hacktracking: nexus

Showing posts with label nexus. Show all posts

# vPC on Nexus 2000

Topology

- Double vPC between N7K and N5K.
- Single-homed or dual-homed between N5K and N2K (FEX).

Single-homed

- The 2148 is not capable of doing a standard port-channel.
- The 2148 is capable of doing a vPC of two ports (each one on a different FEX).
- The 2248 is capable of doing a standard port-channel.
- The 2248 is capable of doing a vPC of two or more ports.

Dual-homed

- The 2148 is not capable of doing a standard port-channel.
- The 2148 is not capable of doing a vPC.
- The 2248 is capable of doing a standard port-channel.
- The 2248 is not capable of doing a vPC.

Dual-homed - Enhanced vPC

- Supported from NX-OS 5.1(3)N1(1) and Nexus 5548P, 5548UP or 5596UP devices.
- The 2248 is capable of doing a standard port-channel.
- The 2248 is capable of doing a vPC of two or more ports.

Notes

- The 2148 and 2248 provide 48 x 1Gbps copper ports and 4 x 10 Gbps SFP+ ports.
- The 2148 does not support 10/100 Mbps.
- The 2248 does not support 10 Mbps.

# NetFlow configuration on Catalyst and Nexus switches

Background information

- The NetFlow cache on the Multilayer Switch Feature Card (MSFC) captures statistics for flows routed in software.
- The NetFlow cache on the Policy Feature Card (PFC) captures statistics for flows routed in hardware.
- A flow mask defines the format of a cache entry in the NetFlow cache table.
- You need to configure Netflow Data Export (NDE) to export NetFlow statistics to a NetFlow collector.

Catalyst NetFlow configuration

- MSFC configuration

Catalyst(config)# interface vlan10
Catalyst(config-if)# ip route-cache flow
Catalyst(config)# ip flow-export version 5
Catalyst(config)# ip flow-cache timeout active 5 ! Delete active cache entries after 5 minutes
Catalyst(config)# ip flow-cache timeout inactive 15 ! Delete inactive cache entries after 15 seconds

- PFC configuration

Catalyst(config)# mls netflow
Catalyst(config)# mls flow ip full-interface ! Flow mask on the PFC
Catalyst(config)# mls nde sender version 5
Catalyst(config)# mls aging fast ! Default threshold = 100 packets, and timeout = 32 seconds
Catalyst(config)# mls aging long 300 ! Delete active cache entries after 5 minutes
Catalyst(config)# mls aging normal 15 ! Delete inactive cache entries after 15 seconds

- Common configuration

Catalyst(config)# snmp-server ifindex persist
Catalyst(config)# ip flow-export source loopback0
Catalyst(config)# ip flow-export destination 10.0.0.1 9995

- Checks

Catalyst# show ip flow export
Catalyst# show ip cache flow
Catalyst# show mls nde
Catalyst# show snmp mib ifmib ifindex

Nexus NetFlow configuration

- Configuration

Nexus(config)# feature netflow
Nexus(config)# flow exporter collector
Nexus(config-flow-exporter)# description export netflow to collector
Nexus(config-flow-exporter)# destination 10.0.0.1
Nexus(config-flow-exporter)# version 5
Nexus(config-flow-exporter)# source loopback0
Nexus(config-flow-exporter)# transport udp 9995
Nexus(config)# flow monitor monitor_nexus
Nexus(config-flow-monitor)# exporter collector
Nexus(config-flow-monitor)# record netflow-original
Nexus(config)# int vlan10
Nexus(config-if)# ip flow monitor monitor_nexus input
Nexus(config)# flow timeout active 300
Nexus(config)# flow timeout inactive 15

- Checks

Nexus# show flow monitor monitor_nexus
Nexus# show flow exporter collector
Nexus# show flow record netflow-original
Nexus# show hardware flow ip
Nexus# show interface snmp-ifindex

# Nexus 5000 upgrade and downgrade procedure

Topology (Dual-Homed)

[N5k1]---PK---[N5k2]
[N5k1]---PL---[N5k2]
[N5k1]---vPC1---[N2k-fex101]
[N5k1]---vPC2---[N2k-fex102]
[N5k1]---vPC3---[N2k-fex103]
[N5k2]---vPC1---[N2k-fex101]
[N5k2]---vPC2---[N2k-fex102]
[N5k2]---vPC3---[N2k-fex103]

Determining the upgrade impact

If you are upgrading from a NX-OS release 4.2.(1)N1(1) or later releases, you are able to do an ISSU (In-Service Software Upgrade).
If the following commands pass the test, you can do a non-disruptive upgrade (ISSU), if not, you will have a disruptive upgrade:

