question about mgnt0 interface

[malmsteen81]

Hi, sorry for stupid question but i never used nexus switch. If i configure ip address on mgnt0 interface on 2 nexus 3000 and connect these port to cisco catalyst, when i configure and enable vpc between 2 nexus, they create a loop? 

thank you

Andrea

[marce1000]

 - Normally not, if you are looking into combined VPC-keepalive solutions have a look at the document below for advisories :

   https://community.cisco.com/t5/networking-documents/nexus-vpc-recommendations/ta-p/3130797

 M.

[malmsteen81]

hi, thanks. for keep alive i wolud use a 10Gb port on the front and not use management port

[marce1000]

 - Then you are good to go.

    M.

[Mark Malone]

as per Cisco in order of pref

Strong Recommendations:When building a vPC peer-keepalive link, use the following in descending orderof preference:

1.Dedicated link(s) (1-Gigabit Ethernet port is enough) configured as L3. Port-channel with 2 X 1G port is even better.

2.Mgmt0 interface (along with management traffic)

3.As a last resort, route the peer-keepalive link over the Layer 3 infrastructure

[malmsteen81]

ok, but now i have another question. When i power on the nexus i run the wizard and i have assigned to mgmt0 the ip address that i used to vlan 1 network subnet . I plugged the cable into a catalyst 3750 port configured on vlan1 but i can't ping and connect to ssh service on nexus switch. I saw that the mgnt0 is configured under vrf managment and i set as default ip gateway the ip address of my firewall. So it's the first time that i use nexus but how can i do to connect with these switches?

thanks

[Mark Malone]

did you set the route in the mgmt context ? are you using a mgmt switch with same vlan and the mgmt ports connected back to that switch , then use a jumphost you can connect to all the devices on the mgmt switch once there in same vlan and it can be controlled by FW too as you did by sending default traffic to it

example fo mine working setup on 9k

interface mgmt0
description OOB.TRUSTED.SERVER
vrf member management
ip address x.x.x.x/23

vrf context management
ip route 0.0.0.0/0 x.x.x.x

use

ping x.x.x.x vrf management

[malmsteen81]

hi, i have created a new vlan and subnet for mgnt interface and now i can ping and connect to ssh service. So with your experience is better to use dedicated ports for keepalive traffic or it's fine use mgnt ports connected to another switch? 

[Mark Malone]

Hi
We use dedicated on our global network on all 9ks 7ks 5ks etc and its worked fine for last 5 years at least no issues , as per Cisco doc its the most preferred by them in terms of design , we use MGMT for exactly that back door access through MGMT switch if ever required

we bond them too which is no harm if you can spare the port

interface Ethernet1/45
description vPC Keepalive Link
channel-group 100 mode active
no shutdown

[malmsteen81]

hi, i have configured the keepalive vlan/vrf and connect directly the 2 switches with a DAC cable. The configuration seems ok but i can't ping  between switches doesn't work

the configuration is 

vlan 223
name keepalive
vrf context keepalive

interface Vlan223
vrf member keepalive
ip address 192.168.23.1/24 (192.168.23.2 the second nexus)

interface Ethernet1/48
switchport access vlan 223

vPC keep-alive status : Suspended (Destination IP not reachable)
--Send status : Success
--Last send at : 2020.01.16 09:03:36 836 ms
--Sent on interface :
--Receive status : Failed
--Last update from peer : (2574) seconds, (970) msec

vPC Keep-alive parameters
--Destination : 192.168.23.2

what's wrong?

thanks

Andrea