Cisco networkers 2009 session BRKDCT 2951 deploying nexus 7000 in data center networks DDU

agg1b agg1a agg1b agg1a VTP L3 link L2 trunk L3 Channel L2 Channel L3 link L2 trunk L3 Channel VLAN Trunking Protocol VTP Implement VTP off mode if all other switches are already in

Trang 1

Deploying Nexus 7000 in

Data Center Networks

BRKDCT-2951

Trang 2

Prerequisites : Session Abstract

This session is targeted to network administrators and operators

who have deployed or are considering the deployment of the

Nexus 7000 The session starts with a brief introduction to the

Nexus 7000 hardware components and NX-OS software followed

by a brief design discussion how the Nexus 7000 can be inserted

into existing as well as green field data centers environments The focus of the presentation is moving to best practices of areas like

environmental, Layer 2 & 3 protocols, high availability and system management aspects Lastly the session will step through a

migration example that will outline a step by step how-to While CLI differences between IOS switching platforms and NX-OS on the

Nexus 7000 are covered, troubleshooting is not part of this

presentation’s scope.

Attendee should have a basic knowledge of the Nexus 7K

hardware and software platform as well as solid knowledge of L2

and L3 protocols.

Trang 3

Associated Sessions/Labs

Center - BRKDCT-2961

Trang 4

Agenda

Hardware and Software Overview

Trang 5

Hardware Overview

7010 Chassis

slots

utilizing 2 system fan trays

and 2 fabric fan trays

insert vertically

Front view Rear view

Trang 6

7018 Chassis

Front view Rear view

slots

utilizing 2 system fan trays

insert horizontally

Trang 7

Supervisor Module

processor with 4GB DRAM

lights-out management via dedicated 10/100/1000 Ethernet

compact flash slots

Trang 9

Fabric Modules

Fabric module is unique to chassis type, 10-slot and 18-slot fabric are not interchangeable 10-slot fabric insert horizontally, 18-slot

fabric insert vertically.

Provide 46Gbps per I/O module slot

Two 23G channels per I/O slot One 23G channel per supervisor slot

Up to 230Gbps per slot with 5 fabric modules

3 fabric modules provides N+1 redundancy with current I/O

modules

N7K-C7018-FAB-1=

Trang 10

Common power supplies for both 7010 and the 7018

Dual Inputs per power supply (220v and 110v)

20A circuit for 6000W PS and 30A circuit for 7500W PS

Hot swappable for availability and migration

Use power calculator in planning power requirement

Trang 11

Nexus 7010 System Fan Tray Nexus 7010

Nexus 7018 System Fan Tray

Fan Trays

fabric fans (fully redundant)

plus the 5 fabric modules The bottom fan tray cools

slots 10-18.

Trang 12

NX-OS Overview

Comprehensive L2 and L3 Feature Set SAN switching (Storage protocols)

(Possible Future) Layer-3 Protocols

Interface Management Chassis Management

OSPF BGP EIGRP

GLBP HSRP VRRP

VSANs Zoning FCIP FSPF IVR

UDLD CDP 802.1X

IGMP snp

LACP CTS PIM SNMP

Other Services

Future Services Possibilities

…

Protocol Stack (IPv4 / IPv6 / L2)

Trang 13

NX-OS Overview (Cont.)

Highly Scalable Unprecedented Uptime

Perform Maintenance Anytime (In-Service Software Upgrade)

Industry First Virtualized Network OS

No interaction with the neighbor to recover the state

Trang 14

Agenda

Common Data Center Designs

Trang 15

Data Center Common Topology 1

Core2 Core1

L2 Channel L3 link L2 link

Access Layer

Core Layer

Edge Layer

L2 L3

L2

Trang 16

Data Center Common Topology 2

L2 L3

L3

agg1b agg1a

L2

aggNb aggNa

L2 Channel L3 link L2 link L3 Channel

Trang 17

Full featured 10G density for aggregating 10G top of rack and 10G blade servers

10G Aggregation

Density

Agg Layer Nexus

7000

Top of Rack

Blade Servers

7000

As virtualization drives host I/O utilization, 10G to

the host requirements are becoming reality

Access 1G/10G

to the Host

Access Layer Nexus

7000

Agg Layer Nexus

7000

Enables new Ethernet capabilities such

as lossless Ethernet, L2 multipathing, and

FCoE

Data Center Ethernet (DCE) (future)

