Wednesday 28 December 2016

All About 6500

6500 part 1

6500 PART 2 SUPERVISOR, MSFP, PFC & SWITCH FABRIC

6500 part 2

6500 PART 3 Ethernet Linecard Overview WAN Linecard Overview Service Module Overview CFC / DFC Overview Power Over Ethernet Overview

6500 part 3

6500 PART 4 Catalyst 6500 Architecture Review Unicast Multi-Layer Switching Multicast Multi-Layer Switching Load-Balancing

6500 part 4

6500 Part 7 VSS

6500 part 7


Mulitcast Part 8: Verifying PIM Operations

Multicasting Part 7 : PIM Switchover

Multicasting Part 6 : PIM Registration Process

Mulitcasting Part 5 : PIM Sparse Mode

Multicasting Part 4 : Multicasting Routing "PIM"

Multicasting Part 3 : Multicast Routing

Multicasting Part 2 :: IGMPv3 & IGMP Snooping

Multicast Part 1 : Multicasting Addressing & IGMPv2

F5 part 6 Persistence

F5 Part 5 : Persistence

F5 Monitors Part 4

F5 Load Balancing Part 3

F5 Processing Part 2

F5 Initial set up part 1

MDS Part 6


MDS Part 5


MDS Part 4


MDS Part 3


MDS Part 2

MDS Part 1

CCNA SECURITY PART 8


CCNA SECURITY PART 7


CCNA SECURITY PART 5


CCNA Security Part 4 Firewall

Ccna Security Section 3a

CCNA Security Part 2a

Intro to CCNA Security

Data Center Interconnect (DCI) 012

!
You are now required to perform Data Center Interconnect between DC1 & DC2.
The WAN core is multicast enable, but not MPLS capable.
You are allowed to use DC1-N7K1 & DC2-N7K1 to assist you in this task.
Only vlan 90 is required to be extended between DC1 and DC2 and vlan 80 will
stay local to the DC.
You will not need to create additional vlan for this task.
You are allowed to use multicast address range of your choice to achieve this task.
The rp address is 20.0.0.1 pim sparse-mode is running in the WAN core.
To property identify site DC1 & site DC2, you are free to configure a site identifier of your choice.
!
Topology:


Configuration:

DC1-N7K1# sh run | in feature
feature ospf
feature otv
DC1-N7K1# sh opsf
              ^
% Invalid command at '^' marker.
DC1-N7K1# sh run ospf

!Command: show running-config ospf
!Time: Sun Mar  6 08:23:08 2016

version 7.2(0)D1(1)
feature ospf

router ospf 1
  router-id 10.0.1.1

interface loopback1
  ip router ospf 1 area 0.0.0.0

interface Ethernet2/2
  ip ospf network point-to-point
  ip router ospf 1 area 0.0.0.0


DC1-N7K1# shrun int e2/1-2
            ^
% Invalid command at '^' marker.
DC1-N7K1# sh run int e2/1-2

!Command: show running-config interface Ethernet2/1-2
!Time: Sun Mar  6 08:23:22 2016

version 7.2(0)D1(1)

interface Ethernet2/1
  switchport
  switchport mode trunk
  switchport trunk allowed vlan 80,90
  no shutdown

interface Ethernet2/2
  no switchport
  mtu 9100
  mac-address 0000.0000.001a
  ip address 10.4.1.18/30
  ip ospf network point-to-point
  ip router ospf 1 area 0.0.0.0
  ip igmp version 3
  no shutdown

DC1-N7K1#
DC1-N7K3# sh run | in feature
feature ospf
feature pim
feature interface-vlan
DC1-N7K3# sh run int e2/6-7

!Command: show running-config interface Ethernet2/6-7
!Time: Sun Mar  6 08:24:29 2016

version 7.2(0)D1(1)

interface Ethernet2/5
  switchport
  switchport mode trunk
  switchport trunk allowed vlan 80,90
  no shutdown
!
interface Ethernet2/6
  no switchport
  mac-address 0000.0000.0036
  ip address 10.4.1.17/30
  ip ospf network point-to-point
  ip router ospf 1 area 0.0.0.0
  ip pim sparse-mode
  ip igmp version 3
  no shutdown

interface Ethernet2/7
  no switchport
  mac-address 0000.0000.003b
  ip address 10.4.1.1/30
  ip ospf network point-to-point
  ip router ospf 1 area 0.0.0.0
  ip pim sparse-mode
  no shutdown
!
DC1-N7K3# sh run ospf

!Command: show running-config ospf
!Time: Sun Mar  6 08:24:51 2016

version 7.2(0)D1(1)
feature ospf

router ospf 1
  router-id 10.0.1.2

interface Vlan90
  ip router ospf 1 area 0.0.0.0

interface loopback1
  ip router ospf 1 area 0.0.0.0

interface Ethernet2/2
  ip ospf network point-to-point
  ip router ospf 1 area 0.0.0.0

interface Ethernet2/6
  ip ospf network point-to-point
  ip router ospf 1 area 0.0.0.0

interface Ethernet2/7
  ip ospf network point-to-point
  ip router ospf 1 area 0.0.0.0
!

version 7.2(0)D1(1)

interface Ethernet2/7
  no switchport
  mac-address 0000.0000.004a
  ip address 10.4.1.5/30
  ip ospf network point-to-point
  ip router ospf 1 area 0.0.0.0
  no shutdown

DC1-N7K4(config)# sh run ospf

!Command: show running-config ospf
!Time: Sun Mar  6 08:26:35 2016

version 7.2(0)D1(1)
feature ospf

router ospf 1
  router-id 10.0.1.4

interface loopback1
  ip router ospf 1 area 0.0.0.0

interface Ethernet2/7
  ip ospf network point-to-point
  ip router ospf 1 area 0.0.0.0

