vPC reaction to peer-link or peer-keepalive link failure

[Yan Tian]

Hello,

I have been struggling with reasions for the vPC reactions to the failure of peer link and keepalive link.

Cisco official docs only tells how vPC will react to those failures but never touch why.

Senario 1: peer-link down, keepalive still working

Q1: What are the reasons for Secondary switch to shutdown all its vPC member ports?

Q2: When vPC member ports on secondary switch are down, PC-B and PC-C will lose 50% of uplink BW, and PC-D will lose connection to PC-A/B/C. How these disadvantages are concerned by Cisco?

Q3: What are the detailed reactions to the comming back of peer-link. vPC domain automatically recovers without human intervention?

Q4: Why not switch to split-brain scenario (both switchese claim the primary role and working properly) in response to peer-link failure, as this ensures 100% utilization of uplink BW.

Senario 2: peer-link up and running, keepalive link down

Q1: According to the cisco official docs, it seems that nothing is affacted by this failure and the only reaction is that peer-link will act as keepalive link temporarily. So, end users will not be aware of this failure at all, Am I right?

Senario 3: both peer-link and keepalive link are down, split-brain scenario will be formed

Q1: From my perspective, the split-brain scnario is almost as fabulous as a healthy vPC domain excepte the only disadvantage is that PC-D will lose connection to PC-A. So it it not too bad, but why cisco wants to avoid it whenever possible?

Thanks in advance for any clarification.

[richbarb · Accepted solution]

Hi Tian, there is a lot of questions.

Senario 1: peer-link down, keepalive still working

Q1: What are the reasons for Secondary switch to shutdown all its vPC member ports?

Just to avoid a split-brain scenario, because you have 2 switches as the same to the rest of the network (STP point of view).

Q2: When vPC member ports on secondary switch are down, PC-B and PC-C will lose 50% of uplink BW, and PC-D will lose connection to PC-A/B/C. How these disadvantages are concerned by Cisco?

PC-D will continue to reach at the others hosts by the uplink in the secondary switch if layer 2 segment still exist. The documentation is clear about this issue: In a vpc topology maintain orphan ports isn't recommended.

Q3: What are the detailed reactions to the comming back of peer-link. vPC domain automatically recovers without human intervention?

Yes, since the vpc peer-keepalive still working at, this a default behavior.

Q4: Why not switch to split-brain scenario (both switchese claim the primary role and working properly) in response to peer-link failure, as this ensures 100% utilization of uplink BW.

A split brain scenario must be avoided at any cost, to keep the network information consistent.

Senario 2: peer-link up and running, keepalive link down

Q1: According to the cisco official docs, it seems that nothing is affacted by this failure and the only reaction is that peer-link will act as keepalive link temporarily. So, end users will not be aware of this failure at all, Am I right?

Yes, cfs still running in the peer-link.

Senario 3: both peer-link and keepalive link are down, split-brain scenario will be formed

Q1: From my perspective, the split-brain scnario is almost as fabulous as a healthy vPC domain excepte the only disadvantage is that PC-D will lose connection to PC-A. So it it not too bad, but why cisco wants to avoid it whenever possible?

The split-brain scenario is the worst case, depends how your network topology is formed. Think two switches in the network spreading the same mac address and the same bridge-id to the STP process. Think, instead hosts, you get switches running spanning-tree downstream and upstream as well, in a split-brain situation you network will create a loop.

Apologize if I wan't clear enough.

Richard

[Yan Tian]

Hello Richard,

many thanks for your reply and help. Sorry that my confusion is still not cleared.

Scenario 1 Q1: Even though we have 2 switches as the same to the rest of the network when peer-link down, I still do not see any layer 2 loop here?

Scenario 1 Q2: I think Orphan port is also a vPC member port as vPC VLAN is carried on it. So Orphan ports will also be shutdown upon the failure of peer-link, Am I right?

Scenario 1 Q4: please also outline the specific damages when split-brain scenario is activated. so far, I do not see any as well as any layer 2 loops from STP perspective.

Thanks in advance.

[Marwan ALshawi]

to add to the nice answer from Richard 5+

when the vPC peer-link is down then both vPC peers will not be seen or acting a one virtual switch to the downstream switch and this will revert back to traditional STP and may cause a potential loop as well as the downstream switch is multi homed and this will end up to L2 loops

by deactivating the secondary vPC member/access ports you get around this loop issue

orphan ports designed for this situation where they can be excluded from being shutdown in case of vPC peerlink failure 

[Yan Tian]

Hello marwanshawi,

Thanks for your input.

