Nexus 9300 vPC Peer-Keepalive - Why mgmt0 instead of port-to-port in a VRF?

[KELLEYD]

I have a 93180YC-FX2 vPC pair that is soon to go into production.  I configured the vPC peer-keepalive via the management VRF, as per best practices on this single-module device.  I was then asked to move OOB to what is essentially a one-off, "kinda supported" network.  I pointed to the vPC peer-keepalive as my justification for keeping OOB on a supported production management network.  I was told that the only reason this is the recommendation is to save front panel ports, but in this case we have a lot more than we actually need.

Is this true?  Are there other reasons for this general recommendation?

Thanks!

[Sergiu.Daniluk · Accepted solution]

Hi @KELLEYD 

First, I think you have a typo in the pst, when you say " I configured the vPC peer-link via the management VRF,", which I believe you mean the peer keepalive, right?

Second, the general recommendation is to use the mgmt0 interface for PKA because: 

• this interface is not subjective to CoPP action, meaning regardless if there is a loop, broadcast storm or anything else hitting hard the CPU from the front ports, the PKA messages will reach the CPU, making the vPC peer visible and "present" in the network
• ASIC failures will not affect the PKA, which could potentially lead to split-brain scenario (when both vpc peers become operational primary)
• after a reload, the mgmt0 interface comes up faster then the front port

With this in mind, is better to have the PKA over the mgmt0 (regardless if you connect the management interface to a OOB mgmt switch, or directly between the vPC peer switches).

Hope it helps,

Sergiu

[KELLEYD]

Thank you!  I really appreciate the insight.  All of the above make perfect sense, actually.

And yes, I meant peer-keepalive.  I will correct this.