HP Blade servers in Cisco Environment

[balla-zoltan]

We had an interesting scenario; The server guys are testing HP Blade technology. The HP blade chassis is connected to a pair of Nexus 5548s, which are connected to our 6509s. The ports that the HP blade chassis is connected are 10G and configured for trunking. The two Nexus 5548s are connected together and each connected to one 6509, which are then connected together. When the server guys accidentally  clicked on bridging instead of teaming they almost took the network down. The 6509s' CPUs were at 99%. They realized the issue and quickly shut the blade chassis down, however we had a brief outage. Did any one of you ever ran into this kind of situation? There is an attached file to see how the connection is among all of the parts.

Thanks

[Jerry Ye]

Typical server admin.

You need to put some spanning-tree protection mechanism like bpduguard on the edge port (connect to the HP blade servers) to protect your L2 domain. This way, if the server admin do that again and passing BPDU between its two ports, the switch will err-disable both ports.

HTH,

jerry

[balla-zoltan]

When I tried to put the bpduguard command on the port I got the message that the command is not supported on the FEX interfaces. I was able to put the spanning-tree guard loop on. The other option is that spanning-tree guard root.

[Jerry Ye · Accepted solution]

FEX? Are you talking about Nexus 2000 connected to Nexus 5596?

Nexus 2000 are all edge port, which means it has BPDU guard enabled.

Root guard is used to protect spanning-tree root. It is not really necessary for the FEX.

Can you post a topology of the network?

Regards,

jerry

[balla-zoltan]

You are right, we have Nexus 5548s and 2232 Fiber Extenders. I was on vacation when it happened. I did a bit more digging and found out that when this happened they actually plugged the blade into the 5548 directly. Thank you for oyur help.

[Jerry Ye]

No problem. Configuring bpduguard and loopguard on N5548 client facing ports should be able to protect it.

Regards,

jerry

[Lsimancek_2]

Hi - could you indentify where your guys found this check box or what type of network setup the Blade Center has? I'm about to plug the blade center in the ARs as a work around to Nexus issues but I'm concerned about this since if I plug anything bridging wise into my ARs my entire layer 2 data center network will go down and take out the business....

[Jerry Ye]

What check box are you talking about? And AR is access router? Please explain more, I am confused with your topology?

The loop in original post is not a Nexus problem, it is a classic spanning-tree issue. You have to use the spanning-tree protection machinasm like loop guard, root guard, etc. to protect your L2 spanning-tree domain.

Regards,

jerry

[Lsimancek_2]

Jerry -

I'm using my ARs to get around my access switches. The access switch is a Nexus 5548 with 2232 FEXs. But right now I'm running into the known VTP bug where the new 2 vlans I added are not being heard by the Nexus. To get around the issue and keep the project moving forward I'm going to plug the blade center into the 10 gig mod I have in the 6509 and use the ports as switch ports. The original post-er referred to within the blade center a "check box" for using bridging or teaming. My server guys can't find this and since we have little to no experience with them I'm concerned that they just aren't looking at the right spot. This is my current plan for the configuration:

interface port-channel2

description Blade Center Bay 1 -ports 1 and 2

switchport mode trunk

switchport trunk allowed vlan 1,105,107

spanning-tree port type edge trunk

spanning-tree guard root

interface Ethernet109/1/17

description Bay 1 port 1

switchport mode trunk

switchport trunk allowed vlan 1,105,107

channel-group 2 mode active

spanning-tree port type edge trunk

spanning-tree guard root

interface Ethernet109/1/18

description Bay 1 port 2

switchport mode trunk

switchport trunk allowed vlan 1,105,107

channel-group 2 mode active

spanning-tree port type edge trunk

spanning-tree guard root

[Jerry Ye]

I see. I am not a server guy and I can't answer the first question.

In the Nexus's point of view, I think you are okay since the configuration will protected against BPDU. In terms of root, I don't think it is necessary.

Regards,

jerry

[Lsimancek_2]

Normally we stick to just the edge port, the guard root is due to a certain level or paranoia - do you think the bolded part is unnecessary?

interface port-channel2

description Blade Center Bay 1 -ports 1 and 2

switchport mode trunk

switchport trunk allowed vlan 1,105,107

spanning-tree port type edge trunk

spanning-tree guard root

interface Ethernet109/1/17

description Bay 1 port 1

switchport mode trunk

switchport trunk allowed vlan 1,105,107

channel-group 2 mode active

spanning-tree port type edge trunk

spanning-tree guard root

interface Ethernet109/1/18

description Bay 1 port 2

switchport mode trunk

switchport trunk allowed vlan 1,105,107

channel-group 2 mode active

spanning-tree port type edge trunk

spanning-tree guard root

[Jerry Ye]

I don't see any bolded text.

I don't think root guard is necessary. If the blade server is configured with bridge, the port should see BPDU and the port will be errdisabled with the default behavior, edge port will enabled BPDU guard.

HTH,

jerry