NX-OS and Cisco Nexus Switching

Ron Fuller, CCIE No. 5851 (Routing and Switching/Storage Networking), is a technical marketing engineer (TME) on the Nexus 7000 team for Cisco. He has 21 years of experience in the industry and has held certifications from Novell, HP, Microsoft, ISC2, SNIA, and Cisco. His focus is working with customers worldwide to address their challenges with comprehensive end-to-end data center architectures and how they can best use Cisco technology to their advantage. He has had the opportunity to speak at Cisco Live on VDCs, NX-OS Multicast, and general design. He lives in Ohio with his wife and four wonderful children and enjoys travel and auto racing. He can be found on Twitter @ccie5851. David Jansen, CCIE No. 5952, is a technical solutions architect for Data Center for Enterprise Central Area. David has more than 20 years’ experience in the information technology industry. He has held multiple certifications from Microsoft, Novell, Checkpoint, and Cisco. His focus is to work with Enterprise customers to address end-to-end data center Enterprise architectures. David has been with Cisco for 15 years and working as a technical solutions architect for 6 years and has provided unique experiences helping customers build architectures for Enterprise data centers. David holds a B.S.E. degree in computer science from the University of Michigan (Go Blue!) and an M.A. degree in adult education from Central Michigan University. Matthew McPhersonis a senior systems engineer and solutions architect for Cisco in the Central Select Operation, specializing in data center architectures. Matt has been with Cisco for more than 2 1/2 years and has more than 12 years of experience in the industry working for service providers and large enterprise customers in the financial and manufacturing verticals. He has held certifications from Juniper, Netscreen, and Cisco, and possesses a deep technical background in the areas of routing, switching, and security. His primary focus is working with strategic customers in greater Michigan to address their overall infrastructure challenges. He lives in Michigan with his wife and enjoys biking and collecting cars.

• Foreword xxiiiIntroduction xxivChapter 1 Introduction to Cisco NX-OS 1NX-OS Overview 1NX-OS Supported Platforms 3NX-OS Licensing 7Nexus 7000 7Nexus 5500 8Nexus 3000 8Nexus 2000 9Nexus 1000v 9Installing the NX-OS License File 9Cisco NX-OS and Cisco IOS Comparison 10NX-OS User Modes 12EXEC Command Mode 12Global Configuration Command Mode 13Interface Configuration Command Mode 13Management Interfaces 14Controller Processor (Supervisor Module) 15Connectivity Management Processor (CMP) 16Telnet 18SSH 19SNMP 23DCNM 26Managing System Files 28File Systems 28Configuration Files: Configuration Rollback 33Operating System Files 35Virtual Device Contexts 37VDC Configuration 43VDC Interface Allocation 46Interface Allocation: N7K-M132XP-12 and L 46Interface Allocation: N7K-F132XP-15 47Interface Allocation: N7K-M108X2-12L 48Interface Allocation: 10/100/1000 Modules 48Interface Allocation on M2 Modules 52Troubleshooting 54show Commands 54debug Commands 55Topology 56Further Reading 57Chapter 2 Layer 2 Support and Configurations 59Layer 2 Overview 59Store-and-Forward Switching 60Cut-Through Switching 60Fabric Extension via the Nexus 2000 60Configuring Nexus 2000 Using Static Pinning 61Nexus 2000 Static Pinning Verification 62Configuring Nexus 2000 Using Port-Channels 66Nexus 2000 Static Pinning Verification 67Layer 2 Forwarding on a Nexus 7000 69L2 Forwarding Verification 70VLANs 71Configuring VLANs 72VLAN Trunking Protocol 72Assigning