Policy Base Routing on Cisco Nexus

Policy Base Routing on Cisco Nexus

1. Source to Destination routing.  all traffic going via OLD Network. Only trying to change Vlan-3 Network should route Via New Network.

2. No static route need to add on Nexus.

3. Nexus Vlan-3Interface  IP will not participate in PBR , because PBR has limitation in feature. but the other IP in Vlan-3 will route to New Network Link.

4. EIGRP is using in my OLD Network. All devices have EIGRP except in Firewalls. 

5. Firewall has only static routes.

*************************START****************************

1.       Add PBR feature in NEXUS

                         feature pbr

2.       Add NEW Networ/ VLAN in ACL for Server  65.35.12.30

                                ip access-list NEW_NET

         permit ip 10.20.3.0 0.0.0.255 host 65.36.12.30

 

3.       Create Route-map  for forward the traffic of new vlan toward new Firewall

route-map NEW_NET

                        match ip address NEW_NET

set ip next-hop 10.20.3.252             // New Firewall IP

4.       Apply on the VLAN interface on Nexus

interface vlan 3

ip policy route-map NEW_NET

5.       Remove default Route  on nexus

no ip route 0.0.0.0/0 10.20.3.252    name NEW_FW1   // Removing all static route for testing

**********************************END********************************************

Cisco Nexus 9396 with Dell M100e & Force10 MXL Blade

1. Cisco Nexus Configuration.
2. Dell Force10 MXL Blade Switch configuration.

-------------------------Network Diagram------------------------------------------

--------------------------------------------------------------------------------------------

Nexus--10.200.30.3 Config

feature telnet
feature vrrp
feature pbr
feature private-vlan
feature interface-vlan
feature lacp
feature vpc
feature lldp
feature vtp

vlan 1,97,100-101,130,970

vlan 97
  private-vlan primary
  private-vlan association 970
vlan 100
  name Servers
vlan 101
  name Management
vlan 130
  name NEW-MGMT
vlan 970
  private-vlan isolated

vrf context management
  ip route 10.200.22.32/30 10.200.22.34
vpc domain 1
  peer-keepalive destination 10.200.22.34

interface Vlan130
  description ** MGMT **
  no shutdown
  ip address 10.200.30.3/24
  ip router eigrp 100
  vrrp 100
    priority 200
    address 10.200.30.1
    no shutdown
interface port-channel101
  description ** 
  switchport mode trunk
  switchport trunk allowed vlan 1,97,100-101,130
  speed 10000
  vpc 101
interface port-channel102
  description ** **
  switchport mode trunk
  switchport trunk allowed vlan 1,100-101,130
  speed 10000
  vpc 102
interface port-channel103
  switchport mode trunk
  switchport trunk allowed vlan 1,100-101,130
  speed 10000
  vpc 103
interface port-channel104
  switchport mode trunk
  switchport trunk allowed vlan 1,100-101,130
  speed 10000
  vpc 104
interface Ethernet1/11
  description *Backup link1*
  switchport mode private-vlan trunk secondary
  switchport private-vlan trunk allowed vlan 1
  switchport private-vlan association trunk 97 970
interface Ethernet1/12
  description **
  switchport mode trunk
  switchport trunk allowed vlan 1,100-101,130
  speed 10000
  channel-group 101 mode active
interface Ethernet1/13
  description *
  switchport mode trunk
  switchport trunk allowed vlan 1,100-101,130
  speed 10000
  channel-group 101 mode active
interface Ethernet1/14
  description **
  switchport mode trunk
  switchport trunk allowed vlan 1,100-101,130
  speed 10000
  channel-group 102 mode active

interface Ethernet1/15
  description **
  switchport mode private-vlan trunk secondary
  switchport private-vlan trunk allowed vlan 1
  switchport private-vlan association trunk 97 970

interface Ethernet1/16
  description =
  switchport mode trunk
  switchport trunk allowed vlan 1,100-101,130
  speed 10000
  channel-group 104 mode active

interface Ethernet1/17
  description *2*
  switchport mode trunk
  switchport trunk allowed vlan 1,100-101,130
  speed 10000
  channel-group 104 mode active

interface Ethernet1/18
  description *1*
  switchport mode trunk
  speed 10000
  channel-group 103 mode active
interface Ethernet1/46
  description ** VPC link **
  switchport mode trunk
  speed 10000
  channel-group 50 mode active

interface Ethernet1/47
  description ** ( VPC link **
  switchport mode trunk
  speed 10000

  channel-group 50 mode active

interface mgmt0
  description **  **
  vrf member management
  ip address 10.200.22.33/30

