Cisco Catalyst Virtual Switching...

Cisco Catalyst Virtual Switching System BRKCRS-2468

Roland Salinas – Technical Marketing Engineer

© 2014 Cisco and/or its affiliates. All rights reserved. BRKCRS-2468 Cisco Public

Key Objectives

Understand key benefits of a VSS network design

Understand the VSS architecture and how a VSS behaves differently than a standalone system

Understand VSS deployment best practices


Housekeeping

4

We value your feedback- don't forget to complete your online session evaluations after each session & complete the Overall Conference Evaluation which will be available online

Visit the World of Solutions

Please remember this is a 'non-smoking' venue!

Please switch off your mobile phones

Please make use of the recycling bins provided

Please remember to wear your badge at all times


Presentation Legend

5

Reference Material

Standalone Multilayer Switch

Virtual Switching System

Key Points

Layer 2 Link

Layer 3 Link


Agenda

Why VSS?

VSS Conversion Process VSS Architecture

VSS Hardware and Software Requirements

VSS High Availability Dual Active Scenarios

VSS Redundant Supervisors

VSL Bandwidth Considerations

Software Upgrades

Summary and Best Practice Recommendations

6

Why VSS ?


Current Network Challenges Traditional Enterprise Campus Multi-layer Design

8

FHRP, STP, Asymmetric

routing,

Policy Management

Extensive routing

topology, Routing

reconvergence

Single active uplink per

VLAN (PVST), L2

reconvergence Access

L2/L3

Distribution

L3 Core


Current Network Challenges Traditional Data Center Multi-layer Design

9

L2/L3 Core

L2 Access

FHRP, HSRP, VRRP

Spanning Tree

Policy Management

L2/L3 Distribution

Single active uplink per

VLAN (PVST), L2

reconvergence,

excessive BPDUs

Dual-Homed Servers to

single switch, Single

active uplink per VLAN

(PVST), L2

reconvergence


Virtual Switching System Traditional Design VSS Design

10


Virtual Switching System VSS Enterprise Campus

11

No FHRPs

No Looped topology

Policy Management

Reduced routing

neighbors, Minimal L3

reconvergence

Multiple active uplinks

per VLAN, No STP

convergence


VSS Simplifies the Configuration (Distribution Example)

Standalone Switch 1

(Coordinated Configuration)

Standalone Switch 2


VSS

(One simplified configuration)

Spanning Tree Configuration

! Enable 802.1d per VLAN spanning tree enhancements.

spanning-tree mode pvst

spanning-tree loopguard default

no spanning-tree optimize bpdu transmission

spanning-tree extend system-id

spanning-tree uplinkfast

spanning-tree backbonefast

spanning-tree vlan 2,4,6,8,10 priority 24576!









! Enable 802.1d per VLAN spanning tree enhancements

spanning-tree mode rapid-pvst



spanning-tree vlan 2-11 priority 24576

L3 SVI Configuration (sample for 1 VLAN)

! Define the Layer 3 SVI for each voice and data VLAN

interface Vlan4

description Data VLAN

ip address 10.120.4.3 255.255.255.0

no ip redirects

no ip unreachables

! Reduce PIM query interval to 250 msec

ip pim query-interval 250 msec

ip pim sparse-mode

load-interval 30

! Define HSRP default gateway with 250/800 msec hello/hold

standby 1 ip 10.120.4.1

standby 1 timers msec 250 msec 800

! Set preempt delay large enough to allow network to stabilize

before HSRP

! switches back on power on or link recovery

standby 1 preempt delay minimum 180

! Enable HSRP authentication

standby 1 authentication cisco123


interface Vlan4


ip address 10.120.4.3 255.255.255.0

no ip redirects

no ip unreachables



ip pim sparse-mode

load-interval 30


standby 1 ip 10.120.4.1



before HSRP






interface Vlan4


ip address 10.120.2.1 255.255.255.0

no ip redirects

no ip unreachables

ip pim sparse-mode

load-interval 30

SiSi SiSi

12


VSS Simplifies the Configuration (Distribution Example)

Standalone Switch 1


Standalone Switch 2


VSS

(One simplified configuration)