!
DC2-N7K1# sh run int e2/1-2

!Command: show running-config interface Ethernet2/1-2
!Time: Sun Mar  6 08:28:38 2016

version 7.2(0)D1(1)

interface Ethernet2/1
  switchport
  switchport mode trunk
  switchport trunk allowed vlan 80,90
  no shutdown

interface Ethernet2/2
  no switchport
  mtu 9100
  mac-address 0000.0000.0051
  ip address 10.4.1.22/30
  ip ospf network point-to-point
  ip router ospf 1 area 0.0.0.0
  ip igmp version 3
  no shutdown

!
DC2-N7K1# sh run ospf

!Command: show running-config ospf
!Time: Sun Mar  6 08:27:59 2016

version 7.2(0)D1(1)
feature ospf

router ospf 1
  router-id 10.0.2.1

interface loopback1
  ip router ospf 1 area 0.0.0.0

interface Ethernet2/2
  ip ospf network point-to-point
  ip router ospf 1 area 0.0.0.0

on DC2-N7K3
DC2-N7K3(config)# sh run int e2/1,e2/6-7

!Command: show running-config interface Ethernet2/1, Ethernet2/6-7
!Time: Sun Mar  6 08:29:25 2016

version 7.2(0)D1(1)

interface Ethernet2/1
  no switchport
  mac-address 0000.0000.0072
  ip address 10.4.1.9/30
  ip ospf network point-to-point
  ip router ospf 1 area 0.0.0.0
  ip pim sparse-mode
  no shutdown

interface Ethernet2/6
  switchport
  switchport mode trunk
  switchport trunk allowed vlan 80,90
  no shutdown

interface Ethernet2/7
  no switchport
  mac-address 0000.0000.0072
  ip address 10.4.1.21/30
  ip ospf network point-to-point
  ip router ospf 1 area 0.0.0.0
  ip pim sparse-mode
  ip igmp version 3
  no shutdown
!
DC2-N7K3(config)# sh run | in feature
feature ospf
feature pim
feature interface-vlan
!
DC2-N7K4(config)# sh run int e2/1

!Command: show running-config interface Ethernet2/1
!Time: Sun Mar  6 08:30:40 2016

version 7.2(0)D1(1)

interface Ethernet2/1
  no switchport
  mac-address 0000.0000.0081
  ip address 10.4.1.13/30
  ip ospf network point-to-point
  ip router ospf 1 area 0.0.0.0
  no shutdown
!
DC2-N7K3(config)# sh ip route ospf-1
IP Route Table for VRF "default"
'*' denotes best ucast next-hop
'**' denotes best mcast next-hop
'[x/y]' denotes [preference/metric]
'%<string>' in via output denotes VRF <string>

10.0.1.1/32, ubest/mbest: 1/0
    *via 10.4.1.10, Eth2/1, [110/84], 01:01:43, ospf-1, intra
10.0.1.2/32, ubest/mbest: 1/0
    *via 10.4.1.10, Eth2/1, [110/44], 01:01:43, ospf-1, intra
10.0.1.4/32, ubest/mbest: 1/0
    *via 10.4.1.10, Eth2/1, [110/44], 01:01:43, ospf-1, intra
10.0.2.1/32, ubest/mbest: 1/0
    *via 10.4.1.22, Eth2/7, [110/41], 00:56:13, ospf-1, intra
10.0.2.4/32, ubest/mbest: 1/0
    *via 10.4.1.10, Eth2/1, [110/42], 00:50:41, ospf-1, intra
10.1.1.0/24, ubest/mbest: 1/0
    *via 10.4.1.10, Eth2/1, [110/42], 01:01:43, ospf-1, intra
10.1.2.0/24, ubest/mbest: 1/0
    *via 10.4.1.10, Eth2/1, [110/41], 01:01:43, ospf-1, intra
10.4.1.0/30, ubest/mbest: 1/0
    *via 10.4.1.10, Eth2/1, [110/43], 01:01:43, ospf-1, intra
10.4.1.4/30, ubest/mbest: 1/0
    *via 10.4.1.10, Eth2/1, [110/43], 01:01:43, ospf-1, intra
10.4.1.12/30, ubest/mbest: 1/0
    *via 10.4.1.10, Eth2/1, [110/41], 01:01:43, ospf-1, intra
10.4.1.16/30, ubest/mbest: 1/0
    *via 10.4.1.10, Eth2/1, [110/83], 01:01:43, ospf-1, intra
!
OTV Commands:

DC1-N7K1# sh ip mroute
IP Multicast Routing Table for VRF "default"

(*, 239.1.1.1/32), uptime: 00:44:57, otv ip
  Incoming interface: Ethernet2/2, RPF nbr: 10.4.1.18
  Outgoing interface list: (count: 1)
    Overlay1, uptime: 00:44:57, otv
!

DC1-N7K1# show ip igmp local-groups
IGMP Locally Joined Group Membership for VRF "default"
Group Address    Source Address   Type     Interface   Last Reported
239.1.1.1        *                Ronly    Eth2/2      00:01:06

!
DC1-N7K1# show otv overlay 1

OTV Overlay Information
Site Identifier 0000.0000.0101
Encapsulation-Format ip - gre

Overlay interface Overlay1

 VPN name            : Overlay1
 VPN state           : UP
 Extended vlans      : 90 (Total:1)
 Control group       : 239.1.1.1
 Data group range(s) : 232.1.1.0/24
 Broadcast group     : 239.1.1.1
 Join interface(s)   : Eth2/2 (10.4.1.18)
 Site vlan           : 80 (up)
 AED-Capable         : No (No Overlay Remote Adjacency up)
 Capability          : Multicast-Reachable
!
DC1-N7K1# sho otv vlan 90 detail

OTV Extended VLANs and Edge Device State Information (* - AED)
Legend: F - Forwarding B - Blocked

Legend:
(NA) - Non AED, (VD) - Vlan Disabled, (OD) - Overlay Down
(DH) - Delete Holddown, (HW) - HW: State Down
 (NFC) - Not Forward Capable

VLAN   Auth. Edge Device                     Vlan State                 Overlay
----   -----------------------------------   ----------------------       ------
-
  90                                         active(NFC)           Overlay1

       MRD packets originated: 84

show otv site
show otv route
show otv adjacency
show mac address-table
!