-----------------------------End Nexus-1------------------

Nexus--10.200.30.4 Config

feature telnet

feature vrrp

feature pbr

feature private-vlan

feature interface-vlan

feature lacp

feature vpc

feature lldp

feature vtp

vlan 1,97,100-101,130,970

vlan 97

  private-vlan primary

  private-vlan association 970

vlan 100

  name Servers

vlan 101

  name Management

vlan 130

  name NEW-MGMT

vlan 970

  private-vlan isolated

vrf context management

  ip route 10.200.22.32/30 10.200.22.33

vpc domain 1

  peer-keepalive destination 10.200.22.33

interface Vlan1

interface Vlan130

  description ** MGMT **

  no shutdown

  ip address 10.200.30.4/24

  ip router eigrp 100

  vrrp 100

    address 10.200.30.1

    no shutdown

interface port-channel101

  description ** C1 **

  switchport mode trunk

  switchport trunk allowed vlan 1,97,100-101,130

  speed 10000

  vpc 101

interface port-channel102

  description ** 2 **

  switchport mode trunk

  switchport trunk allowed vlan 1,100-101,130

  speed 10000

  vpc 102

interface port-channel103

  switchport mode trunk

  switchport trunk allowed vlan 1,100-101,130

  speed 10000

  vpc 103

interface port-channel104

  switchport mode trunk

  switchport trunk allowed vlan 1,100-101,130

  speed 10000

  vpc 104

interface Ethernet1/11

 description * BACKUP LINK-1 SAN*

  switchport mode private-vlan trunk secondary

  switchport private-vlan trunk allowed vlan 1

  switchport private-vlan association trunk 97 970

interface Ethernet1/12

  description **

  switchport mode trunk

  switchport trunk allowed vlan 1,100-101,130

  speed 10000

  bandwidth inherit 1

  channel-group 102 mode active

interface Ethernet1/13

  description *1*

  switchport mode trunk

  switchport trunk allowed vlan 1,100-101,130

  speed 10000

  channel-group 102 mode active

interface Ethernet1/14

  description **

  switchport mode trunk

  switchport trunk allowed vlan 1,100-101,130

  speed 10000

  bandwidth inherit 1

  channel-group 101 mode active

interface Ethernet1/15

  description *TSM BACKUP LINK-2 SAN*

  switchport mode private-vlan trunk secondary

  switchport private-vlan trunk allowed vlan 1

  switchport private-vlan association trunk 97 970

interface Ethernet1/16

 description *W2*

  switchport mode trunk

  switchport trunk allowed vlan 1,100-101,130

  speed 10000

  bandwidth inherit 1

  channel-group 103 mode active

interface Ethernet1/17

  description *SW1*

  switchport mode trunk

  switchport trunk allowed vlan 1,100-101,130

  speed 10000

  channel-group 103 mode active

interface Ethernet1/18

  description **

  switchport mode trunk

  switchport trunk allowed vlan 1,100-101,130

  speed 10000

  bandwidth inherit 1

  channel-group 104 mode active

interface Ethernet1/46

  description **  link **

  switchport mode trunk

  speed 10000

  bandwidth inherit 1

  channel-group 50 mode active

interface Ethernet1/47

  description **( VPC link **

  switchport mode trunk

  speed 10000

  bandwidth inherit 1

  channel-group 50 mode active

interface mgmt0

  description ** Nex **

  vrf member management

  ip address 10.200.22.34/30

-----------------------------END NEXUS-2-------------------



---------DELL-MXL-Switch-1------------



nterface TenGigabitEthernet 0/1
 no ip address
 portmode hybrid
 switchport
 no shutdown
!
interface TenGigabitEthernet 0/2
 no ip address
 portmode hybrid
 switchport
 no shutdown
!
interface TenGigabitEthernet 0/3
 no ip address
 portmode hybrid
 switchport
 no shutdown
!
interface TenGigabitEthernet 0/4
 no ip address
 portmode hybrid
 switchport

interface TenGigabitEthernet 0/42
 no ip address
!!!
!!