Spanning Tree Configuration

















! Enable 802.1d per VLAN spanning tree enhancements

spanning-tree mode rapid-pvst



spanning-tree vlan 2-11 priority 24576

L3 SVI Configuration (sample for 1 VLAN)


interface Vlan4


ip address 10.120.4.3 255.255.255.0

no ip redirects

no ip unreachables



ip pim sparse-mode

load-interval 30


standby 1 ip 10.120.4.1



before HSRP






interface Vlan4


ip address 10.120.4.3 255.255.255.0

no ip redirects

no ip unreachables



ip pim sparse-mode

load-interval 30


standby 1 ip 10.120.4.1



before HSRP






interface Vlan4


ip address 10.120.2.1 255.255.255.0

no ip redirects

no ip unreachables

ip pim sparse-mode

load-interval 30

SiSi SiSi

13


Simplifies operational Manageability via Single point of Management, Non-loop design, minimize

reliance on STP, eliminate FHRP etc

Scales system capacity with Active-Active Multi-Chassis Etherchannel (802.3ad/PAgP), no blocking

links due to Spanning Tree

Minimizes traffic disruption from switch or uplink failure with Deterministic subsecond Stateful and

Graceful Recovery (SSO/NSF)


14

Benefits Summary

Access Switch or

ToR or Blades

Server

10GE

Traditional

SiSi SiSi

VSS (Physical View)

SiSi

Serv

er

10GE

Access Switch or

ToR or Blades

802.3ad

802.3ad or

PAgP

SiSiSiSi

Server Access Switch or ToR or Blades

VSS (Logical View)

802.3ad or

PAgP 802.3ad

VSS Conversion Process


Conversion from Standalone to VSS Overview One-time Conversion Process Needed

SiSi SiSi

Start with two

standalone

systems

Both systems are

now a single VSS

Apply one-time VSS

related conversion

commands and

reload

SiSi SiSi


VSS Conversion Process Example

17

For the purposes of this explanation - let’s assume the

following setup is required…

Virtual Switch Link

T5/4

T5/5

T5/4

T5/5

Port-Channel 1 Port-Channel 2

Switch Virtual Domain #100

Switch1 Switch2


Conversion to VSS One-time CLI

18

Switch2

Router(config)#host VSS

VSS(config)#switch virtual domain 100

Domain ID 10 config will take effect only

after the exec command 'switch convert mode

virtual' is issued

VSS(config-vs-domain)#switch 1

VSS(config-vs-domain)#exit

VSS(config)#interface port-channel 1

VSS(config-if)#switch virtual link 1

VSS(config-if)#interface range tenG 5/4 - 5

VSS(config-if-range)#channel-group 1 mode on

VSS(config-if-range)#int port-channel 1

VSS(config-if)#no shutdown

VSS(config-if)#end

Router(config)#host VSS

VSS(config)#switch virtual domain 100

Domain ID 10 config will take effect only

after the exec command 'switch convert mode

virtual' is issued

VSS(config-vs-domain)#switch 2

VSS(config-vs-domain)#exit

VSS(config)#interface port-channel 2

VSS(config-if)#switch virtual link 2

VSS(config-if)#interface range tenG 5/4 - 5

VSS(config-if-range)#channel-group 2 mode on

VSS(config-if-range)#int port-channel 2

VSS(config-if)#no shutdown

VSS(config-if)#end

Switch1

1

2

3

4


vss#switch convert mode virtual

This command will convert all interface names

to naming convention "interface-type switch-

number/slot/port", save the running config to

startup-config and reload the switch.

Do you want to proceed? [yes/no]: yes

Converting interface names

Building configuration...

[OK]

Saving converted configuration to bootflash:

...

Destination filename [startup-

config.converted_vs-20071031-150039]?

AT THIS POINT THE SWITCH WILL REBOOT

Switch2

vss#switch convert mode virtual

This command will convert all interface names

to naming convention "interface-type switch-

number/slot/port", save the running config to

startup-config and reload the switch.

Do you want to proceed? [yes/no]: yes

Converting interface names


[OK]

Saving converted configuration to bootflash:

...