Establish A/A PO from N5K to Fabric Extender 011

DC2

Topo:


configure active/active connections from N5K-1 and N5K-2 to the FEX
use Fex 103 & Fex 104 as stated in the diagram.
You are allowed to configure L2 port channel trunk between N5K-1 & N5K-2
as stated in the diagram, you are not allowed to add any L3.
Use port-channel number 200. Make sure N5K-1 is both operational & role primary.
You are free to assign a switch identifier of your choice between N5K-1 & N5K-2.
You are free to assign a domain number of your choice between N5K-1 & N5K-2.
!
Downstream A/A PO from fex to server4.
User port-channel 2000 to complete this task.
Meet these requirements.
. trunk port that transition to forward immediately
. remote host does not support LACP
. Allow vlan 31 and 41 only.
!
5672-A(config)# feature fex
5672-A(config)# fex 103
5672-A(config-fex)# fex 103
5672-A(config-fex)# fex 104
5672-A(config-fex)# int e1/26-27
5672-A(config-if-range)# channel-group 103
5672-A(config-if-range)# no sh
5672-A(config-if-range)# int p103
5672-A(config-if)# switchport mode fex
5672-A(config-if)# fex associate 103
5672-A(config-if)# vpc 103
5672-A(config-if)# no sh
5672-A(config-if)# int e1/28-29
5672-A(config-if-range)# channel-group 104
5672-A(config-if-range)# no sh
5672-A(config-if-range)# int p104
5672-A(config-if)# switchport mode fex
5672-A(config-if)# fex associate 104
5672-A(config-if)# vpc 104
5672-A(config-if)# no sh
!
5672-B(config)# feature fex
5672-B(config)# fex 103
5672-B(config-fex)# fex 104
5672-B(config-fex)# int e1/26-27
5672-B(config-if-range)# channel-group 103
5672-B(config-if-range)# no sh
5672-B(config-if-range)# int p103
5672-B(config-if)# switchport mode fex
5672-B(config-if)# fex associate 103
5672-B(config-if)# vpc 103
5672-B(config-if)# no sh
5672-B(config-if)# int e1/28-29
5672-B(config-if-range)# channel-group 104
5672-B(config-if-range)# no sh
5672-B(config-if-range)# int p104
5672-B(config-if)# switchport mode fex
5672-B(config-if)# fex associate 104
5672-B(config-if)# vpc 104
5672-B(config-if)# no sh
5672-B(config-if)#
!
on Nexus DC1 side:
int e103/1/1,e104/1/1
channel-group 2000
no shut
!
interface port-channel 2000
switchport mode trunk
switchport trunk allowed vlan 31,41
spanning-tree port type edge trunk
no shut
!
on Nexus DC2 side:
int e103/1/1,e104/1/1
channel-group 2000
no shut
!
interface port-channel 2000
switchport mode trunk
switchport trunk allowed vlan 31,41
spanning-tree port type edge trunk
no shut
!
show port-channel summary
show vpc
!

VPC+ between two Nexus 5K 010

Creating VPC+ between two Nexus 5K.
Southbound Port-channel PO from N5K to FEX as per diagram:

topo:


in DC2
You are allowed to configure L2 port channel trunk between N5K-1 & N5K-2
as stated in the diagram, you are not allowed to add any L3.
Use port-channel number 200. Make sure N5K-1 is both operational & role primary.
You are free to assign a switch identifier of your choice between N5K-1 & N5K-2.
You are free to assign a domain number of your choice between N5K-1 & N5K-2.

5672-A(config)# feature lacp
5672-A(config)# vpc domain 200
5672-A(config-vpc-domain)# exit
5672-A(config)# install feature-set fa
fabric       fabricpath
5672-A(config)# install feature-set fabricpath
5672-A(config)# fea
feature       feature-set
5672-A(config)# feature-set fabricpath
5672-A(config)# fea
feature       feature-set
5672-A(config)# feature fex
5672-A(config)# vpc domain 200
5672-A(config-vpc-domain)# fabricpath switch-id 200
Configuring fabricpath switch id will flap vPCs. Continue (yes/no)? [no] yes
5672-A(config-vpc-domain)# role priority 1
Warning:
 !!:: vPCs will be flapped on current primary vPC switch while attempting role change ::!!
Note:
 --------:: Change will take effect after user has re-initd the vPC peer-link  ::--------
5672-A(config-vpc-domain)# pe
peer-config-check-bypass   peer-keepalive
peer-gateway               peer-switch
5672-A(config-vpc-domain)# peer-keepalive destination 10.31.113.39
Note:
 --------:: Management VRF will be used as the default VRF ::--------
5672-A(config-vpc-domain)# int e2/1-2
5672-A(config-if-range)# no sh
5672-A(config-if-range)# channel-group 200 mode active
5672-A(config-if-range)# int p200
5672-A(config-if)# switchport mode fabricpath
5672-A(config-if)# vpc peer-link
no sh

5672-B(config)# feature lacp
5672-B(config)# install feature-set fa
fabric       fabricpath
5672-B(config)# install feature-set fabricp
5672-B(config)# fe
feature       feature-set
5672-B(config)# feature-set fabricpath
fea     fex
5672-B(config)# fea
feature       feature-set
5672-B(config)# featurefex
                       ^
% Invalid command at '^' marker.
5672-B(config)# fe
feature       feature-set
5672-B(config)# feature fex
5672-B(config)# fe
feature       feature-set   fex
5672-B(config)# fea
feature       feature-set
5672-B(config)# feature lacp
5672-B(config)# vpc domain 200
5672-B(config-vpc-domain)# fabricpath switch-id 200
Configuring fabricpath switch id will flap vPCs. Continue (yes/no)? [no] yes
5672-B(config-vpc-domain)# pe
peer-config-check-bypass   peer-keepalive
peer-gateway               peer-switch
5672-B(config-vpc-domain)# peer-keepalive destination 10.31.113.38
Note:
 --------:: Management VRF will be used as the default VRF ::--------
5672-B(config-vpc-domain)# interface e2/1-2
5672-B(config-if-range)# channel-group 200 mode active
5672-B(config-if-range)# no sh
5672-B(config-if-range)# int p200
5672-B(config-if)# switchport mode fabricpath
5672-B(config-if)# no sh
5672-B(config-if)# vpc peer-link
5672-B(config-if)#

