How to design VLAN priority when implement vPC DCI with HSRP?

[prachaya_k]

Hi All,

I am connecting 2 pair of NEXUS 9500 using vPC DCI with HSRP. I can't seem to find the detail in any document on how to set this exactly. Right now, I am a bit confusing on the VLAN priority that should be set on each pair of nexus switch. Can anyone guide me what should be the correct method to set VLAN priority on these 4 switches.

My guess is to have one pair of nexus with priority 0 and another pair with priority 4096. Or should all 4 switches have the same priority?

## I only have these 2 pair of nexus switches acting as core on each side of DC ## Other switches connecting to nexus switch are typical Cisco IOS switches

[Rick1776]

When you mean VLAN priority are you referring to spanning tree?

[prachaya_k]

Yes. That's right. Spanning tree. I know that within vpc domain (a pair of nexus) should be the same. But my question is about 2 pair doing DCI with HSRP enabled. So I am not sure about the vlan prioirity value should be between 2 pair of nexus.

[Rick1776]

So if I understand you correctly your going to extend the vpc over the DCI?

If you go to page 13 in this link is this what you are trying to achieve? Also starting on page 58 shows the configuration.
https://www.cisco.com/c/dam/en/us/td/docs/switches/datacenter/sw/design/vpc_design/vpc_best_practices_design_guide.pdf

[prachaya_k]

Hi Rick1776

Thank you for helping. After re-reading this doc once again I realize what it might be.

Reference in the doc is on page 14 and page 61 would be what I am trying to archive.

I found in the doc said: (Page 62)

●Configure root guard on vPC for DCI. STP root must remain local on each side of the data center.

           - It comes to me that it does not matter what VLAN priority I've given on those 2 pair of nexus switches because the STP root must remain local on each side of the data center.

Funny last time I configured root guard on the port channel that used for vPC DCI, the status of port members became "block" due to root guard. So I removed this command out. I guess I have to find a way to make it work somehow.

The following guideline is what I do not really understand. Can you help me clarify?

●No loop must exist outside the vPC domains

[Rick1776]

The ports facing the other dc are the port type edge or edge trunk and the ones facing inside to the aggregation and or access switches will run the spanning tree root for the vlans

[prachaya_k]

The ports facing the other dc are also enable root guard, right?

[Rick1776]

Correct.