Nexus 5000 VPC, ISSU, And Bridge Assurance

[spreed]

Hello,

I'm interested in finding out if anyone has some experience with the Nexus 5000 ISSU upgrade process.  Have you found the process to work "as advertised?"  Also one of the requirements to perform a non-disruptive upgrade is to turn Bridge Assurance off.  Of course this must be done on both N5k VPC domain members, which implies that for a brief period the configurations will not match and will not meet the criteria for VPC's to exist.  Has anyone done this in a production environment with multiple VPCs?  Do the VPCs experience a hit with total loss of connectivity?  How long was the hit?

Thanks for the help,

Simon

[mizhang]

Hi Simon -

Have done some testings in the lab on ISSU with FEXes either in Active/Active and Straight-through fashion, and it works.

Disabling BA on N5K(except the vPC peer link) is one of the requirements for ISSU . 

In a lately lab testing with the following topo, BA is configured on the vpc 101 between the N5Ks and Cat6k.  We have a repeated regular ping between the SVI interfaces of c3750 and Cat6K. 

                      c3750

                         ||

                      vPC

                         ||

    N5K =====vPC====== N5K

                          ||

                     vpc 101

                          ||

                     Cat6k

When we changed the network type to disable BA, we observed some ping drops, which around 20-30.

I am not sure what your network looks like, hopefully this will give you some ideas about the ISSU.  As a general recommendation, schedule a change window for some changes or even ISSU.

regards,

Michael

[spreed]

Thanks Michael for your response!

I did open a case with Cisco TAC and the engineer did set up the lab as you describe above.  One of the other things he pointed out was that by setting the spanning-tree port type on the interface to NORMAL, this in effect turns BA off for that link.  Therefore it would be a requirement to set this port type for all links that are running BA.  He also reminded that host facing links need to be set to port type edge.  Additionally he recommended turning on spann-tree guard loop on interfaces facing the aggregation layer (in our topology.)

I will not be able to test this recommendation until July/August (2011) time frame.  When I do, I will update this discussion with my results.

Thanks again,

Simon