!
 port-channel-protocol LACP
  port-channel 101 mode active
 no shutdown
!
interface TenGigabitEthernet 0/43
 no ip address
!
 port-channel-protocol LACP
  port-channel 101 mode active
 no shutdown
!
interface TenGigabitEthernet 0/44
 no ip address
!
 port-channel-protocol LACP
  port-channel 101 mode active
 no shutdown


interface Port-channel 101
 no ip address
 portmode hybrid
 switchport
 no shutdown
!
interface Vlan 1
 ip address dhcp
!untagged TenGigabitEthernet 0/1,5-17,21-32
!untagged Port-channel 101
 no shutdown
!

interface Vlan 100
 no ip address
 tagged TenGigabitEthernet 0/1,5-32
 tagged Port-channel 101
 untagged TenGigabitEthernet 0/2-4
 no shutdown
!
interface Vlan 101
 no ip address
 tagged TenGigabitEthernet 0/1-32
 tagged Port-channel 101
 no shutdown
!
!
interface Vlan 130
 ip address 10.200.30.14/24
 tagged TenGigabitEthernet 0/1-32
 tagged Port-channel 101
 no shutdown
!
interface Vlan 970
 no ip address
 tagged TenGigabitEthernet 0/1-17,21-32,41
 untagged TenGigabitEthernet 0/18-20
 no shutdown
!
ip route 0.0.0.0/0 10.200.30.1

PTC-CH1-SW1#sh vlan

Codes: * - Default VLAN, G - GVRP VLANs, R - Remote Port Mirroring VLANs, P - Primary, C - Community, I - Isolated
       O - Openflow
Q: U - Untagged, T - Tagged
   x - Dot1x untagged, X - Dot1x tagged
   o - OpenFlow untagged, O - OpenFlow tagged
   G - GVRP tagged, M - Vlan-stack, H - VSN tagged
   i - Internal untagged, I - Internal tagged, v - VLT untagged, V - VLT tagged

    NUM    Status    Description                     Q Ports
*   1      Active                                    U Po101(Te 0/42-44)
                                                     U Te 0/1,5-17,21-32
    100    Active                                    T Po101(Te 0/42-44)
                                                     T Te 0/1,5-32
                                                     U Te 0/2-4
    101    Active                                    T Po101(Te 0/42-44)
                                                     T Te 0/1-32
    130    Active                                    T Po101(Te 0/42-44)
                                                     T Te 0/1-32
    970    Active                                    T Te 0/1-17,21-32,41
                                                     U Te 0/18-20
-----------------END MXL-1-----------------------


--------DELL-MXL-Switch-2------------


interface TenGigabitEthernet 0/41
 no ip address
!
 port-channel-protocol LACP
  port-channel 102 mode active
 no shutdown
!
interface TenGigabitEthernet 0/42
 no ip address
 switchport
 no shutdown
!
interface TenGigabitEthernet 0/43
 no ip address
!
 port-channel-protocol LACP
  port-channel 102 mode active
 no shutdown
!
interface TenGigabitEthernet 0/44
 no ip address
!
 port-channel-protocol LACP
  port-channel 102 mode active
 no shutdown


interface Port-channel 102
 no ip address
 portmode hybrid
 switchport
 no shutdown



interface Vlan 1
 ip address dhcp
!untagged TenGigabitEthernet 0/1,5-17,21-32,49-56
!untagged Port-channel 102
 no shutdown
!
!
interface Vlan 100
 no ip address
 tagged TenGigabitEthernet 0/1,5-32
 tagged Port-channel 102
 untagged TenGigabitEthernet 0/2-4
 no shutdown
!
interface Vlan 101
 no ip address
 tagged TenGigabitEthernet 0/1-32
 tagged Port-channel 102
 no shutdown

!
interface Vlan 130
 ip address 10.200.30.15/24
 tagged TenGigabitEthernet 0/1-32
 tagged Port-channel 102
 no shutdown
!
interface Vlan 970
 no ip address
 tagged TenGigabitEthernet 0/1-17,21-32,42
 untagged TenGigabitEthernet 0/18-20
 no shutdown
!
ip route 0.0.0.0/0 10.200.30.1

------------------------END MXL-2------------------


--------DELL-MXL-Switch-3------------

interface TenGigabitEthernet 0/41
 no ip address
!
 port-channel-protocol LACP
  port-channel 103 mode active
 no shutdown
!
interface TenGigabitEthernet 0/42
 no ip address
!
 port-channel-protocol LACP
  port-channel 103 mode active
 no shutdown
!
interface TenGigabitEthernet 0/43
 no ip address
 switchport
 no shutdown
!
interface TenGigabitEthernet 0/44
 no ip address
!
 port-channel-protocol LACP
  port-channel 103 mode active
 no shutdown
!

!
interface ManagementEthernet 0/0
 no ip address
 shutdown
!
interface Port-channel 103
 no ip address
 portmode hybrid
 switchport
 no shutdown
!
interface Vlan 1
 ip address dhcp
!untagged TenGigabitEthernet 0/1,4,8-17,20,24-32
!untagged Port-channel 103
 no shutdown
!

