"NX OSv 9K" HSRP isolation not working on DCI link

[Jay47110]

Hi,

I'm labbing a DCI setup according to the topology diagram below. Each DC has its own VPC domain. The 9Ks act as default gateways for internal VLANs.

I want to Isolate HSRP between DCs, so I can have the same HSRP VIP active on both DCs. I am using HSRP Version 2.

I have used this Cisco Article as guide : Configure a Layer 2 vPC Data Center Interconnect on a Nexus 7000 Series Switch - Cisco
And have applied the following config for isolation:

ip access-list DENY_HSRP_IP
  10 deny udp any 224.0.0.2/32 eq 1985
  20 deny udp any 224.0.0.102/32 eq 1985 
  30 permit ip any any 

interface <DCI-Port-Channel>
  ip port access-group DENY_HSRP_IP in
  
interface Vlan <x>
  no ip arp gratuitous hsrp duplicate

Above config is applied as an "L2 port access-list" to all Nx9K DCI port-channels, but I am still seeing HSRP hellos being received across DCI. Seems like the multicast traffic is bypassing the port access-list. Could there be a restriction in Nx OSv causing this behaviour?

Kind regards

[Christopher Hart · Accepted solution]

Hi Jay!

Nexus 9000v virtual switches do not support either routed access-lists (sometimes called "RACLs") applied to an L3 interface or port access-lists (sometimes called "PACLs") applied to an L2 interface. Although the CLI may let you apply a RACL/PACL to an interface, the feature itself is not supported at this time.

You can find a full list of supported features on Nexus 9000v virtual switches under the "Nexus 9000v Feature Support" heading of the Cisco Nexus 9000v (9300v/9500v) Guide document for your relevant NX-OS software release. If a feature is not in this list, then it is not supported, and thus the feature's behavior may be unpredictable or non-functional if configured.

I hope this helps - thank you!

-Christopher

[Jay47110]

Thanks Chris,

Appreciate your help. 

Kind regards

[rais]

Ain't better to use a routing protocol?

[MHM Cisco World]

are the PO port member is Pending ??

[mlund]

Try to use passwords for the hsrp, different password for each side.