VLAN Membership 73Verifying VLAN Configuration 74Private VLANs 76Configuring PVLANs 77Verifying PVLAN Configuration 80Spanning Tree Protocol 80Rapid-PVST+ Configuration 82Verifying Spanning Tree State for a VLAN 83Spanning Tree Timers 84MST Configuration 87Additional Spanning Tree Configuration 91Port Cost 91Port Priority 94Spanning Tree Toolkit 94BPDUGuard 94BPDUFilter 95RootGuard 96LoopGuard 97Dispute Mechanism 98Bridge Assurance 98Spanning Tree Port Types 99Virtualization Hosts 100Configuring Layer 2 Interfaces 100Trunk Ports 100Standard Host 101Link to Virtualization Host 101Port-Profiles 102Port-Channels 103Assigning Physical Ports to a Port-Channel 104Port-Channel Flow Control 107Verifying Load Distribution Across a Port-Channel 108Virtual Port-Channels 109vPC Peer-Gateway 116vPC Peer-Switch 116ARP Synchronization 117Unidirectional Link Detection 118Cisco FabricPath 119vPC+ 127Configuring vPC+ 127Summary 133Chapter 3 Layer 3 Support and Configurations 135EIGRP 135EIGRP Operation 136Configuring EIGRP 137EIGRP Summarization 142EIGRP Stub Routing 145Securing EIGRP 147EIGRP Redistribution 149OSPF 154OSPFv2 Configuration 154OSPF Summarization 160OSPF Stub Routing 163Securing OSPF 167OSPF Redistribution 169OSPFv3 Configuration 177IS-IS 178IS-IS Configuration 178BGP 183BGP Configuration 184BGP Neighbors 187Securing BGP 190BGP Peer Templates 192Advertising BGP Networks 194Modifying BGP Routing Metrics 197Verifying BGP-Specific Configuration 198First Hop Redundancy Protocols 198HSRP 199HSRP Configuration 199HSRP Priority and Preempt 200Verifying the HSRP Configuration 201Securing HSRP 202HSRP Secondary Support 204HSRP Support for IPv6 204VRRP 205VRRP Configuration 205VRRP Priority and Preempt 207Verifying VRRP Configuration 208Securing VRRP 208VRRP Secondary Support 209HSRP, VRRP, and vPC Interactions 210GLBP 212GLBP Configuration 212GLBP Priority and Preempt 214Verifying GLBP Configuration 214Securing GLBP 215GLBP Secondary Support 218Summary 220Chapter 4 IP Multicast Configuration 221Multicast Operation 221Multicast Distribution Trees 222Reverse Path Forwarding 225Protocol Independent Multicast (PIM) 225RPs 226PIM Configuration on Nexus 7000 and Nexus 5500 227Configuring Static RPs 230Configuring BSRs 232Configuring Auto-RP 235Configuring Anycast-RP 237Configuring SSM and Static RPF 239IGMP Operation 241IGMP Configuration on Nexus 7000 242IGMP Configuration on Nexus 5000 245IGMP Configuration on Nexus 1000V 246MSDP Configuration on Nexus 7000 248Administrative Scoping of Multicast RPs in PIM 250Configuring PIM Join and Prune Policies 252Multicast and Control Plane Policing (CoPP) 253Summary 253Chapter 5 Security 255Configuring RADIUS 256RADIUS Configuration Distribution 259Configuring TACACS+ 266Enabling TACACS+ 266TACACS+ Configuration Distribution 267Configuring the Global TACACS+ Keys 268Configuring the TACACS+ Server Hosts 268Configuring TACACS+ Server Groups 269Configuring TACACS+ Source Interface 270Configuring SSH 275Cisco TrustSec 278Configuring AAA for Cisco TrustSec 281Defining Network Device Admission Control 282Configuring the Nexus 7000 for 802.1x and SGA Features 285SGT Assignment via ISE Server 288Policy Component: IP to SGT Mapping 290Policy Component: SGACL Creation 292Configuring Cisco TrustSec: IEEE 802.1AE LinkSec 294Layer 2 Solutions Between Data Centers 301Configuring IP ACLs 302Configuring MAC ACLs 305Configuring VLAN ACLs 307Configuring Port Security 308Security Violations and Actions 311Configuring DHCP Snooping 313Configuring Dynamic ARP Inspection 316Dynamic ARP Inspection Trust State 317Configuring IP Source Guard 321Configuring Keychain