Unified Fabric

LAN SAN

IPC Nexus 7000 Series

Insertion Points/Needs

Trang 18

DC Topology 1

Inserting Nexus 7K in the core

Core2 Core1

L2 L3

L2

Trang 19

DC Topology 1

Inserting Nexus 7K in the Core With VPC

Core2 Core1

VPC

L2 L3

L2

Trang 20

DC Topology 2

Insert Nexus 7K in the Aggregation With VPC

L2 L3 L3

L2

aggNb aggNa

…

Trang 21

DC Topology 2

Insert Nexus 7K in the Aggregation With VDC

devices by utilizing VDC

security zones.

L2 L3 L3

L2

VDC 2b

VDC 2a

VDC 1b

VDC 1a

VDC 2b

VDC 2a

Core2

VDC 1b

VDC 1a

Core1

…

Trang 22

Agenda

Implementation Best Practices

Trang 23

Environmental Considerations

Trang 24

Power Redundancy Mode

Trang 25

Static: 2000 lbs Dynamic: 1500 lbs

for NEBS)

Trang 26

Airflow and Cable Management

For hot-aisle cold-aisle design,

cabinets can be used to converts

7018 to front to back air cooling

7018 requires 11” space on both

sides

Route cables on the left front or

right front side of the 7018 to

leave the right and left rear side

unobstructed

Optionally, install fiber I/O

modules on the outside slots and

copper I/O modules on the inside

slot on 7010

7010 chassis

7018 chassis

Trang 27

Layer2 and Layer3 Features

Trang 28

agg1b agg1a

VTP

L3 link L2 trunk L3 Channel

L2 Channel L3 link L2 trunk L3 Channel

VLAN Trunking Protocol (VTP)

Implement VTP off mode if all

other switches are already in

transparent mode

Configure VTP transparent

mode if VTP domain needs to

extend across Nexus 7K

switches

Trang 29

Implement consistent STP mode

for all switches in the L2 domain

Dispute Mechanism is enabled

by default to detect

unidirectional link failure

agg1b agg1a

Si

Access1

Primary Secondary root

Dispute Mechanism

Primary Secondary root

Access2

Trang 30

agg1b agg1a

Si

Access1

Bridge Assurance Loopguard

Bridge

Assurance

Network Port Type

BPDU-guard

Access2

Edge Port Type

Normal Port Type

L2 access

Cat6500 supports BA from 12.2(33)SXI onwards

Spanning-tree (Cont.)

Configure port type “network”

or Bridge Assurance (BA) on

the interfaces only if feature

is supported on both side of

switches,

Enable loopguard globally on

access switch if BA is not

supported

Configure port type “edge” or

STP portfast on host ports

globally

Trang 31

N7010-2 %ARP-2-DUP_SRC_IP: arp [25537] Source address of packet received from

001b.54c2.aec4 on Vlan2(port-channel1) is duplicate of local, 10.4.2.2

N7010-2 %STP-2-DISPUTE_DETECTED: Dispute detected on port port-channel1 on VLAN0002.

N7010-2 %STP-2-DISPUTE_CLEARED: Dispute resolved for port port-channel1 on VLAN0002.

N7010-2 %ARP-2-DUP_SRC_IP: arp [25537] Source address of packet received from

001b.54c2.aec4 on Vlan2(port-channel1) is duplicate of local, 10.4.2.2

EtherChannel

Configure Link Aggregation Control

Protocol (LACP) for L2 and L3

port-channel to detect mis-configuration

On/On for L3 port-channel (tradeoff

between HA and performance)

Mis-matching (L2 port-channel) will

be detected by the dispute

mechanism

Trang 32

agg1b agg1a

Si

Access1

UDLD normal mode

UDLD Aggressive mode

UDLD normal mode

UniDirectional Link Detection (UDLD)

on L2 switch-to-switch

interfaces

L2 and L3 port channel

member ports to avoid traffic

black-hole

Trang 33

Virtual Port-Channel (VPC)

port channel across two upstream

switches

Trang 34

VPC (Cont.)