5672-A# sh vpc brief
Legend:
                (*) - local vPC is down, forwarding via vPC peer-link

vPC domain id                     : 200
vPC+ switch id                    : 200
Peer status                       : peer adjacency formed ok
vPC keep-alive status             : peer is alive
vPC fabricpath status             : peer is not reachable through fabricpath
Configuration consistency status  : failed
Per-vlan consistency status       : success
Configuration inconsistency reason: vPC type-1 configuration incompatible - STP
Mode inconsistent
Type-2 consistency status         : success
vPC role                          : primary
Number of vPCs configured         : 0
Peer Gateway                      : Disabled
Dual-active excluded VLANs        : -
Graceful Consistency Check        : Enabled
Auto-recovery status              : Enabled (timeout = 240 seconds)

vPC Peer-link status
---------------------------------------------------------------------
id   Port   Status Active vlans
--   ----   ------ --------------------------------------------------
1    Po200  up     -
5672-A# sh vpc role

vPC Role status
----------------------------------------------------
vPC+ role                       : primary
Dual Active Detection Status    : 0
vPC system-mac                  : 00:23:04:ee:be:c8
vPC system-priority             : 32667
vPC local system-mac            : 8c:60:4f:93:5f:fc
vPC local role-priority         : 1
5672-A#

Practice Set 2:

Topology:

Solution:

Configuring vPC+ between 5K and Downstream Switches:
!
Configure vPC domain 20 between DC2-N5K1 & 2 .
perform the following task:
1. Make sure N5K1 is always the vPC Primary switch.
2. Use Port-channel 200 for the Peer link
3. Do not add any L3 interface
4. Use Fabric path switch ID value 70.
5. use port channel ID 10 towards FI A
6. Use Port channel ID 20 towards FI B
7. Port channel to Down-Switch should  be configured as IEEE 802.1Q trunk
interfaces that allow only VLANs 30,40,70,71.
8. Make sure that port channels 10 & 20 come up without wating for the
standard forward delay time.
9. in few months our server team will connect a singel-leg on VLAN 300 that's
connect to N5K-2 . Make sure that the interface does not go down in dual-active scenario.
10. Make sure the vPC peer devices are the primary deciecs as LACP & use
priority value 2500.


Solution:

5672-A# sh run vpc

!Command: show running-config vpc
!Time: Tue Aug 28 13:31:42 2001

version 7.0(1)N1(1)
feature vpc

vpc domain 20
  role priority 1
  system-priority 2500
  peer-keepalive destination 1.1.1.2 source 1.1.1.1
  delay restore 150
  auto-recovery
  fabricpath switch-id 70

interface port-channel10
  vpc 10

interface port-channel20
  vpc 20

interface port-channel200
  vpc peer-link

5672-A# sh run int e1/1,p10,p20
                        ^
Invalid interface format at '^' marker.
5672-A# sh run int e1/1,port-channel10
                        ^
Invalid interface format at '^' marker.
5672-A# sh run int e1/1

!Command: show running-config interface Ethernet1/1
!Time: Tue Aug 28 13:32:37 2001

version 7.0(1)N1(1)

interface Ethernet1/1
  switchport mode fabricpath
  channel-group 200 mode active

5672-A# sh run int e1/18-19

!Command: show running-config interface Ethernet1/18-19
!Time: Tue Aug 28 13:32:46 2001

version 7.0(1)N1(1)

interface Ethernet1/18
  description To 9396-A Eth1/12
  switchport mode trunk
  switchport trunk allowed vlan 30,40,70-71
  channel-group 10

interface Ethernet1/19
  description To 9396-B Eth1/12
  switchport mode trunk
  switchport trunk allowed vlan 30,40,70-71
  channel-group 20

5672-A# sh run int p10

!Command: show running-config interface port-channel10
!Time: Tue Aug 28 13:32:55 2001

version 7.0(1)N1(1)

interface port-channel10
  switchport mode trunk
  switchport trunk allowed vlan 30,40,70-71
  spanning-tree port type edge trunk
  speed 10000
  vpc 10

5672-A# sh run int p20

!Command: show running-config interface port-channel20
!Time: Tue Aug 28 13:33:00 2001

version 7.0(1)N1(1)

interface port-channel20
  switchport mode trunk
  switchport trunk allowed vlan 30,40,70-71
  spanning-tree port type edge trunk
  speed 10000
  vpc 20

!
5672-B(config-if)# sh run vpc

!Command: show running-config vpc
!Time: Tue Aug 28 13:31:00 2001

version 7.0(1)N1(1)
feature vpc

vpc domain 20
  peer-keepalive destination 1.1.1.1 source 1.1.1.2
  delay restore 150
  dual-active exclude interface-vlan 300
  auto-recovery
  fabricpath switch-id 70

interface port-channel10
  vpc 10

interface port-channel20
  vpc 20

interface port-channel200
  vpc peer-link

5672-B(config-if)# sh run int e1/1,e1/12-13

!Command: show running-config interface Ethernet1/1, Ethernet1/12-13
!Time: Tue Aug 28 13:31:19 2001

version 7.0(1)N1(1)

interface Ethernet1/1
  switchport mode fabricpath
  channel-group 200 mode active

interface Ethernet1/12

interface Ethernet1/13


5672-B(config-if)# sh run int p10,p20

!Command: show running-config interface port-channel10, port-channel20
!Time: Tue Aug 28 13:31:43 2001

version 7.0(1)N1(1)

interface port-channel10
  switchport mode trunk
  switchport trunk allowed vlan 30,40,70-71
  spanning-tree port type edge trunk
  speed 10000
  vpc 10

interface port-channel20
  switchport mode trunk
  switchport trunk allowed vlan 30,40,70-71
  spanning-tree port type edge trunk
  speed 10000
  vpc 20