!
interface Vlan 100
 no ip address
 tagged TenGigabitEthernet 0/1-32
 tagged Port-channel 103
 no shutdown
!
interface Vlan 101
 no ip address
 tagged TenGigabitEthernet 0/1-32
 tagged Port-channel 103
 no shutdown
!

!
interface Vlan 130
 ip address 10.200.30.16/24
 tagged TenGigabitEthernet 0/1,4,8-17,20,24-32
 tagged Port-channel 103
 untagged TenGigabitEthernet 0/2-3,5-7,18-19,21-23
 no shutdown
!
interface Vlan 970
 no ip address
 tagged TenGigabitEthernet 0/1-32,43
 no shutdown
!
ip route 0.0.0.0/0 10.200.30.1

------------------------END-MXL-3--------------------


--------DELL-MXL-Switch-4------------
!
interface TenGigabitEthernet 0/42
 no ip address
!
 port-channel-protocol LACP
  port-channel 104 mode active
 no shutdown
!
interface TenGigabitEthernet 0/43
 no ip address
!
 port-channel-protocol LACP
  port-channel 104 mode active
 no shutdown
!
interface TenGigabitEthernet 0/44
 no ip address
!
 port-channel-protocol LACP
  port-channel 104 mode active
 no shutdown
!


!
interface Port-channel 104
 no ip address
 portmode hybrid
 switchport
 no shutdown
!
interface Vlan 1
 ip address dhcp
!untagged TenGigabitEthernet 0/1,4,8-17,20,24-32,49-56
!untagged Port-channel 104
 no shutdown
!

!
interface Vlan 100
 no ip address
 tagged TenGigabitEthernet 0/1-32
 tagged Port-channel 104
 no shutdown
!
interface Vlan 101
 no ip address
 tagged TenGigabitEthernet 0/1-32
 tagged Port-channel 104
 no shutdown

interface Vlan 130
 ip address 10.200.30.17/24
 tagged TenGigabitEthernet 0/1,4,8-17,20,24-32
 tagged Port-channel 104
 untagged TenGigabitEthernet 0/2-3,5-7,18-19,21-23
 no shutdown
!
interface Vlan 970
 no ip address
 tagged TenGigabitEthernet 0/1-32,41
 no shutdown
!
ip route 0.0.0.0/0 10.200.30.1

--------------------------END-MXL-4-----------------

NAT and PAT on single IP

1. LAN will access the internet same WAN IP
2. Server will access outside  same WAN IP with static PAT server use port tcp / udp 9000

Router Config

interface FastEthernet0/0
 description WAN
 ip address 89.41.134.112 255.255.255.252
 ip nat outside.

interface FastEthernet0/1
 description LAN
 ip address 192.168.2.1 255.255.255.0
 ip nat inside

 ip nat inside source list 101 interface FastEthernet0/0 overload
ip nat inside source static tcp 192.168.2.5 9000 interface FastEthernet1 9000
ip nat inside source static udp 192.168.2.5 9000 interface FastEthernet1 9000

!


access-list 100 deny   ip 192.168.0.0 0.0.255.255 192.168.0.0 0.0.255.255
access-list 100 deny   ip 192.168.0.0 0.0.255.255 10.0.0.0 0.255.255.255
access-list 100 permit ip 192.168.0.0 0.0.255.255 any

 Router#sh ip nat translations
Pro Inside global                  Inside local                Outside local        Outside global
tcp  89.41.134.112 :9000    192.168.2.5 :9000    101.57.166.85:50942  101.57.166.85:50942

Top 10 high utilization traffic on cisco router

TOP  10 high traffic utilization results.
top talker result on cisco router
Top 10 high utilization traffic on cisco router
-----------------------------------------------------------
interface FastEthernet0/0
 description *** WAN Link ***
 bandwidth 3072
 ip address 79.51.100.X 255.255.255.252
 ip flow ingress
 ip flow egress
 speed 100
 full-duplex


