual Router Initiation
By default, a virtual router is always disabled. VRRP can be configured only if this state is enabled. Be sure to configure at least one IP address before attempting to enable a VR.
To enable or disable a virtual router, follow these steps:
Step 1
switch(config-if-vrrp)# no shutdown
Enables VRRP configuration.
switch(config-if-vrrp)# shutdown
Disables VRRP configuration.
Virtual Router IP Address Addition
One virtual router IP address can be configured for a virtual router. If the configured IP address is the same as the interface IP address, this switch automatically owns the IP address.
According to the VRRP specification, the master VRRP router drops the packets addressed to the virtual router's IP address because the virtual router is only intended as a next-hop router to forward packets. In MDS switches however, some applications require that packets addressed to virtual router's IP address be accepted and delivered to them. By using the secondary option to the virtual router IP address, the VRRP router will accept these packets when it is the master.
To configure an IP address for a virtual router, follow these steps:
Step 1
switch# config t
Enters configuration mode.
Step 2
switch(config)# interface vsan 1
switch(config-if)#
Configures a VSAN interface (VSAN 1).
Step 3
switch(config-if)# interface ip address 10.0.0.12 255.255.255.0xi
Configures an IP address. The IP address must be configured before the VRRP is added.
Step 4
switch(config-if)# vrrp 250
switch(config-if-vrrp)#
Creates VR ID 250.
Step 5
switch(config-if-vrrp)# address 10.0.0.10
Configures the IP address (10.0.0.10) for the selected VR.
Note
switch(config-if-vrrp)# no address 10.0.0.10
Removes the IP address (10.0.0.10) for the selected VR.
Step 6
switch(config-if-vrrp)# address 10.0.0.10 secondary
Configures the IP address (10.0.0.10) as secondary for the selected VR.
Note
switch(config-if-vrrp)# no address 10.0.0.10 secondary
Removes the IP address (10.0.0.10) as secondary for the selected VR.
Priority for the Virtual Router
The valid range to assign a virtual router priority is 1 to 254 with 1 being the lowest priority and 254 being the highest priority. The default value is 100 for switches with secondary IP addresses and 255 for a switch with the primary IP address.
To set the priority for a virtual router, follow these steps:
Time Interval for Advertisement Packets
The valid time range for an advertisement packet is between 1 and 255 seconds with the default being 1 (one) second. If the switch has the primary IP address, this time must be specified.
To set the priority for a virtual router, follow these steps:
Priority Preemption
You can enable a higher priority backup virtual router to preempt the lower priority master virtual router.
Note
Note
To enable or disable preempting, follow these steps:
Virtual Router Authentication
VRRP security provides three options, including simple text authentication, MD5 authentication, and no authentication.
•
•
•
You can configure the key using the authentication option in the VRRP submode and distribute it using the configuration file. The security parameter index (SPI) settings assigned in this option should be unique for each VSAN.
Note
To set an authentication option for a virtual router, follow these steps:
Priority Based on Interface State
The tracking feature is disabled by default. When you specify the tracking option, the priority of the virtual router is changed based on the state of another interface in the switch. When the tracked interface is down, the priority of the virtual router is changed to a lower priority value. When the tracked interface is up, the priority of the virtual router is restored to its original value. You can track one of two interfaces on a switch in the Cisco MDS 9000 Family: a specified VSAN interface or a management interface.
Note
To track the interface priority for a virtual router, follow these steps:
Displaying VRRP Information
Use the show vrrp vr command to display configured VRRP information (see Examples 36-5 to 36-8).
Example 36-5 Displays VRRP Configured Information
switch# show vrrp vr 7 interface vsan 2 configurationvr id 7 configurationadmin state downpriority 100no authenticationadvertisement-Interval 1preempt yestracking interface vsan1 priority 2protocol IPExample 36-6 Displays VRRP Status Information
switch# show vrrp vr 7 interface vsan 2 statusvr id 7 statusMAC address 00:00:5e:00:01:07Operational state: initExample 36-7 Displays VRRP Statistics
switch# show vrrp vr 7 interface vsan 2 statisticsvr id 7 statisticsBecome master 0Advertisement 0Advertisement Interval Error 0Authentication Failure 0TTL Error 0Priority 0 Received 0Priority 0 Sent 0Invalid Type 0Mismatch Address List 0Invalid Authentication Type 0Mismatch Authentication 0Invalid Packet Length 0Example 36-8 Displays VRRP Cumulative Statistics
switch# show vrrp statisticsInvalid checksum 0Invalid version 0Invalid VR ID 0Clearing VRRP Statistics
Use the clear vrrp command to clear all the software counters for the specified virtual router (see Example 36-9).
Example 36-9 Clears VRRP Information
switch# clear vrrp 7 interface vsan2switch#DNS Server Configuration
The DNS client on the switch communicates with the DNS server to perform the IP address-name server correspondence.
The DNS server may be dropped after two attempts due to one of the following reasons:
•
•
Note
To configure a DNS server, follow these steps:
Displaying DNS Host Information
Use the show hosts command to display the DNS configuration (see Example 36-10).
Example 36-10 Displays Configured Host Details
switch# show hostsDefault domain is cisco.com
Domain list: ucsc.edu harvard.edu yale.edu stanford.edu
Name/address lookup uses domain service
Name servers are 15.1.0.1 15.2.0.0Default Settings
Table 36-1 lists the default settings for FSPF features.