ports (port channels) that form a VPC

between the VPC peers and the

downstream device

between VPC peer devices, must be

10GbE

the status of VPC peer devices,

i.e., backup to the VPC peer-link

protocol, used for state

synchronization and configuration

validation between VPC peer devices

VPC Peer-link

Keepalive link

agg1b agg1a

Access2 Access1

VPC

CFS Protocol vPC

member port

VPC member

L3 link L2 trunk L3 Channel

Trang 35

Core1 Core2

VPC Peer-link

Keepalive link

agg1b agg1a

Access2 Access1

Network Type

UDLD Aggressive

Bridge Assurance

VPC Secondary VPC Primary

VPC Best Practices

Manually define VPC primary

and VPC secondary switch

Form L2 channel with diverse

10GE modules for VPC

peer-link w/ ports in dedicated mode

Form L3 channel with diverse

GE modules for VPC peer

keepalive link (non-default VRF)

Enable BA on VPC peerlink

interface (default)

Enable UDLD aggressive on

VPC peerlink interface

Trang 36

VPC Best Practices (Cont.)

Align STP root, HSRP active

router and PIM DR with VPC

primary switch

Align STP secondary root,

HSRP standby router with VPC

secondary switch

By eliminating L2 loops with

VPC, BA and Loopguard are

not needed on access switches

Enable spanning-tree port type

edge on host ports

Enable spanning-tree

Access2 Access1

STP primary root HSRP Active PIM DR

STP secondary root HSRP Standby

Edge Port Type

BPDU-guard

L2 access

Trang 37

Core1 Core2

VPC PL

VPC PKAL

Secondary primary

Access2 Access1

Shut down VPC ports

Detects VPC peer-link failure

10GE

VPC With Single 10GE I/O Module

Trang 38

Common Layer-3 Features

avoid unnecessary network convergence during

supervisor failover

improve IGP convergence over L2 cloud

IOS default is 100M and NX-OS default is10G

plane load and FHRP timers should not be tuned to

less than 1 sec hello and hold 3 sec hold timer

routing authentication, route summarization and

preemption delay

Trang 39

System Management

Trang 40

Nexu7K# checkpoint checkpt1

Processing the Request Please Wait

Done

Nexus7K# show diff rollback-patch running-config checkpoint checkpt1

Nexus7K# config t

Enter configuration commands, one per line End with CNTL/Z.

………

Nexus7K# rollback running-config checkpoint checkpt1

Generating the Rollbackpatch Please Wait

Executing the patch Please Wait

<Snip>

Successfully executed patch

Configuration Rollback

Trang 41

Notifying services about system upgrade.

[# ] 0% FAIL Return code 0x412A0007 ((null)).

Cannot proceed with ISSU, BGP ISSU config check failed

In-Service Software Update (ISSU)

Non-Stop forwarding during system upgrade

ISSU needs to be performed between ISSU compatible

releases Refer to release notes for more information

Active supervisor can not switchover to the standby

supervisor with active config sessions Save, commit or

abort all configuration sessions before ISSU

Active supervisor can not switchover to standby supervisor if BGP graceful restart is disabled or BGP hold timer tuned to

less than switchover time

NX-OS 4.1 release notes:

Trang 42

EPLD Upgrade

provide hardware functionalities on the I/O modules

from ISSU.

be power down during upgrade)

release notes page for more information

EPLD release notes:

http://www.cisco.com/en/US/docs/switches/datacenter/sw/4_1/epld/epld_rn.html

Trang 43

Virtual Device Context (VDC)

as the administrative VDC for other non-default VDCs

accomplish operational tasks on default VDC (example: VDC-admin instead of Network-admin)

system can be modified to “restart” or “bringdown”

Trang 44

Agenda

Case Study – Data Center Migration

Trang 45

Core2 Core1

L2 L3 L3

L2

Data Center Migration Tasks

Replace core switches with Nexus 7K

Replace aggregation switches with Nexus 7K

Implement VPC in aggregation layer

Convert port-channel in access layer to Multi-Chassis

EtherChannel (MCEC)