Destination filename [startup-

config.converted_vs-20071031-150039]?

AT THIS POINT THE SWITCH WILL REBOOT

Switch1

Conversion to VSS Con’t One-Time CLI

19

5


SWITCH CONSOLE OUTPUT

<…snip…>

System detected Virtual Switch configuration...

Interface TenGigabitEthernet 1/5/4 is member

of PortChannel 1

Interface TenGigabitEthernet 1/5/5 is member

of PortChannel 1

<…snip…>

00:00:26: %PFREDUN-6-ACTIVE: Initializing as

ACTIVE processor for this switch

Initializing as Virtual Switch ACTIVE processor

<…snip…>

00:01:19: %VSLP-5-RRP_ROLE_RESOLVED: Role

resolved as ACTIVE by VSLP

00:01:19: %VSL-5-VSL_CNTRL_LINK: New VSL

Control Link 5/4


<…snip…>

System detected Virtual Switch configuration...

Interface TenGigabitEthernet 2/5/4 is member of

PortChannel 2

Interface TenGigabitEthernet 2/5/5 is member of

PortChannel 2

<…snip…>

00:00:26: %PFREDUN-6-ACTIVE: Initializing as

ACTIVE processor for this switch

Initializing as Virtual Switch STANDBY processor

<…snip…>

00:01:02: %VSLP-5-RRP_ROLE_RESOLVED: Role

resolved as STANDBY by VSLP

00:01:02: %VSL-5-VSL_CNTRL_LINK: New VSL

Control Link 5/4

Switch1 Switch2

Conversion to VSS Con’t One-Time CLI

20


vss-demo# switch accept mode virtual interface Port-channel2

switch virtual link 2

no shutdown

interface TenGigabitEthernet2/5/4

channel-group 2 mode on

no shutdown

interface TenGigabitEthernet2/5/5

channel-group 2 mode on

no shutdown

This command will populate the above VSL configuration from

the standby switch into the running configuration.

The startup configuration will also be updated with the new

merged configuration if merging is successful.

Do you want to proceed? [yes/no]: yes Merging the standby VSL configuration...


00:11:33: %PFINIT-SW1_SP-5-CONFIG_SYNC: Sync'ing the startup

configuration to the standby Router. [OK]


<…snip…>

Copyright (c) 1986-2007 by Cisco Systems, Inc.

Compiled Wed 10-Oct-07 01:02 by chrisvan

00:02:42: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is OFF


vss-sdby>

Standby console disabled

vss-sdby>

Switch2 Switch

1

Conversion to VSS Con’t Last Critical Step (No Longer required in SXI3 or newer)

21

5



<…snip…>

vss-demo# switch accept mode virtual

This command is no longer required since

standby VSL configuration merge is done

automatically.

vss-demo#


<…snip…>


Compiled Wed 10-Oct-07 01:02 by chrisvan



vss-sdby>


vss-sdby>

Switch2 Switch1

Conversion to VSS Con’t Last Critical Step is Automated in SXI3 or newer

22

6


Both switches are now converted

with

Switch1 - VSS Active

Switch2 - VSS Hot standby

Switch 2 console is now disabled

for normal console activity…

vss-sdby>enable


vss-sdby>

Switch2 Switch1

vss# show switch virtual

Switch mode : Virtual Switch

Virtual switch domain number : 10

Local switch number : 1

Local switch operational role: Virtual Switch

Active

Peer switch number : 2

Peer switch operational role : Virtual Switch

Standby

vss#

Conversion to VSS Con’t Completed

23


VSS Control Plane Active / Standby Model

24

Switch 1 Switch 2

VSL

vss#

vss#

vss#

vss#

vss#show switch virtual




Local switch operational role: Virtual Switch Active


Peer switch operational role : Virtual Switch Standby

vss#

Switch 1 Console (Active)

vss-sdby> enable


vss-sdby>

Switch 2 Console (Standby Hot)


VSS Data Plane Active – Active

25

VSS# show switch virtual redundancy My Switch Id = 1 Peer Switch Id = 2 <snip> Switch 1 Slot 5 Processor Information : ----------------------------------------------- Current Software state = ACTIVE <snip> Fabric State = ACTIVE