Why Orphan port can still work when peer-live fails? cisco book says all vPC member ports on secondary switch will be shutdown. Does Orphan port belongs to vPC member port ?

When peer-link fails, I still do not see the layer 2 loop? I do not believe that layer 2 frames that originat from downstream switch will go to vPC secondary swtich, then to vPC primary switch through keepalive link, and finally back to its origin from primary switch. Keepalive link only carries heartbeats, not MAC frames. Please clarify how the layer 2 loop is formed ?

Thanks in advance.

[Marwan ALshawi]

Put it this way regardless there will ne a loop or not the L2 will be malfunctioning

From the downstream switch you have a port channel multi homed to one virtual switch with vPC

When the peer-link down the down stream switch will see one port channel link connected to two switches which is not supported !

Hope this helps

[richbarb · Accepted solution]

By definition the orphan port can be a vpc member port or not. If you have two switches that formed a vpc domain, the recomendation says: you should connect all devices in both of them, if not connected in both is a orphan port and the traffic of this orphan will pass through peer-link sometimes.

The orphan port could be a vpc member port with one side failure/down or just a port configured in a side alone.

The split-brain scenario can causes a loop just by the fact the network isn't working properly.

[Yan Tian]

To marwanshawi,

one port-channel multi-homed to 2 vPC peer devices is supported when peer-link is online, but not supported when peer-link goes down, What are the underlying causes for this difference please ?

To Rechard,

Sorry that, from your posted pic, I still do not discover any loops. Can you please further point out the loop path in the form of a frame sending out and coming back to its origin?

Thanks in advance.

[Marwan ALshawi]

Tian,

normally if you have one switch and pair of switch upstream ( using traditional STP ) you can not create a port channel of 2x links and more in the downstream switch and multi home it to those two switches you need to virtualize to get working e.g. vss, vPC

in case of vPC peer-link down all the vPC control messages that Handel virtualizes the two switches to area as one switch to the downstream switch will be broken and the down stream switch will see both switches as 2 no 1 which will lead abnormal behavior one of them could be a loop

hope this help

[Liang Dong Chen]

I agree with Tian, if peer-link is down, there is physically no loop. But the issue is the downstream switch will receive 2 spanning-tree hello packets instead of one, and by the protocol, the switch will think there is something wrong and err-disable both the ports in port-channel. 

peer-link makes the 2 upstream switches as one so only one hello packet sent to the downstream switch. 

Maybe you can disable spanning-tree to get around this, but it's not recommended even you use vPC. 

Another major issue is usually you need HSRP on the upstream switches. if they become active-active, the destination will receive duplicated packets. 

Considering these, Cisco won't let them happen, so shuting down all ports on the secondary switch when peer-link down is required.

[vinod rathore]

If the vPC keepalive link fails first and then a peer link fails, vPC primary switch continues to be primary but the vPC secondary switch becomes the operational primary switch and keeps its vPC member ports up (this is also known as dual active scenario). This can occur when both the vPC switches are healthy but, the failure is occurred because of a connectivity issue between the switches. This situation is known as a split-brain scenario. There is no loss of traffic for existing flows but new flows can be effected as the peer link is not available, the two vPC switches cannot synchronize the unicast MAC address and the IGMP groups and therefore they cannot maintain the complete unicast and multicast forwarding table and there may be some duplicate packet forwarding.

HTH

-Vinod

[Marwan ALshawi]

Tian hope your questions answered and make sure to rate the helpful posts in this discussion

[Yan Tian]

Hello Marwanshawi,

Sorry that my last confusion about the l2 loop is still not cleared.

1. When peer-link is down, secondary peer switch will shut down all its vPC member port to avoid potential L2 loop. I would link to see an spicific example which demonstrate how l2 loop is formed as I still do not believe the loop can happen.

2. Regarding to Split-Brain scenario, we need to make every effort to avoid it because it can possibly cause l2 loop. Again My problem is that I do not see that possibility and want an exact example showing how l2 loop is formed.

Thanks

[Alcides Miguel]

Hello Richard, in my scenario I've two N5K sharing the same vPC domain but when the peer keepalive fail the switch that is accessible via mgmt0 port shutdown all the vPC's. what is going wrong in my configuration? 

Regards,

Lucas

[qasim.saeed1]

Cisco VPC Quick Configuration

https://aqlearningcenter.blogspot.com/2017/11/cisco-nexus-vpc-configuration-step-by.html

Regards,

AQ Learning Center