  5672-A# sh vpc
Legend:
                (*) - local vPC is down, forwarding via vPC peer-link

vPC domain id                     : 20
vPC+ switch id                    : 70
Peer status                       : peer link is up
vPC keep-alive status             : peer is alive
vPC fabricpath status             : peer is reachable through fabricpath
Configuration consistency status  : success
Per-vlan consistency status       : success
Type-2 consistency status         : success
vPC role                          : primary
Number of vPCs configured         : 2
Peer Gateway                      : Disabled
Dual-active excluded VLANs        : -
Graceful Consistency Check        : Enabled
Auto-recovery status              : Enabled (timeout = 240 seconds)

vPC Peer-link status
---------------------------------------------------------------------
id   Port   Status Active vlans
--   ----   ------ --------------------------------------------------
1    Po200  up     -

vPC status
---------------------------------------------------------------------------
id     Port        Status Consistency Reason       Active vlans vPC+ Attrib
--     ----------  ------ ----------- ------       ------------ -----------
10     Po10        down   success     success      -            DF: No, FP
                                                                MAC: 70.0.0
20     Po20        down   success     success      -            DF: No, FP
                                                                MAC: 70.0.0

5672-A# sh vpc role

vPC Role status
----------------------------------------------------
vPC+ role                       : primary
Dual Active Detection Status    : 0
vPC system-mac                  : 00:23:04:ee:be:14
vPC system-priority             : 2500
vPC local system-mac            : 8c:60:4f:93:5f:fc
vPC local role-priority         : 1




fabric path multi-path 009

on DC2
N7K7 & N7K8 will be the spine switches and N7K9 & N7K10 will be
leaf switches.
Ensure that N7K7 is the root for tree1 and N7K9 will be of tree 2.
L2 Multipathing topology and port assignment are displayed in the diagram:

Device            Switch id
N7K7               30
N7K8               40
N7K9               300
N7K10              400
!


Solution:

nx7(config)# fabricpath switch-id 30
nx7(config)# fa
fabric       fabricpath
nx7(config)# fabricpath domain ?
  default  Default fabricpath domain

nx8(config)# fabricpath switch-id 40
nx8(config)# fa
fabric       fabricpath
nx8(config)# fabricpath domain default
nx8(config-fabricpath-isis)# root-priority 254

nx7(config)# fabricpath domain default
nx7(config-fabricpath-isis)# root-priority 255


fabric       fabricpath
nx9(config)# fabricpath switch-id 300
nx10(config)# fabricpath switch-id 400

nx7(config-fabricpath-isis)# sh fabricpath switch-id
                        FABRICPATH SWITCH-ID TABLE
Legend: '*' - this system
        '[E]' - local Emulated Switch-id
        '[A]' - local Anycast Switch-id
Total Switch-ids: 4
=============================================================================
    SWITCH-ID      SYSTEM-ID       FLAGS         STATE    STATIC  EMULATED/
                                                                  ANYCAST
--------------+----------------+------------+-----------+--------------------
*   30          fa16.3e4f.b1ff    Primary     Confirmed Yes     No
    40          fa16.3e91.e6d2    Primary     Confirmed Yes     No
    300         fa16.3eef.ce20    Primary     Confirmed Yes     No
    400         fa16.3e5e.feda    Primary     Confirmed Yes     No
nx7(config-fabricpath-isis)# show fab
fabric       fabricpath
nx7(config-fabricpath-isis)# show fabricpath isis topology summary
FabricPath IS-IS Topology Summary
Fabricpath IS-IS domain: default
MT-0
  Configured interfaces:  Ethernet2/8  Ethernet2/9
 Max number of trees: 2  Number of trees supported: 2
    Tree id: 1, ftag: 1, root system: fa16.3e4f.b1ff, 30
    Tree id: 2, ftag: 2, root system: fa16.3e91.e6d2, 40
Ftag Proxy Root: fa16.3e4f.b1ff



Part 2:

Diag:



Fabric Path Configuration Part 2 (Practice)
Please refer the diagram:
DC2-N7K3 & DC2-N7K4 , DC2-N5K1 & DC2-N5K-2 enable fabricpath between them.
Port channel between DC2-N7K3 & DC2-N7K4 will not take part on fabricpath.
Create port channel between both Nexus 5K and enable fabricpath on the port
channel .
allow 20 seconds to detect any switch ID conflicts in Fabric path domain.
Make sure that only two equal cost paths are selected in Fabric path doamin.
Make sure DC2-N7K3 & DC2-N7K4 uses DC2-N5K-1 & 2 as equal cost paths.

Device name       switch id
DC2-N7K3           30
DC2-N7K4           40
DC2-N5K-1          50
DC2-N5K-2          60


Solution:
DC1-N7K-3(config-vlan)#
DC1-N7K-3(config-vlan)# sh run | in feature
install feature-set fabricpath
  allow feature-set fabricpath
feature-set fabricpath
DC1-N7K-3(config-vlan)# sh run fabricpath

!Command: show running-config fabricpath
!Time: Sun Mar  6 11:52:24 2016

version 7.2(0)D1(1)
install feature-set fabricpath
feature-set fabricpath

vlan 31,41
  mode fabricpath
fabricpath timers linkup-delay 20
fabricpath switch-id 30


interface Ethernet2/8
  switchport mode fabricpath
  fabricpath isis metric 35

interface Ethernet2/9
  switchport mode fabricpath
  fabricpath isis metric 35
fabricpath domain default
  maximum-paths 2
!
DC1-N7K-4(config-vlan)# sh run | in feature
install feature-set fabricpath
  allow feature-set fabricpath
feature-set fabricpath
DC1-N7K-4(config-vlan)# sh run fabricpath