Control Plane State = ACTIVE Switch 2 Slot 5 Processor Information : ----------------------------------------------- Current Software state = STANDBY HOT (switchover

target) <snip> Fabric State = ACTIVE

Control Plane State = STANDBY

VSS Architecture


VSS Architecture Concepts

Virtual Switch Domain

Virtual Switch Link

Switch 1 Switch 2

27

Active Standby Hot Control Plane (Cisco IOS Processes)

Active Active Data Plane

(Traffic Forwarding)


Virtual Switching System Architecture

28

Virtual Switch Link (VSL)

Virtual Switch Link

Port

Channel 1

Port

Channel 2

Control Link

Data Links

interface Port-channel1

no switchport

no ip address


mls qos trust cos

no mls qos channel-consistency

!


no switchport

no ip address


mls qos trust cos


Switch

1 Switch 2


Virtual Switch Link

29

VSL Header

Virtual Switch Link

Port Channel 1 Port Channel 2

Control Link

Data Links Switch 1 Switch 2

VS Header L2 Hdr L3 Hdr Data CRC

All traffic traversing the VSL link is encapsulated with a 32 byte

“Virtual Switch Header” containing ingress and egress

switchport indexes, class of service (COS), VLAN number,

other important information from the layer 2 and layer 3 header


Virtual Switch Link

30

Initialization

Pre-parse config file and bring up VSL interfaces 1

Link Management Protocol (LMP) used to track and reject Unidirectional Links, Exchange

Chassis ID and other information between the 2 switches 2

Role Resolution Protocol (RRP) used to determine compatible Hardware and Software versions

to form the VSL as well as determine which switch becomes Active and Hot Standby from a

control plane perspective

3

Virtual Switch Link

Port

Channel 1

Port

Channel 2 Switch

1

Switch

2



31

VSL Configuration Consistency Check After the roles have been resolved through Role Resolution Protocol, a Configuration Consistency

Check is performed across the VSL switches to ensure proper VSL operation. The following items

are checked for consistency:

Switch Virtual Domain ID

Switch Virtual Switch ID

Switch Priority

Switch Preempt

VSL Port Channel Link ID

VSL Port state, interfaces…

Power Redundancy mode

Power Enable on VSL cards

Note that if configurations do not match, the Hot-Standby Supervisor will revert to Route

Processor Redundancy mode, disabling all non-VSL interfaces…

Virtual Switch



32

System Bootup Sequence

Sup720-10GE

SF RP PFC

CFC or DFC Line Cards





Sup720-10GE

SF RP PFC

VSL CFC or DFC Line Cards







IOS Initialization 1 IOS Initialization 1

Pre-Parse Config 2 Pre-Parse Config 2

Bring up VSL Linecards and

VSL Ports 3 Bring up VSL Linecards and

VSL Ports 3

Run VSLP 4 Run VSLP 4

Run RRP 5 Run RRP 5

Inter-chassis SSO 6 Inter-chassis SSO 6

Run Startup Config 7 Run in SSO mode 7

VSLP

RRP ACTIVE Standby Hot


Catalyst 6500 Supervisor Uplink VSL In-band Connection

33

Reduces VSS Boot Time

Allows for the VSL ports to be brought online very early in the boot process

Applicable to both Sup720-

10G and Sup2T


VSS Output show switch virtual

34

6500-VSS#show switch virtual ?

dual-active Virtual switch dual-active information

link Virtual switch link information

redundancy vs pseudo-standby status

role Virtual switch role information

slot-map virtual slot map table

troubleshooting vs vsl troubleshooting output

Troubleshooting provides a single command to gather all VSS related

troubleshooting data, simplifies gathering data for TAC


VSS Output show switch virtual role

35

CiscoLive-A# show switch virtual role

RRP information for Instance 2

--------------------------------------------------------------------

Valid Flags Peer Preferred Reserved

Count Peer Peer

--------------------------------------------------------------------

TRUE V 1 1 1

Switch Switch Status Preempt Priority Role Local Remote

Number Oper(Conf) Oper(Conf) SID SID

--------------------------------------------------------------------

LOCAL 2 UP FALSE(N ) 100(100) ACTIVE 0 0

REMOTE 1 UP FALSE(N ) 100(100) STANDBY 928 5923

Peer 0 represents the local switch

Flags : V - Valid

In dual-active recovery mode: No

CiscoLive-A#


VSS Output

36

show switch virtual role redundancy CiscoLive-A# show switch virtual role redundancy