Management 322Configuring Traffic Storm Control 323Configuring Unicast RPF 325Configuring Control Plane Policing 327Configuring Rate Limits 335SNMPv3 340Summary 347Chapter 6 High Availability 349Physical Redundancy 349Redundant Power Supplies 350Redundant Cooling System 352Redundant Supervisors 355Redundant Ethernet Out-of-Band (EOBC) 357Redundant Fabric Modules 357Generic Online Diagnostics 358Bootup Diagnostics 359Runtime Diagnostics 360On-Demand Diagnostics 365NX-OS High-Availability Architecture 365Process Modularity 366Process Restart 368Stateful Switchover 369Nonstop Forwarding 370In-Service Software Upgrades 370Summary 383Chapter 7 Embedded Serviceability Features 385SPAN 386SPAN on Nexus 7000 386Configuring SPAN on Nexus 7000 387SPAN on Nexus 5x00 392Configuring SPAN on Nexus 5x00 393SPAN on Nexus 1000V 397Configuring SPAN on Nexus 1000V 398ERSPAN on Nexus 1000V 400ERSPAN on Nexus 7000 406ERSPAN on Nexus 5x00 412Embedded Analyzer 414Smart Call Home 424Smart Call Home Configuration 428Configuration Checkpoint and Rollback on Nexus 7000 431Checkpoint Creation and Rollback 432Configuration Checkpoint and Rollback on Nexus 5x00 434Checkpoint Creation and Rollback 435NetFlow 437Configuring NetFlow on Nexus 7000 438Configuring NetFlow on Nexus 1000V 442Network Time Protocol 444Precision Time Protocol 445IEEE 802.3az (Energy Efficient Ethernet) 447Power On Auto-Provisioning 448Python 449Summary 454Chapter 8 Unified Fabric 455Unified Fabric Overview 455Enabling Technologies 45610-Gigabit Ethernet 456Fibre Channel over Ethernet 458Single-Hop Fibre Channel over Ethernet 461Multhop Fibre Channel over Ethernet 462Storage VDC on Nexus 7000 463N-Port Virtualization 465N-Port Identification Virtualization 466FCoE NPV Mode 466Nexus 5x00 Unified Fabric Configuration 467Single-Hop FCoE Configuration: Nexus 5x00 469FCoE-NPV on Nexus 5x00 473Nexus 7000 Unified Fabric Configuration 477Summary 488Chapter 9 Nexus 1000V 489Hypervisor and vSphere Introduction 489Nexus 1000V System Overview 490Nexus 1000V Switching Overview 494Nexus 1000V VSM Installation 496Nexus 1000V Deployed on Nexus 1010 Virtual Services Blade 497Registering the Nexus 1000V Plug-In to VMware Virtual Center Management Application 502Configuring the SVS Domain and Networking Characteristics 507Connecting the Nexus 1000V VSM to the vCenter Server 508Nexus 1000V Installation Management Center 510VEM Installation Option on the Nexus 1000V Management Installation Center 519vCenter Connection Option on the Nexus 1000V Management Installation Center 523Creating the Uplink Profile 526Adding the VEM to a ESX vSphere Host 528Enabling the Telnet Server Process 536Changing the VSM Hostname 536Layer 3 Control 5361000V Port Profiles 542Virtual Network Management Center 552Installing Virtual Network Management Center Software from OVA Downloaded from Cisco.com 553Adding the VM-Manager for vCenter Connectivity in VNMC Management Application 564Configuring the Cisco VNMC Policy-Agent on the 1000v VSM 570Virtual Security Gateway 571Install Virtual Security Gateway on the Nexus 1010 574Configuring the Cisco VNMC Policy-Agent on the VSG 577Verify That the VSG and VSM Are Registered Clients in VNMC 578Creating a Tenant in VMMC 579Virtual Extensible LAN 602Deploying Virtual Extensible LAN 604Nexus 1000v Network Analysis Module 629Installing Nexus 1000v Network Analysis Module 630Deploying the Nexus 1000v NAM as a Virtual Services Blade on the Nexus 1010 641Summary 642Chapter 10 Quality of Service (QoS) 643QoS on Nexus 7000 646Forwarding Architecture 646Network-QoS Policies 648Queuing Policies 650QoS and Nexus 2000 Fabric Extenders 661