!Command: show running-config fabricpath
!Time: Sun Mar  6 11:52:24 2016

version 7.2(0)D1(1)
install feature-set fabricpath
feature-set fabricpath

vlan 31,41
  mode fabricpath
fabricpath timers linkup-delay 20
fabricpath switch-id 40


interface Ethernet2/6
  switchport mode fabricpath
  fabricpath isis metric 35

interface Ethernet2/7
  switchport mode fabricpath
  fabricpath isis metric 35
fabricpath domain default
  maximum-paths 2
!
version 7.2(0)D1(1)
install feature-set fabricpath
feature-set fabricpath

vlan 31,41
  mode fabricpath
fabricpath timers linkup-delay 20
fabricpath switch-id 50


interface port-channel200
  switchport mode fabricpath

interface Ethernet2/1
  switchport mode fabricpath

interface Ethernet2/2
  switchport mode fabricpath

interface Ethernet2/7
  switchport mode fabricpath

interface Ethernet2/8
  switchport mode fabricpath

interface Ethernet2/9
  switchport mode fabricpath

interface Ethernet2/10
  switchport mode fabricpath
fabricpath domain default
  maximum-paths 2

!
DC1-N5K-2(config-if-range)# sh run fabricpath

!Command: show running-config fabricpath
!Time: Sun Mar  6 11:52:23 2016

version 7.2(0)D1(1)
install feature-set fabricpath
feature-set fabricpath

vlan 31,41
  mode fabricpath
fabricpath timers linkup-delay 20
fabricpath switch-id 60


interface Ethernet2/1
  switchport mode fabricpath

interface Ethernet2/2
  switchport mode fabricpath

interface Ethernet2/6
  switchport mode fabricpath

interface Ethernet2/7
  switchport mode fabricpath

interface Ethernet2/8
  switchport mode fabricpath

interface Ethernet2/9
  switchport mode fabricpath
fabricpath domain default
  maximum-paths 2
!



Configuring CE & FP(fabricpath) VLANS 008

on DC2
On N7K-5 , N7K-7 configure Classical Ethernet
on N7K-7 to 10 Configure Fabricpath Vlans:

Vlan ID   Name          Vlan mode
31      FP-DATA1         FP
41      FP-DATA2         FP
80      DCI-SITE         CE
90      DCI-DATA         CE

N7K-5         80,90
N7K-7         31.41,80,90
N7K-8 to 10   31,41




Solutions:

for classical vlan , its same like other catalyst switches
vlan 80
name DC1-SITE
vlan 90
name DCI-DATA

for fabricpath vlans , we have to do these things:
nx7(config)# install feature-set fabricpath
!
on nexus 7 to nexus 10 do this : 
install feature-set fabricpath
feature-set fabricpath
!
vlan 31
name FP-DATA1
mode fabricpath
!
vlan 41
name FP-DATA2
mode fabricpath
!
vlan 80
name DC1-SITE
vlan 90
name DCI-DATA
!
nx7(config-vlan)# sh vlan

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active
31   FP-DATA1                         active
41   FP-DATA2                         active
80   DC1-SITE                         active
90   VLAN0090                         active

VLAN Type         Vlan-mode
---- -----        ----------
1    enet         CE
31   enet         FABRICPATH
41   enet         FABRICPATH
80   enet         CE
90   enet         CE
!
on nexus 7
int e2/8-9

nx7(config)# int e2/8
nx7(config-if)# switchport
nx7(config-if)# switchport mode fabricpath
nx7(config-if)# no sh
nx7(config-if)# int e2/9
nx7(config-if)# switchport
nx7(config-if)# switchport mode fabricpath
nx7(config-if)# no sh
nx7(config-if)#

nx8(config)# feature-set fabricpath
nx8(config)# int e2/6-7
nx8(config-if-range)# switchport
nx8(config-if-range)# switchport mode fabricpath
nx8(config-if-range)# no sh
!
nx9(config-vlan)# feature-set fabricpath
nx9(config)# int e2/1-2,e2/7-10
nx9(config-if-range)# switchport mode fabricpath
ERROR: Ethernet2/1, Ethernet2/2, Ethernet2/7, Ethernet2/8, Ethernet2/9, Ethernet2/10: requested config change not allowed

nx9(config-if-range)# switchport
nx9(config-if-range)# switchport mode fabricpath
nx9(config-if-range)# no sh
!
nx10(config-vlan)# feature-set fa
nx10(config)# int e2/1-2,e2/6-9
nx10(config-if-range)# switchport
nx10(config-if-range)# switchport mode fabricpath
nx10(config-if-range)# no sh
!
nx8(config-if-range)# sh fabricpath route
FabricPath Unicast Route Table
'a/b/c' denotes ftag/switch-id/subswitch-id
'[x/y]' denotes [admin distance/metric]
ftag 0 is local ftag
subswitch-id 0 is default subswitch-id


FabricPath Unicast Route Table for Topology-Default

0/2208/0, number of next-hops: 0
        via ---- , [60/0], 0 day/s 00:03:08, local
1/475/0, number of next-hops: 1
        via Eth2/7, [115/400], 0 day/s 00:01:23, isis_fabricpath-default
1/1266/0, number of next-hops: 2
        via Eth2/6, [115/800], 0 day/s 00:00:41, isis_fabricpath-default
        via Eth2/7, [115/800], 0 day/s 00:01:23, isis_fabricpath-default
1/3366/0, number of next-hops: 1
        via Eth2/6, [115/400], 0 day/s 00:00:41, isis_fabricpath-default

nx9(config-if-range)# sh fabricpath route
FabricPath Unicast Route Table
'a/b/c' denotes ftag/switch-id/subswitch-id
'[x/y]' denotes [admin distance/metric]
ftag 0 is local ftag
subswitch-id 0 is default subswitch-id


FabricPath Unicast Route Table for Topology-Default

0/475/0, number of next-hops: 0
        via ---- , [60/0], 0 day/s 00:02:51, local
1/1266/0, number of next-hops: 1
        via Eth2/1, [115/400], 0 day/s 00:01:44, isis_fabricpath-default
1/2208/0, number of next-hops: 1
        via Eth2/2, [115/400], 0 day/s 00:01:44, isis_fabricpath-default
1/3366/0, number of next-hops: 4
        via Eth2/7, [115/400], 0 day/s 00:01:02, isis_fabricpath-default
        via Eth2/8, [115/400], 0 day/s 00:01:02, isis_fabricpath-default
        via Eth2/9, [115/400], 0 day/s 00:01:02, isis_fabricpath-default
        via Eth2/10, [115/400], 0 day/s 00:01:02, isis_fabricpath-default

