EMAIL SUPPORT

dclessons@dclessons.com

LOCATION

NZ

LAB: VPC Consistency Check and failover Scenarios

LAB: VPC Consistency Check and failover Scenarios

Posted on Jan 24, 2020 (0)

VPC Consistency Check and failover Scenarios

LAB: Consistency Check and failover Scenarios:

Task :  We can use the same topology for this task.

  • Configure N7K and N7K to check the consistency type 1 by changing the following feature and then verify the effect and revert the configuration to again verify the Result one by one:

Global Configuration:

  • N7K1: Spanning tree mode RSTP
  • N7K2: Spanning tree Mode MST

Interface Configuration:

  • N7K1: No Interface Change
  • N7K2: configuration change on Po10 and make it access port.
  • Configure HSRP for VLAN 10 with Virtual IP 10.10.10.1/24 and SVI IP on N7K1 is 10.10.10.2/24 and on N7K2 would be 10.10.10.3/24. N7K should be configured with Priority 150, Preempt and Hello timer 2 and hold timer 15 sec. N7K2 should be configured with Preempt and Hello timer 2 and hold timer 15 sec. Once configuration is done Verify the HSRP status.
  • Verification on Failover scenario:
    • Peer-Keepalive Down: Shut down the Mgmt0 link and verify the connectivity between HOST1 and HOST2
    • Peer-link down only: Make Keepalive Link UP and then shut down the peer-link Po100 and then test the vPC effect and verify the Host Connectivity.
    • Peer-link down and Peer-keepalive down: Verify the vPC effect and test the HOST connectivity.
    • Peer-Keepalive link goes down and then Peer-link goes down: Verify the vPC behaviour
    • Peer-Keepalive link goes down and then Peer-link goes down: Verify the vPC behaviour
    • Peer-Keepalive link Peer-link goes down goes down same time: Verify the vPC behaviour
  • Enable Object Tracking feature on Peer-link and lets all track object on N7K1 goes down verify the vPC behaviour.
  • Remove the Track command from both N7K1 and N7K2 and configure auto-recovery on VPC domain on both Nexus Device and shut down Peer-link, Keepalive and then shut down the N7K1 primary and then see the vPC behaviour.

Solution:

Task 1: Configure N7K and N7K to check the consistency type 1 by changing the following feature and then verify the effect and revert the configuration to again verify the Result one by one as per given above task :

Global Configuration changes:

N7K1(config)# spanning-tree mode rapid-pvst
N7K2(config)# spanning-tree mode mst

Verification 1: By seeing below Figure we can easily say that there is consistency type-1 error and when there is type-1 error in global configuration mode then on secondary side , vPC member port goes down.

Now to verify CFS is working properly lets see the global consistency parameter :

Here we can see that there is mismatch in STP global configuration where N7K1 is configured with RSTP and N7K2 is configured with MST. Now lets revert the configuration and make N7K2 as RSTP.

N7K2(config)# spanning-tree mode rapid-pvst

Verification 2: Now lets verify the Consistency Error and vPC status .

Once the Global parameter is corrected then vPC member port on Secondary comes UP.

Interface Configuration changes :

Now we will change the configuration on interface level on N7K2 and see the results:

N7K2(config)# int po10
N7K2(config-if)# switchport mode access
N7K2(config-if)# no switchport mode trunk

Verification 3: Now as soon as we do changes configuration in Port-channel  and make it access port , Type-1 interface error is detected  and you can see that Port-channel 10 is down and shows consistency error.

Now revert the configuration and see the vPC status again.

N7K2(config)# int po10
N7K2(config-if)# no switchport mode acc
N7K2(config-if)# switchport
N7K2(config-if)# switchport mode trunk
N7K2(config-if)# no shut

Now upon revert , The consistency error get solved and port-channel 10 is Up again on secondary switch.

Task 2: Configure HSRP for VLAN 10 with Virtual IP 10.10.10.1/24 and SVI IP on N7K1 is 10.10.10.2/24 and on N7K2 would be 10.10.10.3/24. N7K should be configured with Priority 150, Preempt and Hello timer 2 and hold timer 15 sec. N7K2 should be configured with Preempt and Hello timer 2 and hold timer 15 sec. Once configuration is done Verify the HSRP status.

N7K1(config)# int vlan 10
N7K1(config-if)# ip address 10.10.10.2/24
N7K1(config-if)# no shut
N7K1(config-if)# hsrp 1
N7K1(config-if-hsrp)# ip 10.10.10.1
N7K1(config-if-hsrp)# preempt
N7K1(config-if-hsrp)# priority 150
N7K1(config-if-hsrp)# timers 2 15
N7K1(config-if-hsrp)# no shut
N7K1(config-if)#
!
N7K2(config)# feature hsrp
N7K2(config)# int vlan 10
N7K2(config-if)# ip address 10.10.10.3/24
N7K2(config-if)# no shut
N7K2(config-if)# hsrp 1
N7K2(config-if-hsrp)# ip 10.10.10.1
N7K2(config-if-hsrp)# preempt
N7K2(config-if-hsrp)# timers 2 15
N7K2(config-if-hsrp)# no shut
N7K2(config-if)#

Verification 4: From sh hsrp brief we can see that N7K1 is the active and N7K2 is standby.

TASK 3:  Verification on Failover scenario:

Peer-Keepalive Down: Shut down the Mgmt0 link and verify the connectivity between HOST1 and HOST2

N7K2(config-if)# int mgmt0
N7K2(config-if)# shut
Shutting down this interface will drop all telnet and SSH sessions. Do you wish to continue(y/n)? [no]
N7K2(config-if)#

Verification 5: Once Peer-keepalive is down , it can be seen than on vPC it shows that Peer is not reachable by Keepalive link how ever when HOST1 ping to HOST 2 , Ping successfully works.