!
ip flow-top-talkers
 top 10
 sort-by bytes


-------------------------------------------------------




Router-R1#sh ip flow top-talkers


SrcIf         SrcIPaddress    DstIf            DstIPaddress           Pr SrcP DstP            Bytes
Fa0/0         12.181.72.2     Fa0/1            69.71.200.186        32 749F 255A          3914K
Fa0/1         69.71.200.186   Fa0/0*        12.181.72.2            32 163C 4ECC        1087K
Fa0/0         69.71.202.118   Local          79.51.100.X           06 D88F 0017          936
Fa0/1         69.71.200.186   Fa0/0*        192.168.100.10      06 05F6 4261           152
Fa0/1         69.71.200.186   Fa0/0*        192.168.100.153    06 089B 2329           144
Fa0/1         69.71.200.186   Fa0/0*        192.168.100.154    06 08BD 2329          144
Fa0/1         69.71.200.186   Fa0/0*        192.168.100.151    06 09EB 2329           144
Fa0/1         69.71.200.186   Fa0/0*        192.168.100.151    06 05B3 2329           144
Fa0/1         69.71.200.186   Fa0/0*        192.168.100.151    06 09EB 2329           144
Fa0/1         69.71.200.186   Fa0/0*        192.168.100.151    06 05B3 2329            144
10 of 10 top talkers shown. 29 flows processed.
85_SanDiego#

Cisco UCS with Nexus VPC

Note:
1. Cisco UCS Mini 5108 with Fabric interconnect 6324
2. Cisco  Nexus 3000k pair.
3. Cross connection topology .
4. Only VPC configuration display
5. Only UCS link configuration shown.

------------------------------------------------------------------------------

------------------------------------Nexus Switch-1----------------------------------------------------------
CORW-NX-SW1#  sh run


feature lacp
feature vpc
feature lldp
feature vtp


interface mgmt0
  ip address 10.10.10.1/24

vrf context management
  ip route 10.10.10.0/24 10.10.10.2

vpc domain 1
  peer-keepalive destination 10.10.10.2
  peer-gateway

!
interface port-channel50
  switchport mode trunk
  spanning-tree port type network
  speed 10000
  vpc peer-link

interface port-channel101
  description ** VPC link to UCS-F1 **
  switchport mode trunk
  speed 10000
  vpc 101

interface port-channel102
  description ** VPC link to UCS-F2 **
  switchport mode trunk
  speed 10000
  vpc 102

interface Ethernet1/1
  description ** UCS-F1-1 **
  switchport mode trunk
  channel-group 101 mode active



interface Ethernet1/2
  description ** UCS-F2-1 **
  switchport mode trunk
  channel-group 102 mode active



interface Ethernet1/46
  description ** NEXUS-SW2 VPC link **
  switchport mode trunk
  channel-group 50 mode active


interface Ethernet1/47
  description ** NEXUS-SW2 VPC link **
  switchport mode trunk
  channel-group 50 mode active






-----------------------------Nexus Switch-2 -------------------------------------
CORE-NX-SW2# sh run

 feature lacp
feature vpc
feature lldp
feature vtp


vrf context management
  ip route 10.10.10.0/24 10.10.10.1


vpc domain 1
  peer-keepalive destination 10.10.10.1


interface mgmt0
  ip address 10.10.10.2/24

!
interface port-channel50
  switchport mode trunk
  spanning-tree port type network
  speed 10000
  vpc peer-link

interface port-channel101
  description ** VPC link to UCS-F1 **
  switchport mode trunk
  speed 10000
  vpc 101

interface port-channel102
  description ** VPC link to UCS-F2 **
  switchport mode trunk
  speed 10000
  vpc 102

interface Ethernet1/1
  description ** UCS-F2-P1 **
  switchport mode trunk
  channel-group 101 mode active



interface Ethernet1/46
  description ** NEXUS-SW1 VPC link **
  switchport mode trunk
  channel-group 50 mode active


interface Ethernet1/47
  description ** NEXUS-SW1 VPC link **
  switchport mode trunk
  channel-group 50 mode active



----------------------------------UCS Configuration-------------------------------------------

Configure Ports on UCS Steps

1. Select the ports individually and right click on the port.
2. Select Configure as Uplink Port.

 

Fabric -1
 . Port-1
 . Port-2

Fabric -2
 . Port-1
 . Port-2

---------------------------------------------------------------------------------- ----------

Configure Port Channel on UCS

1. Go to LAN Tab
2. Go to Fabric -A
3. Right Click on Port Channels 
4. Click on Create Port Channel 

5. Select and add ports.

 6. Finish.
7. Now select Fabric-B and apply steps (2 to 6)


Your all connect Ports should look green.

-----------------------------------------------------------------------------------------


Troubleshoot commands.

Show vpc

-CORW-NX-SW1# sh vpc consistency-parameters vpc 102

Testing on both Nexus switch and the result should be Up and success.




vPC status
----------------------------------------------------------------------------
id     Port        Status Consistency Reason                     Active vlans
------ ----------- ------ ----------- -------------------------- -----------
101    Po101       up     success     success                    1,10-14
102    Po102       up     success     success                    1,10-14