N5k# show incompatibility system bootflash:n5000.bin
N5k# show install all impact kickstart bootflash:n5000-kickstart.bin system bootflash:n5000.bin
N5k# show spanning-tree issu-impact
N5k# show lacp issu-impact

Disruptive upgrade

1. Verify the required space to upload the kickstart and system images in the primary and secondary switches (N5k):

N5k1# dir bootflash:
N5k2# dir bootflash:

2. If necessary, delete unneeded files to make space available.
3. Copy the new kickstart and system images to the switches bootflash.
4. Display the impact of the upgrade:

N5k1# show install all impact kickstart bootflash:n5000-kickstart.bin system bootflash:n5000.bin
N5k2# show install all impact kickstart bootflash:n5000-kickstart.bin system bootflash:n5000.bin

5. Upgrade the primary switch:

N5k1# install all kickstart bootflash:n5000-kickstart.bin system bootflash:n5000.bin

6. After the primary switch has been reloaded, change the boot variables on the secondary switch and save the configuration:

N5k2(config)# boot system bootflash:n5000.bin
N5k2(config)# boot kickstart bootflash:n5000-kickstart.bin
N5k2# copy running-configuration startup-configuration

7. Once done, reload from the secondary switch each FEX sequencially, one after the other:

N5k2# reload fex 101
N5k2# reload fex 102
N5k2# reload fex 103

8. Finally, reload the secondary switch without saving the current configuration:

N5k2# reload

NonDisruptive upgrade

1. Verify the required space to upload the kickstart and system images in the primary and secondary switches (N5k):

N5k1# dir bootflash:
N5k2# dir bootflash:

2. If necessary, delete unneeded files to make space available.
3. Copy the new kickstart and system images to the switches bootflash.
4. Display the impact of the upgrade:

N5k1# show install all impact kickstart bootflash:n5000-kickstart.bin system bootflash:n5000.bin
N5k2# show install all impact kickstart bootflash:n5000-kickstart.bin system bootflash:n5000.bin

5. Upgrade the primary switch:

N5k1# install all kickstart bootflash:n5000-kickstart.bin system bootflash:n5000.bin

6. After the primary switch has been reloaded, all FEX begin a rolling upgrade (automatic).
7. Once done, upgrade the secondary switch:

N5k2# install all kickstart bootflash:n5000-kickstart.bin system bootflash:n5000.bin

Downgrade

1. Verify the required space to upload the kickstart-old and system-old images in the switch (N5k):

N5k# dir bootflash:

2. If necessary, delete unneeded files to make space available.
3. Copy the kickstart-old and system-old images to the switch bootflash.
4. Display the impact of the upgrade:

N5k# show install all impact kickstart bootflash:n5000-kickstart-old.bin system bootflash:n5000-old.bin

5. Downgrade the switch:

N5k# install all kickstart bootflash:n5000-kickstart-old.bin system bootflash:n5000-old.bin

Notes

- An ISSU is a nondisruptive upgrade. The control plane is reloaded, but the data plane does not stop forwarding packets.
- The kickstart.bin contains the kickstart image.
- The system.bin contains the image, bios and fex images.

# vPC failure scenarios

Topology

[ N7K1 ]--- PK ---[ N7K2 ]
[ N7K1 ]--- PL ---[ N7K2 ]

[ N7K1 ]--- vPC ---[ N5K ]
[ N7K2 ]--- vPC ---[ N5K ]

Peer-Link goes down

[ N7K1 ]

- Peer-Link up --> down
- Peer-Keepalive up
- vPC up
- Role: primary

[ N7K2 ]

- Peer-Link up --> down
- Peer-Keepalive up
- vPC up ------> down (suspend)
- Role: secondary

Peer-Link is down and Peer-Keepalive goes down as well (dual active)

[ N7K1 ]

- Peer-Link down
- Peer-Keepalive up --> down
- vPC up
- Role: primary

[ N7K2 ]

- Peer-Link down
- Peer-Keepalive up --> down
- vPC down ------> up (if auto-recovery enabled)
- Role: secondary ------> primary (if auto-recovery enabled)

Peer-Keepalive goes down

[ N7K1 ]

- Peer-Link up
- Peer-Keepalive up --> down
- vPC up
- Role: primary

[ N7K2 ]

- Peer-Link up
- Peer-Keepalive up --> down
- vPC up
- Role: secondary

Peer-Keepalive is down and Peer-Link goes down as well (dual-active)

[ N7K1 ]

- Peer-Link up --> down
- Peer-Keepalive down
- vPC up
- Role: primary

[ N7K2 ]

- Peer-Link up --> down
- Peer-Keepalive down
- vPC up
- Role: secondary ------> primary (if auto-recovery enabled)

