L2 configuration of Cisco Nexus 3048TP ToR switch

[Goran1085]

We are having two identical Nexus 3048TP switches configured with vPC on ports 1/49 by using 10Gbit SFP+ transceivers (SFP-10G-SR). We have a VLAN named "public" (ID 2) on ports 1-12 and we want to connect a server and configure public IP address 82.xxx.xxx.161/27, which is provided by the colocation provider and a gateway of 82.xxx.xxx.190.

What is the best configuration to utilize basic L2 switching without configuring any VLAN interfaces in L3 and setting static routes in separate VRF?

Thanks in advance. 

[balaji.bandi]

Configure Port-channel with Layer 2 with vPC and allow the VLAN in that Port-channel it can be Access VLAN 

what Server Windows ? 2 ports connect port 1 nexus 1 and pot 2 to nexus 2

here is one of my testing :

http://www.balajibandi.com/?s=vpc

[Goran1085]

We already have configured a vPC for the uplinks:

sw-core-1# sh vpc brief
Legend:
(*) - local vPC is down, forwarding via vPC peer-link

vPC domain id : 20
Peer status : peer adjacency formed ok
vPC keep-alive status : peer is alive
Configuration consistency status : success
Per-vlan consistency status : success
Type-2 consistency status : success
vPC role : primary, operational secondary
Number of vPCs configured : 1
Peer Gateway : Enabled
Dual-active excluded VLANs : -
Graceful Consistency Check : Enabled
Auto-recovery status : Enabled, timer is off.(timeout = 240s)
Delay-restore status : Timer is off.(timeout = 30s)
Delay-restore SVI status : Timer is off.(timeout = 10s)

vPC Peer-link status
---------------------------------------------------------------------
id Port Status Active vlans
-- ---- ------ --------------------------------------------------
1 Po15 up 1-2

vPC status
----------------------------------------------------------------------
id Port Status Consistency Reason Active vlans
-- ---- ------ ----------- ------ ------------
20 Po20 up success success 1

The problem is that when we try to ping the gateway or 8.8.8.8 we get error "No route to host"

Here are the VLANS:

sw-core-1# sh vlan brief

VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Po15, Po20, Eth1/19, Eth1/21
Eth1/23, Eth1/47, Eth1/48
2 wan active Po15, Eth1/1, Eth1/2, Eth1/3
Eth1/4, Eth1/5, Eth1/6, Eth1/7
Eth1/8, Eth1/9, Eth1/10, Eth1/11
Eth1/12, Eth1/47, Eth1/48

Even if we add a default route to the default VRF:

sw-core-1(config)# ip route 0.0.0.0 0.0.0.0 82.xxx.xxx.190 vrf default
sw-core-1(config)# sh ip route
IP Route Table for VRF "default"
'*' denotes best ucast next-hop
'**' denotes best mcast next-hop
'[x/y]' denotes [preference/metric]
'%<string>' in via output denotes VRF <string>

sw-core-1# ping 8.8.8.8 vrf 1
PING 8.8.8.8 (8.8.8.8): 56 data bytes
ping: sendto 8.8.8.8 64 chars, No route to host
Request 0 timed out
ping: sendto 8.8.8.8 64 chars, No route to host
^XRequest 1 timed out
ping: sendto 8.8.8.8 64 chars, No route to host
^C
--- 8.8.8.8 ping statistics ---
3 packets transmitted, 0 packets received, 100.00% packet loss

[Reza Sharifi]

sw-core-1(config)# sh ip route
IP Route Table for VRF "default"
'*' denotes best ucast next-hop
'**' denotes best mcast next-hop
'[x/y]' denotes [preference/metric]
'%<string>' in via output denotes VRF <string>

In order to ping from the switch, you need to have an IP address assigned to an SVI on the switch, if not you can't ping.

Example:

Server address 82.xxx.xxx.161/27

gateway of 82.xxx.xxx.190.

switch IP address assign to an SVI for vlan 2

82.xxx.xxx.162/27

once you assign this IP to the switch, you should be able to ping 8.8.8.8

HTH

[Goran1085]

Using an SVI would be L3 routing and we will waste one public IP unnecessary. The solution require to use L2 switching between the colo provider uplink port and the VLAN where servers will be connected. The idea is to assign all 27 public IP addresses to different server... 

[balaji.bandi]

As per discussion,  if the Pure L2 and your WAN device connected to VLAN2 then Servers are connected to VLAN2, it should work as expected since this nexus just Layer 2 forwrader.,

we are not sure how your nexus connected to the uplink provider or WAN ? 

Do you have any high-level diagram of how these nexus connected to uplink ISP?

[Goran1085]

That was our expectation too. If the colo uplink port is in the same VLAN (wan), all servers in the same VLAN will be using pure L2 switching without any L3 routing. 

The Nexus is connected via simple fiber cable on port 1/49 and is on VLAN 1, where the other server is connected too on port 1/1 and has configured public IP and the provided gateway. 

sw-core-1# sh lldp neighbor
(R) Router, (B) Bridge

ce09.lon-01.uk.xxxxxxxxx.net Eth1/49 120 BR Ethernet5

LLDP shows clearly that the neighbor is both switch and a router which means L2 should work...