nexus 3k vpc with no etherchannel

[Meuserid1979]

HI expert,

im new to nexus. i would like some opinion whether the attached setup will work. no etherchannel on firewall side. what necessary config needed on nexus side. maybe somebody can lead me to a good example. thanks

thanks,

chris 

[ADP_89]

Hey Chris,

That is not going to work. The firewall cannot have two interfaces sharing the same subnet. The best thing you could do here is to add a third switch wich supports lacp. You can then connect this L2 switch via a VPC port-channel, so it will be dual-homed to both nexus. Then you can create an interface vlan on both nexus and use HSRP/VRRP to provide gateway redundancy to the firewall.

This will avoid to maintain multiple subnets, multiple gateways and hence multiple routes.

HTH,

ADP

[Meuserid1979]

hi ADP, thanks for the reply. noted on that 

[paul driver]

Hello

What is it your wanting to accomplish?
is this just the one fw or an HA pair?

[Meuserid1979]

HI paul,

it will be 2 firewalls that will be on HA as well. what i need to do is setup firewalls linking to 2xnexus 3k then will support high availability on core switch side.

[paul driver]

Hello

So basically the HA will have the exact same ip addressing apart from the primary being specified as lan primary and the secondary as lan secondary and each fw will then be connected into your core exactly the same

Primary fw
failover lan unit primary
Outside interface x/x
ip address 10.1.12.1 255.255.255.0 standby 10.1.12.2

Inside interface x/x
ip address 10.1.13.1 255.255.255.0 standby 10.1.13.2

Primary LAN FO link - x/x 172.16.1.1/30  - Standby 172.16.1.2/30
Primary Stateful FO link - x/x   172.16.2.1/30  Standby 172.16.2.1/30

Secondary fw
failover lan unit secondary

(as above)

[Meuserid1979]

Hi paul,

thanks for the reply. i have a similar setup from this below post

https://community.cisco.com/t5/switching/connecting-active-passive-palo-alto-pair-850-to-nexus-vpc-7k/td-p/3095033

i have 3 sets of non-cisco firewalls that needs to connect to nexus 3k. 1 of them is PA. if i follow the setup as what the above topic says like:

Primary PA (192.168.1.4/29) <-----> (192.168.1.2/29) (access vlanX)Primary Nexus (hsrp vip:192.168.1.1)

Secondary PA (192.168.1.5/29) <------> (192.168.1.3/29) (access vlanx)Secondary Nexus  (hsrp vip : 192.168.1.1)

will i still achieve the redundancy on the nexus portion? i.e if primary nexus goes down the secondary will take over

thanks alot!

chris