Peer-Link and Peer-Keepalive go down at the same time (dual-active)

[ N7K1 ]

- Peer-Link up --> down
- Peer-Keepalive up --> down
- vPC up
- Role: primary

[ N7K2 ]

- Peer-Link up --> down
- Peer-Keepalive up --> down
- vPC up
- Role: secondary ------> primary (if auto-recovery enabled)

All tracked objects go down on primary

[ N7K1 ]

- Peer-Link up --> down
- Peer-Keepalive up
- vPC up --> down
- Role: primary ------> secondary

[ N7K2 ]

- Peer-Link up --> down
- Peer-Keepalive up
- vPC up
- Role: secondary ------> primary

All tracked objects go down on primary and Peer-Keepalive goes down at the same time

[ N7K1 ]

- Peer-Link up --> down
- Peer-Keepalive up --> down
- vPC up --> down
- Role: primary

[ N7K2 ]

- Peer-Link up --> down
- Peer-Keepalive up --> down
- vPC up
- Role: secondary ------> primary (if auto-recovery enabled)

Primary has power failure and is shut down

[ N7K2 ]

- Peer-Link up --> down
- Peer-Keepalive up --> down
- vPC up
- Role: secondary ------> primary (if auto-recovery enabled)

# Cisco Nexus

Some Commands

- Hardware

NX-7K-1# show inventory ! display chassis components
NX-7K-1# show redundancy status ! determine active supervisor
NX-7K-1# show module ! display individual modules
NX-7K-1# show environment ! display clock, fan, temperature, power
NX-7K-1(config)# power redundancy-mode ?

- System utilization

NX-7K-1# show system resources

- Piping

NX-7K-1# show run | ? ! last, tail, egrep, no-more, ...

- Running config

NX-7K-1# show running-config ?
NX-7K-1# show running-config all ! display configuration with defaults

- Interface ranges

NX-7K-1(config)# int e2/4, e3/1-2 ! no range command

- Shared or dedicated

NX-7K-1(config)# int e2/1, e2/3, e2/5, e2/7
NX-7K-1(config-if)# shutdown
NX-7K-1(config)# int e2/1
NX-7K-1(config-if)# rate-mode dedicated
NX-7K-1(config-if)# no shutdown

- Licencing

NX-7K-1# show license host-id
NX-7K-1# install license bootflash: NX7K-1234.lic
NX-7K-1# show license usage

- Modules

NX-7K-1# reload module ?
NX-7K-1# attach module ?

Virtual Device Context (VDC)

Four VDCs: Default VDC1 and 3 additional VDCs.

NX-7K-1(config)# vdc VDC2 id 2
NX-7K-1(config-vdc)# allocate interface e3/1-24
NX-7K-1(config)# vdc VDC3 id 3
NX-7K-1(config-vdc)# allocate interface e3/25-48
NX-7K-1# show vdc
NX-7K-1# show vdc membership
NX-7K-1# show run vdc
NX-7K-1# switchto vdc VDC2
NX-7K-1-VDC2# switchback
NX-7K-1#

Virtual Port Channel (VPC)

NX-7K-1(config)# feature vpc
NX-7K-1(config)# vpc domain 10
NX-7K-1(config-domain)# peer-switch
NX-7K-1(config-domain)# peer-keepalive destination 10.10.10.2
NX-7K-1# show vpc role
NX-7K-1# show vpc peer-keepalive
NX-7K-1(config)# interface port-channel 10
NX-7K-1(config-if)# switchport mode trunk
NX-7K-1(config-if)# switchport trunk allowed vlan 100-105 ! vPC VLANs
NX-7K-1(config-if)# switchport trunk native 100
NX-7K-1(config-if)# vpc peer-link
NX-7K-1# show vpc brief
NX-7K-1(config)# interface ethernet 1/1-2
NX-7K-1(config-if-range)# channel-group 11 mode active
NX-7K-1(config)# interface port-channel 11
NX-7K-1(config-if)# switchport mode trunk
NX-7K-1(config-if)# vpc 11
NX-7K-2(config)# feature vpc
NX-7K-2(config)# vpc domain 10
NX-7K-2(config-domain)# peer-switch
NX-7K-2(config-domain)# peer-keepalive destination 10.10.10.1
NX-7K-2(config)# interface port-channel 10
NX-7K-2(config-if)# switchport mode trunk
NX-7K-2(config-if)# switchport trunk allowed vlan 100-105 ! vPC VLANs
NX-7K-2(config-if)# switchport trunk native 100
NX-7K-2(config-if)# vpc peer-link
NX-7K-2(config)# interface ethernet 2/7-8
NX-7K-2(config-if-range)# channel-group 11 mode active
NX-7K-2(config)# interface port-channel 11
NX-7K-2(config-if)# switchport mode trunk
NX-7K-2(config-if)# vpc 11
NX-7K-2# show vpc consistency-parameters global

