Configure NXOS Switch as Layer 2 or disable inter-vlan routing

[dhau]

I'd like to disable inter-vlan routing on NXOS switches so it would act as a Layer 2 switch and would not contribute to routing. On Catalyst switches I know the method is to run "no ip routing", set up a default-gateway and it's all done. However, I can't seem to find the equivalent command for NXOS switches.

Currently the feature I have enabled is "feature interface-vlan" since I was setting up VLANs on NXOS switches and I found that this command made configuring VLANs the same process as VLANs on Catalyst switches. I found some "mac address table" commands for NXOS switches but I'm confused by them.

One of the implementations of these NXOS switches is that they'll have multiple VLANs and mostly trunk ports for allowing VM host connections. These VM hosts will need a VLAN for vMotion or vSAN processes, and various VLANs for the production VLAN that the VM guests would need to connect to. The reason for configuring the NXOS switches as a Layer 2 devices (aka disabling inter-vlan routing) is so I can perform segmentation between the VLANs.

I've seen implementations of applying access-lists to the VLANs but that seems a bit clunky. I imagine the cleaner way would be to configure the switch as a Layer 2 switch.

[marce1000]

       >.... is that they'll have multiple VLANs and mostly trunk ports for allowing VM host...
 Note that nx-os based devices (nexus) are datacenter oriented and usually not used for simple layer2 functionality , 

 M.

[Christopher Hart · Accepted solution]

Hello!

There is no command on Cisco Nexus series switches running the NX-OS network operating system to outright disable routing capabilities (inter-VLAN or otherwise). Cisco Catalyst switches running the IOS-XE network operating system have the no ip routing global configuration command to do this, but NX-OS does not have an equivalent command.

However, if you do not configure any Switch Virtual Interfaces (SVIs) for any VLANs and do not configure any routed/Layer 3 ports on the switch, then the switch will functionally operate as a Layer 2 switch and will not route traffic.

The feature interface-vlan global configuration command allows you to configure SVIs. If you do not need this, then you can safely disable the feature interface-vlan global configuration command. This will not impact your ability to create new VLANs on the switch, and it will not impact the switch's ability to act as a Layer 2 switch; it only prevents you from configuring SVIs on the switch.

I hope this helps - thank you!

-Christopher

[dhau]

Hello,

I tried that and I think that resolves my issue. I read on a different thread also and my approach will be to keep "feature interface-vlan" but run "no interface vlan #" for all VLANs except for the one that I plan on using for inline band management. That allows me to have segmentation between the VLANs while still allowing SSH to individual switches for management purposes.

I know it's possible to configure the management port and use vrf etc. to have OOB management, but for compliance reasons this will be my approach for now. I may change it in the future so all VLANs are Layer 2 with no SVI and use the management port for OOB management access.

Thanks!

Davin

[MHM Cisco World]

Only not config SVI for vlan that want Nexus be l2 for it.

No need more command

If you want to config vlan for managment that ok it will not effect NSK l2.