Conclusion: When Peer-keepalive goes down no traffic effect happens.

Now make the mgmt0 interface UP.

N7K2(config)# int mgmt0
N7K2(config-if)# no shut
N7K2(config-if)#

Peer-link down only: Now shut down po100 on N7K2 due to which on secondary switch all vPC member posts and SVI 10 will go down while on Primary switch it will be UP.

N7K2(config)# int po100
N7K2(config-if)# shut

Verification 6:

Above figure status that on secondary switch all vPC member posts and SVI 10 will go down

While on Nexus Primary vPC interface and SVI is UP.Now check the HOST connectivity. And we will see that HOST 1 will be able to reach to HOST2 by Primary switch.

Peer-link down and then Peer-keepalive down:

Now keep the Above Scenario like this and shut down the Peer-keepalive Link mgmt0 on N7K2 to make it Split Brain scenario.

N7K2(config)# int mgmt0
N7K2(config-if)# shut

Once done you will see that all vPC link and its related vPC VLAN will go down on secondary switch.

Now revert the changes you have made.

N7K2(config)# int mgmt0
N7K2(config-if)# no shut
N7K2(config)# int po100
N7K2(config-if)# no shut

You will see that everything will come back as normal, on N7K2 vPC is up and all SVI will come UP.

Peer-Keepalive link goes down and then Peer-link goes down

In this as soon as Peer keepalive link goes down both vPC on N7K1 and N7K2 remains UP and now let’s shut down the Peer-link , upon shutdown of Peer-link as well , both Nexus device can no longer make aware of each other thus both will start behaving and claims themselves as primary and Dual Active scenario is achieved. In this Peer-link shows down but all the vPC interface remains UP.  

N7K2(config-if)# int mgmt0
N7K2(config-if)# shut
N7K2(config-if)#

Now Peer-link goes down

N7K2(config)# int po100
N7K2(config-if)# shut

Peer-Keepalive link Peer-link goes down goes down same time.

When both Peer-Keepalive link Peer-link goes down goes down same time both Nexus device can no longer make aware of each other thus both will start behaving and claims themselves as primary and Dual Active scenario is achieved. In this Peer-link shows down but all the vPC interface remains UP.  

  • N7K1: Primary
  • N7K2: Operation Primary

Task 4: Enable Tracking and Verify the vPC feature:

N7K2(config)# track 1 interface port-channel100 line-protocol
N7K2(config-track)# track 2 interface Ethernet1/6 line-protocol
N7K2(config-track)# track 10 list boolean or
N7K2(config-track)# object 1
N7K2(config-track)# object 2
N7K2(config-track)#
N7K2(config-track)# exit
N7K2(config)#
N7K2(config)#
N7K2(config)#
N7K2(config)# vpc domain 100
N7K2(config-vpc-domain)# track 10
N7K2(config-vpc-domain)#
!
N7K1# sh run track
track 1 interface port-channel100 line-protocol
track 2 interface Ethernet1/6 line-protocol
track 10 list boolean or
object 1
object 2
!

Verification 7:

shows that all track object is UP and all vPC is UP and running.Now lets make tracke object down on Primary N7K1 switch.

N7K1# conf t
N7K1(config)# int po100
N7K1(config-if)# shut
N7K1(config-if)# int eth1/6
N7K1(config-if)# shut
2018 Aug 29 17:12:00 N7K1 %$ VDC-1 %$ %VPC-2-TRACK_INTFS_DOWN: In domain 100, vPC tracked interfaces down, suspending all vPCs and keep-alive

Verification 8: On N7K1 vPC will be suspended and N7K2 will be operational Primary and vPC will be in Up state.

TASK5:  Remove the Track command from both N7K1 and N7K2 and configure auto-recovery on VPC domain on both Nexus Device and shut down Peer-link, Keepalive and then shut down the N7K1 primary and then see the vPC behavior.

N7K1(config)# vpc domain 100
N7K1(config-vpc-domain)# no track 10
N7K1(config-vpc-domain)# exit
N7K1(config)# no track 10 list boolean or
N7K1(config)# no track 1 interface port-channel100 line-protocol
N7K1(config)# no track 2 interface Ethernet1/6 line-protocol
N7K2(config)# int po100
N7K2(config-if)# no track 10
N7K2(config)# exit
N7K2(config)# no track 10 list boolean or
N7K2(config)# no track 1 interface port-channel100 line-protocol
N7K2(config)# no track 2 interface Ethernet1/6 line-protocol
Now configure auto-recovery command on both nexus Device.
N7K1(config)# vpc domain 100
N7K1(config-vpc-domain)# auto-recovery
N7K1(config-vpc-domain)#
N7K2(config)# vpc domain 100
N7K2(config-vpc-domain)# auto-recovery
N7K2(config-vpc-domain)#
Now shut down both Peer-link and mgmt0 on N7K1.
N7K1(config)# int po100
N7K1(config-if)# shut
N7K1(config-if)# int mgmt0
N7K1(config-if)# shut

Verification 9: This will shut down SVI and vPC member port down on Secondary.

Now Shutdown the Nexus N7K1 and you will find that N&K2 will enable its SVI and its Member port due to auto-recovery feature.

N7K1# conf t
Enter configuration commands, one per line. End with CNTL/Z.
N7K1(config)# reload


Comment

    You are will be the first.

LEAVE A COMMENT

Please login here to comment.