Deploy service switches

Trang 46

Access> (enable) set spantree mode rapid-pvst+

Access> (enable) set channelprotocol lacp <module>

Access> (enable) set port lacp-channel <port range>

Access> (enable) set port lacp-channel <port range> mode active

Access> (enable) set spantree mode rapid-pvst+

Access> (enable) set channelprotocol lacp <module>

Access> (enable) set port lacp-channel <port range>

Access> (enable) set port lacp-channel <port range> mode active

Configuration for access layer switches (CatOS)

Single-Phase Migration

Migration performed in a single maintenance window

Build-out new network (core, aggregation and service

switches) with interim access switches using same IP

address’

Perform network acceptance testing with test servers

Move devices from existing core to new core switches

Convert STP mode on access switches to RSTP

Configure 4 port MCEC on access switch to new

aggregation switches using LACP

Trang 47

Core2 Core1

L2 L3

L2

Trang 48

Multiphase Migration

Migration performed over multiple maintenance windows

Build-out new network (core, aggregation and service

switches) with interim access switches using

non-overlapping IP address’

Perform network acceptance testing with test servers

Interconnect existing core to new core using L3 links

Migrate edge connection to new core

Interconnect existing aggregation switches to one of the new aggregation switches using L2 links with MCEC

Migrate access switches to new aggregation switches (STP

mode, MCEC)

Trang 49

Core2 Core1

L2 L3

L2

Trang 50

Core1

L2 L3

L2

Trang 51

L2 L3

L2

Move Edge Devices to New Core Switches

Trang 52

L2 L3

L2

Edge1

Core2 Core1

Edge2

Connect Existing Aggregation to New Core

Trang 53

L2 L3

L2

L2 access

L3

L2 L3

Edge1

agg1b

Core2 Core1

Trang 54

L2 L3

L2

L2 access

L3

L2 L3

Edge1

agg1b

Core2 Core1

Trang 55

L2 L3

L2

agg2b agg2a

L2 access

L3

L2 L3

Edge1

agg1b

Core2 Core1

Trang 56

L2 L3

L2

Agg1a

Edge2

Agg2b Agg2a

Complete Migration

Trang 57

Hardware and Software

Core

Aggregation

1 2 3 4 5 6 7 8 9 10

N 7 K - M 1 3 2 X P - 1 2

N 7 K - S U P 1

1 2 3 4 5 6 7 8 9 10

N 7 K - M 1 3 2 X P - 1

N 7 K - S U P 1

N 7 K - M 1 3 2 X P - 1

N 7 K - M 1 4 8 G T - 1 1

N 7 K - M 1 4 8 G T - 1

N 7 K - M 1 4 8 G S - 1

N 7 K - M 1 4 8 G S - 1 1

Trang 59

Inter-Switch Links (Core)

Current

4 port L3 GEC

New

2 port L3 10GEC

Trang 60

Inter-Switch links (Aggregation)

Trang 61

agg1b agg1a

agg1b

Access2 Access1

Uplink (Access to Aggregation)

Current

Two 2-port L2 GEC uplinks One port forwarding and one blocking

New

One logical L2 MCEC Traffic hashed over MCEC

Trang 62

HSRP Pri OSPF100

HSRP Sec OSPF110 HSRP Pri OSPF100 HSRP Pri OSPF100 HSRP Sec OSPF100 HSRP Sec OSPF100

agg1b agg1a

Uplink (Aggregation to Core)

Trang 63

Current (Catalyst 6K)

Transparent mode Define VLAN locally

Off (default) Define VLAN locally

Trang 64

switchport channel-group 1 mode active

Nexus7K(config-if-range)#

no switchport channel-group 4

Trang 65

switchport switchport access vlan <vlan>

switchport mode access

6500(config-if)#

Nexus7K(config-if)#

Switchport Access

Current (Catalyst 6K)

Switchport Mode access Access VLAN

Định dạng
Số trang	103
Dung lượng	5,34 MB