Fabric EXtenders (FEX) ~ Nexus 2000 series

Deployment models:

- Static pinning (Nexus 5000 series)

NX-5K-1(config)# feature fex
NX-5K-1(config)# fex 100
NX-5K-1(config-fex)# pinning max-links 4
NX-5K-1(config)# int ethernet 1/1-4
NX-5K-1(config-if)# switchport mode fex-fabric
NX-5K-1(config-if)# fex associate 100
NX-5K-1# show fex 100
NX-5K-1# show fex detail
NX-5K-1# show module fex

- Dynamic pinning (Nexus 5000 and 7000 series)

NX-5K-1(config)# feature fex
NX-5K-1(config)# fex 101
NX-5K-1(config-fex)# pinning max-links 1
NX-5K-1(config)# int ethernet 1/9-12
NX-5K-1(config-if)# switchport mode fex-fabric
NX-5K-1(config-if)# channel-group 11
NX-5K-1(config)# int port-channel 11
NX-5K-1(config-if)# fex associate 101
NX-5K-1# show int port-channel 11 fex-intf
NX-5K-1# show module fex

- vPC (Nexus 5000 series)

NX-5K-1(config)# feature fex
NX-5K-1(config)# fex 102
NX-5K-1(config-fex)# pinning max-links 1
NX-5K-1(config)# int ethernet 1/17-20
NX-5K-1(config-if)# switchport mode fex-fabric
NX-5K-1(config-if)# channel-group 12
NX-5K-1(config)# feature vpc
! vPC domain configuration
NX-5K-1(config)# int port-channel 12
NX-5K-1(config-if)# vpc 12
NX-5K-1(config-if)# fex associate 102
NX-5K-1# show int port-channel 12 fex-intf
NX-5K-1# show module fex

Configuration Rollback

NX-7K-1# checkpoint CP1 description First checkpoint
NX-7K-1# show checkpoint summary
NX-7K-1# rollback running-config checkpoint CP1

Role-Based Access Control (RBAC)

NX-7K-1(config)# role name L3-admin
NX-7K-1(config-role)# rule 1 permit read-write feature-group L3
NX-7K-1(config-role)# vlan policy deny
NX-7K-1(config-role-vlan)# permit vlan 1-100
NX-7K-1(config-role)# vrf policy deny
NX-7K-1(config-role-vlan)# permit vrf VRF1
NX-7K-1(config-role-vlan)# permit vrf VRF2 
NX-7K-1# show role

Ethanalyzer ~ a wrapper over tshark

NX-7K-1# ethanalyzer local interface inband brief limit-captured-frames 10
NX-7K-1# ethanalyzer local interface inband limit-captured-frames 1

VRF

NX-7K-1# show ip int brief ! default VRF
NX-7K-1# show ip int brief vrf management
NX-7K-1# ping 10.1.1.1 vrf management
NX-7K-1# routing-context vrf management
NX-7K-1%management# ping 10.1.1.1
NX-7K-1%management# routing-context vrf default
NX-7K-1#

Config-sync

NX-7K-1# configure sync
NX-7K-1(config-sync)# switch-profile PROFILE1
NX-7K-2# configure sync
NX-7K-2(config-sync)# switch-profile PROFILE1
NX-7K-2(config-sync-sp)# import interface po10
NX-7K-2(config-sync-sp-import)# verify
NX-7K-2(config-sync-sp-import)# show switch-profile PROFILE1 buffer
NX-7K-2(config-sync-sp-import)# show switch-profile PROFILE1 status
NX-7K-2(config-sync-sp-import)# commit
NX-7K-1(config-sync-sp)# sync-peers destination 10.0.0.2
NX-7K-2(config-sync-sp)# sync-peers destination 10.0.0.1
NX-7K-2(config-sync-sp)# int po10
NX-7K-2(config-sync-sp-if)# spanning-gree port type edge trunk
NX-7K-2(config-sync-sp)# verify
NX-7K-2(config-sync-sp)# commit
NX-7K-2# show running-config switch-profile

In-Service Software Upgrade (ISSU)

NX-7K-2# show incompatibility system n7000.bin
NX-7K-2# install all kickstart n7000-kickstart.bin system n7000.bin
NX-7K-2# system switchover
NX-7K-1# show incompatibility system n7000.bin
NX-7K-1# install all kickstart n7000-kickstart.bin system n7000.bin
NX-7K-1# system switchover