The biggest limitation to a classic port-channel communication is that port-channel operates only between two devices. To overcome this limitation, NX-OS has a technology called virtual Port Channel (vPC). A pair of switches acting as a vPC peer endpoint look like a single logical entity to port-channel attached devices; the two devices that act as the logical port-channel endpoint are actually two separate devices. This setup has the benefits of hardware redundancy combined with the benefits offered by port-channel, e.g loop management.
A virtual port channel (vPC) allows links that are physically connected to two different Cisco Nexus 7000 Series devices to appear as a single port channel by a third device. The third device can be a switch, server, or any other networking device that supports port channels. You can use only Layer 2 port channels in the vPC. A vPC domain is associated to a single VDC, so all vPC interfaces belonging to a given vPC domain must be defined in the same VDC. You must have a separate vPC peer-link and peer-keepalive link infrastructure for each VDC deployed. Consolidating a vPC pair (two vPC peer devices of the same domain) in two VDCs of the same physical device is not supported. The vPC peer link must use 10-Gigabit Ethernet ports for both ends of the link or the link will not form.
vPC Control Plane Recommendations
For the Peer Link, it is good to use two 10GbE ports on separate line cards for resilent connectivity.
Also, for the Peer Link, make sure that the ports are in dedicated mode (not Shared).
If using the Management Interface for Peer-Keepalive traffic, the management interface should be connected to a Layer 2 management switch, not back to back.
The Peer Keepalive traffic should be over a separate keepalive link and not over the Peer Link.
vPC Member Connectivity Recommendations
Make sure to dual attach all devices into the vPC Domain.
It is good to use LACP for the Port Channels of vPC Member ports.
vPC Spanning Tree Recommendations
Check that the Spanning Tree parameters match across vPC peers in accordance with vPC requirements.
Do not use Bridge Assurance feature on vPC Member ports.
Use Bridge Assurance feature on vPC Peer Link.
Ensure all switches in the Layer 2 domain are using Rapid-PVST to avoid slow STP convergence time.
Configure Portfast on Edge ports, to avoid slow STP convergence.
vPC Layer 3 Connectivity Recommendations
Use separate layer 3 links to connect routers to the vPC Domain.
Enable Layer 3 routing between vPC peers over a separate layer 3 link.
Do not enable routing over vPC for vPC members. In the DCI environment, use HSRP tracking to ensure Layer 3 failover between Data Center.
Do not use Link tracking for HSRP, use extended Object tracking.
1. According to bug#CSCvs40360 and release notes, v4.2(6d) should support AES-256 for SNMPv3 encryption. But when I try to add SNMP User profile (screenshot), I still only have AES-128 or DES or None... OR maybe I need to specifically enabling it somewher...