VPC & Port-Channel 007

VPC & Port-Channel
In DC1
N7K-3 & N7K-4 configure port-channel with Nexus-11 & Nexus-2 as in
diagram, (i am excluding LACP primary on N7K-3,4 , i am excluding this)
Make sure N7K-3 is both operational and role primary.
Downstream port channel must meet the following requirements:
. (LACP i am excluding this)
. Trunk Port
. Allow Vlan 30,40,70 only
. Jumbo Frame
You may assign any domain number per your choice.
Device name      inerface    port-channel
N7K-3              e2/8       10
N7K-3              e2/9       20
N7K-4              e2/6       10
N7K-4              e2/5       20

Topo:




Solution:
N7K-3(config)# feature lacp
Error
N7K-3(config)# fea
feature       feature-set
N7K-3(config)# feature vpc
N7K-3(config)# int mgmt 0
N7K-3(config-if)# ip add 10.4.1.1/24
N7K-3(config-if)# no sh
N7K-3(config-if)# exit
N7K-3(config)# vpc domain 1
N7K-3(config-vpc-domain)# role priority 1
Warning:
N7K-3(config-vpc-domain)# peer-keepalive destination 10.4.1.5 source 10.4.1.1 vrf management
N7K-3(config-vpc-domain)# sy
system-mac        system-priority
N7K-3(config-vpc-domain)# system-priority 1
N7K-3(config-vpc-domain)# int e2/1-4
N7K-3(config-if-range)# channel-group 100 mode on
N7K-3(config-if-range)# no sh
N7K-3(config-if-range)# int p100
N7K-3(config-if)# switchport
N7K-3(config-if)# switchport mode trunk
N7K-3(config-if)# int p100
N7K-3(config-if)# vpc peer-link
Warning:
Ensure that VPC peer-link member ports on both peers use identical VDC types (limit-resource module-type VDC conf
ERROR: Operation failed: [Interface needs to be 10G to act as a peer-link]

N7K-3(config-if)#
N7K-3(config-if)# int e2/8
N7K-3(config-if)# channel-group 10 mode on
N7K-3(config-if)# no sh
N7K-3(config-if)# int p10
N7K-3(config-if)# switchport
N7K-3(config-if)# switchport mode trunk
N7K-3(config-if)# switchport trunk allowed vlan 30,40,70
N7K-3(config-if)# mtu 9216
N7K-3(config-if)# int e2/9
N7K-3(config-if)# channel-group 20 mod on
N7K-3(config-if)# no sh
N7K-3(config-if)# int p20
N7K-3(config-if)# switchport
N7K-3(config-if)# switchport mod tru
N7K-3(config-if)# switchport trunk allowed vlan 30,40,70
N7K-3(config-if)# mtu 9216


on N7K-4 Side:
switch(config)# feature vpc
switch(config)# int mgmt 0
switch(config-if)# ip add 10.4.1.5/24
switch(config-vpc-domain)# peer-keepalive destination 10.4.1.1 source 10.4.1.5 vrf management
switch(config-vpc-domain)# int e2/1-4
switch(config-if-range)# channel-group 100 mod on
switch(config-if-range)# no sh
switch(config-if-range)# int p100
switch(config-if)# switchport
switch(config-if)# switchport mod trun
switch(config-if)# vpc peer-link

N7K-4(config)# int e2/6
N7K-4(config-if)#   channel-group 10 mode on
N7K-4(config-if)#   no shutdown
N7K-4(config-if)# int p10
N7K-4(config-if)# switchport
N7K-4(config-if)#   switchport mode trunk
N7K-4(config-if)#   switchport trunk allowed vlan 30,40,70
N7K-4(config-if)#   mtu 9216

N7K-4(config-if)# int e2/5
N7K-4(config-if)# channel-group 20 mode on
N7K-4(config-if)# no sh
N7K-4(config-if)# int p20
N7K-4(config-if)#  switchport
N7K-4(config-if)#   switchport mode trunk
N7K-4(config-if)#   switchport trunk allowed vlan 30,40,70
N7K-4(config-if)#   mtu 9216
N7K-4(config-if)# no sh

on both switches:
N7K-3(config-if)# int p10
N7K-3(config-if)# vpc 10
N7K-3(config-if)# int p20
N7K-3(config-if)# vpc 20

nx-2(config)# int e2/1
nx-2(config-if)# channel-group 10 mod on
nx-2(config-if)# no sh
nx-2(config-if)# int p10
nx-2(config-if)# switchport
nx-2(config-if)# switchport mode trun
nx-2(config-if)# switchport trunk allowed vlan 30,40,70
nx-2(config-if)# no sh

nx-11(config)# int e2/1
nx-11(config-if)# channel-group 10 mod on
nx-11(config-if)# no sh
nx-11(config-if)# int p10
nx-11(config-if)# switchport
nx-11(config-if)# switchport mode trun
nx-11(config-if)# switchport trunk allowed vlan 30,40,70
nx-11(config-if)# no sh

Verificatoin:
N7K-3# sh port-c summary
N7K-3# sh vpc
Legend:
                (*) - local vPC is down, forwarding via vPC peer-link

vPC domain id                          : 1
Peer status                            : peer link not configured
vPC keep-alive status                  : peer is alive
Configuration consistency status       : Success
Configuration inconsistency reason     : vPC peer-link does not exist
Per-vlan consistency status            : Success
Type-2 consistency status              : Success
Type-2 inconsistency reason            : vPC peer-link Po10
vPC role                               : none established
Number of vPCs configured              : 2
Peer Gateway                           : Disabled
Dual-active excluded VLANs and BDs     : -
Graceful Consistency Check             : Enabled
Auto-recovery status                   : Enabled (timeout = 240 seconds)
Operational Layer3 Peer-router         : Disabled
Self-isolation                         : Disabled

vPC status
Id               : 10
  Port           : Po10
  Status         : up
  Consistency    : Applicable
  Reason         : Consistency Check Performed
  Active Vlans   : -
Id               : 20
  Port           : Po20
  Status         : up
  Consistency    : Applicable
  Reason         : Consistency Check Performed
  Active Vlans   : -

