Cisco VPC学习笔记.docx

VPC学习笔记（包含配置）_vpc话题：vpcVirtual Port Channels用途：扩展port-channel，将连接不同设备链路汇聚成一条逻辑的链路。（个人理解）支持设备：N5K、N7K、N2K优势：设备级别冗余，收敛速度比STP快（无STP） 去除了STP BLOCK端口，提供无环路网络 更好的带宽利用（线路能负载均衡）注意：VPC只能用于二层，VPC端口不能运行路由协议。实现方式：将2个nexus设备关联到VPCdomain。两台设备通过2条特殊链路实现信息交换：vPC peer-keepalive link：心跳链路，确保两台VPC设备在线。避险A/A或者split-brain情况导致VPC拓扑环路。VPC端口可以是1G或者10G端口vPC peer link：VPC邻居之间交换状态信息，提供而外的机制发现和防止split-brain情况split-brain是什么？关于peer-keepalive端口MGT可以作为vPC peer-keepalive link接口。在N7K上如果引擎切换或者在线服务升级（ISSU）管理端口会改变，导致keepalive中断。 如果使用MGT口，保证所有MGT口接入到网管交换机。 可以使用数据接口的port-channel接口提高更高级别的冗余。配置：1、开启VPC特性Congo(config)# feature vpcEgypt(config)# feature vpc2、创建用于VPC的VRF创建VRFCongo(config-if)# vrf context vpc-keepaliveEgypt(config)# vrf context vpc-keepalive3、创建VPC keeplive链路Congo(config)# int ethernet 2/47Congo(config-if)#no switchportCongo(config-if)# vrf member vpc-keepaliveCongo(config-if)# ip address 1.1.1.1 255.255.255.252Egypt(config)# interface ethernet 2/48Egypt(config-if)# no switchportEgypt(config-if)# vrf member vpc-keepaliveEgypt(config-if)# ip address 1.1.1.2 255.255.255.252测试连通性：Congo# ping 1.1.1.2 vrf vpc-keepalive查看：Congo# sho vpcLegend:(*) - local vPC is down, forwarding via vPC peer-linkvPCdomainid : 1Peer status : peer link not configuredvPC keep-alive status : peer is aliveConfiguration consistencystatus: failedConfiguration consistency reason: vPC peer-link does not existsvPC role : none establishedNumber of vPCs configured : 0Peer Gateway : DisabledDual-active excluded VLANs : -可以看到keepalive已经OK,但vpc peer没有起来4、建立VPC-domainCongo(config)# vpc domain 1Congo(config-vpc-domain)# peer-keepalive destination 1.1.1.2 source1.1.1.1 vrf vpc-keepaliveEgypt(config)# vpc domain 1Egypt(config-vpc-domain)# peer-keepalive destination 1.1.1.1 source1.1.1.2 vrf vpc-keepalive5、配置VPC peer链路(NEXUS交换机互联）必须使用10G端口，并且指定速率。配置port-channel 100(省略）Congo(config)# interface port-channel 100Congo(config)#switchport mode trunkCongo(config)# interface port-channel 100Congo(config-if)# vpc peer-linkEgypt(config)# interface port-channel 100Egypt(config)#switchport mode trunkEgypt(config)# interface port-channel 100Egypt(config-if)# vpc peer-link配置后STP端口类型从network变为vPC peer-，STPBridge Assurance将会开启，并且不能被关闭。验证：Egypt# show vpcLegend:(*) - local vPC is down, forwarding via vPC peer-linkvPCdomainid : 1Peerstatus: peer adjacency formed okvPC keep-alive status : peer is aliveConfiguration consistency status: successvPC role : secondaryNumber of vPCs configured : 0Peer Gateway : DisabledDual-active excluded VLANs : -vPC Peer-link status-id Port Status Active vlans- - - -1 Po100 up 1-20,100如果Configuration consistencystatus状态为any，可以通过下面命令检查具体不一致的信息Congo# show vpc consistency-parameters globalLegend:Type 1 : vPC will be suspended in case of mismatchName Type Local Value Peer Value- - - -STP Mode 1 Rapid-PVST Rapid-PVSTSTP Disabled 1 VLANs 91 VLANs 91STP MST Region Name 1 customer customerSTP MST Region Revision 1 1 1STP MST Region Instance to 1VLAN MappingSTP Loopguard 1 Disabled DisabledSTP Bridge Assurance 1 Enabled EnabledSTP Port Type, Edge 1 Normal, Disabled, Normal,Disabled,BPDUFilter, Edge BPDUGuard Disabled DisabledSTP MST Simulate PVST 1 Enabled EnabledInterface-vlan admin up 2 40-43,50,60,70-71,91,1 40-43,50,60,70-71,91,100-103 00-103Allowed VLANs - 40-43,50,60,91,100-103 9,40-43,50,60,91,100-1,1000 03,1000Local suspended VLANs - - -6、将port-channel加入VPC（连接下行端口）Congo(config)# interface ethernet 2/1Congo(config-if)# channel-group 1 mode activeCongo(config)# interface port-channel 1Congo(config-if)# switchportCongo(config-if)# switchport mode trunkCongo(config-if)# vpc 1Egypt(config)# int ethernet 2/2Egypt(config-if)# channel-group 1 mode activeEgypt(config)# int port-channel 1Egypt(config-if)# switchportEgypt(config-if)# switchport mode trunkEgypt(config-if)# vpc 1下行交换机配置（不支持VPC设备）配置为普通ether-channelKenya(config)# interface ethernet 2/11-12Kenya(config-if-range)# switchportKenya(config-if-range)# channel-group 1 mode activeKenya(config-if-range)# no shutdownKenya(config)# int port-channel 1Kenya(config-if)# switchportKenya(config-if)# switchport mode trunk验证VPCCongo# show vpcLegend:(*) - local vPC is down, forwarding via vPC peer-linkvPCdomainid : 1Peer status : peer adjacency formed okvPC keep-alive status : peer is aliveConfiguration consistency status: successvPC role : primaryNumber of vPCs configured : 1Peer Gateway : DisabledDual-active excluded VLANs : -vPC Peer-link status-id Port Status Active vlans- - - -1 Po100 up 1-20,100vPCstatus-id Port Status Consistency Reason Active vlans- - - - - -1 Po1 up success success 1-20,1007、配置VPC Peer-Gateway（可选）Peer-Gateway用于fast-pathfunctionality。（存储，应用服务器）节点发送返回流量到发送方的一个特殊的mac地址而不是hsrp mac地址（由于VPC防环机制，默认情况这种流量会被丢弃-不允许将VPC peer link收到的流量发送到VPC端口-VPC防环机制）VPC Peer-Gateway使VPC对端（peer）设备转发目的MAC地址为对端路由器的本地mac地址的流量配置：Congo(config-vpc