N7K-3# sh vpc role

vPC Role status
----------------------------------------------------
vPC role                            : Primary
vPC system-mac                  : 00:00:00:00:00:00
vPC system-priority             : 1
vPC local system-mac            : fa:16:3e:e4:d1:2b
vPC local role-priority         : 1
N7K-3# sh vpc peer-keepalive

vPC keep-alive status                  : peer is alive
--Peer is alive for             : (1150) seconds, (541) msec
--Send status                   : Success
--Last send at                  : 2016.02.25 04:05:32 720 ms
--Sent on interface             : mgmt0
--Receive status                : Success
--Last receive at               : 2016.02.25 04:05:32 720 ms
--Received on interface         : mgmt0
--Last update from peer         : (0) seconds, (433) msec

vPC Keep-alive parameters
--Destination                   : 10.4.1.5
--Keepalive interval            : 1000 msec
--Keepalive timeout             : 5 seconds
--Keepalive hold timeout        : 3 seconds
--Keepalive vrf                 : management
--Keepalive udp port            : 3200
--Keepalive tos                 : 192


DC ospf 006

Topo:


DC-1
on N7K3
Configure ospf with process id 1 .
Use Loopback 0 address as router ID.
Configure interface e2/7 in area 1 MTU 9100.
Make sure switch doesn't participate in DR/BDR election on WAN Link.
Advertise the following SVI into ospf .
Vlan 30
Vlan 40

on N7K4
Configure ospf with process id 1 .
Use Loopback 0 address as router ID.
Configure interface e2/7 in area 1 MTU 9100.
Make sure switch doesn't participate in DR/BDR election on WAN Link.
Advertise the following SVI into ospf .
Vlan 30
Vlan 40

On DC-2
on N7K3
Configure ospf with process id 1 .
Use Loopback 0 address as router ID.
Configure interface e2/7 in area 2 MTU 9100.
Make sure switch doesn't participate in DR/BDR election on WAN Link.
Advertise the following SVI into ospf .
Vlan 31
Vlan 41

on N7K4
Configure ospf with process id 1 .
Use Loopback 0 address as router ID.
Configure interface e2/7 in area 2 MTU 9100.
Make sure switch doesn't participate in DR/BDR election on WAN Link.
Advertise the following SVI into ospf .
Vlan 31
Vlan 41
!

nx-osv-3# sh run section ospf
show running-config | section ospf
feature ospf
  ip router ospf 1 area 0.0.0.1
  ip router ospf 1 area 0.0.0.1
  ip ospf network point-to-point
  ip router ospf 1 area 0.0.0.1
router ospf 1
  router-id 10.0.1.3
nx-osv-3# sh run int e2/7

!Command: show running-config interface Ethernet2/7
!Time: Sat Feb 20 11:50:47 2016

version 7.2(0)D1(1)

interface Ethernet2/7
  no switchport
  mtu 9100
  mac-address 0000.0000.002f
  ip address 10.4.1.1/30
  ip ospf network point-to-point
  ip router ospf 1 area 0.0.0.1
  no shutdown

nx-osv-3# sh run int vlan 30

!Command: show running-config interface Vlan30
!Time: Sat Feb 20 11:50:57 2016

version 7.2(0)D1(1)

interface Vlan30
  no shutdown
  ip address 10.1.30.124/25
  ip router ospf 1 area 0.0.0.1
  hsrp 0
    preempt
    priority 255
    ip 10.1.30.126

nx-osv-3# sh run int vlan 40

!Command: show running-config interface Vlan40
!Time: Sat Feb 20 11:51:03 2016

version 7.2(0)D1(1)

interface Vlan40
  no shutdown
  ip address 10.1.40.252/24
  ip router ospf 1 area 0.0.0.1
  hsrp 0
    preempt
    priority 255
    ip 10.1.40.254

!
 feature ospf

nx-osv-7(config)# router ospf 1
nx-osv-7(config-router)# router-id 10.0.2.3
nx-osv-7(config-router)# int e2/7
nx-osv-7(config-if)# ip ospf network point-to-point
nx-osv-7(config-if)# ip router ospf 1 area 2
nx-osv-7(config-if)# mtu 9100
nx-osv-7(config-if)# int vl 31
nx-osv-7(config-if)# ip router ospf 1 area 2
nx-osv-7(config-if)# int vl 41
nx-osv-7(config-if)# ip router ospf 1 area 2
nx-osv-7(config-if)#
!
nx-osv-8(config)# router ospf 1
nx-osv-8(config-router)# sh ip int brief
IP Interface Status for VRF "default"(1)
Interface            IP Address      Interface Status
Vlan31               10.1.31.125     protocol-down/link-down/admin-up
Vlan41               10.1.41.253     protocol-down/link-down/admin-up
Lo0                  10.0.2.4        protocol-up/link-up/admin-up
Eth2/1               10.4.1.13       protocol-up/link-up/admin-up
nx-osv-8(config-router)# router-id 10.0.2.4
nx-osv-8(config-router)# int e2/7
nx-osv-8(config-if)# ip ospf network point-to-point
nx-osv-8(config-if)# ip router ospf 1 area 2
nx-osv-8(config-if)# m
mac           mac-address   mdix          medium        mtu
nx-osv-8(config-if)# mt 9100
nx-osv-8(config-if)# int vl 31
nx-osv-8(config-if)# ip router ospf 1 area 2
nx-osv-8(config-if)# int vl 41
nx-osv-8(config-if)# ip router ospf 1 area 2
nx-osv-8(config-if)#
!
Use :
sh ip ospf nei
&
sh ip ospf route
to verify
!