My Switch Id = 2

Peer Switch Id = 1

Last switchover reason = active unit removed

Configured Redundancy Mode = sso

Operating Redundancy Mode = sso

Switch 2 Slot 8 Processor Information :

-----------------------------------------------

Current Software state = ACTIVE

Uptime in current state = 1 day, 1 hour, 39 minutes

Image Version = Cisco IOS Software, s2t54 Software (s2t54-ADVENTERPRISEK9_DBG-M), Version 12.2(49)SY131.71, INTERIM SOFTWARE

Synced to CARSON_BASE_FOR_V122_50_SY_THROTTLE_121610_101313, Weekly Branch: v122_50_sy_throttle

BOOT = bootdisk:s2t54-adventerprisek9_dbg-mz.SSA.122-49.SY131.71_110421,1;

CONFIG_FILE =

BOOTLDR =

Configuration register = 0x2102

Fabric State = ACTIVE

Control Plane State = ACTIVE


-----------------------------------------------

Current Software state = STANDBY HOT (switchover target)

Uptime in current state = 1 day, 1 hour, 35 minutes

Image Version = Cisco IOS Software, s2t54 Software (s2t54-ADVENTERPRISEK9_DBG-M), Version 12.2(49)SY131.71, INTERIM SOFTWARE

Synced to CARSON_BASE_FOR_V122_50_SY_THROTTLE_121610_101313, Weekly Branch: v122_50_sy_throttle

BOOT = bootdisk:s2t54-adventerprisek9_dbg-mz.SSA.122-49.SY131.71_110421,1;

CONFIG_FILE =

BOOTLDR =






37

Traffic Forwarding Enhancements

For a VSS, Etherchannel and L3 ECMP forwarding will always favor locally attached interfaces

•Deterministic Traffic patterns

•Removes the need to send traffic over the VSL

Multichassis Etherchannel (MEC) L3 Equal Cost Multi-Path Routing (ECMP)


Review - Etherchannel Traffic Load Balancing

L4 Ports

MAC

IPSA IPDA

38


Virtual Switching System Architecture Multichassis EtherChannel (MEC)

Traditional Etherchannel

One logical link

partner, but two

physical chassis

Multichassis Etherchannel

(MEC)

39



40

EtherChannel Hash for MEC

Link 1 Link 2

Etherchannel hashing algorithms are modified in VSS to always favor locally attached

interfaces

Blue Traffic flow will

result in Link 1 in the

MEC link bundle

Orange Traffic flowwill

result in Link 2 in the

MEC link bundle

Logical

Interface

Physical

Interface

Result Bundle Hash

(RBH) Value

PO-1 T 1/1/1

PO-1 T2/1/1

Logical

Interface

Physical

Interface

Result Bundle Hash

(RBH) Value

PO-1 T 1/1/1

PO-1 T2/1/1

0,1,2,3,4,5,6,7

0,1,2,3,4,5,6,7


How Etherchannel Works

43

Show Commands

Load values assigned to each port

Hash distribution method

VSS-Sup720# show etherchannel 1 port-channel

Port-channels in the group:

----------------------

Port-channel: Po1

------------

Age of the Port-channel = 2d:21h:10m:59s

Logical slot/port = 46/1 Number of ports = 2

GC = 0x00000000 HotStandBy port = null

Passive port list = Te1/6/4 Te1/6/5

Port state = Port-channel L3-Ag Ag-Inuse

Protocol = -

Fast-switchover = disabled

Load share deferral = disabled

Ports in the Port-channel:

Index Load Port EC state No of bits

------+------+------------+------------------+-----------

0 95 Te1/6/4 On 4

1 6A Te1/6/5 On 4

Time since last port bundled: 2d:21h:08m:34s Te1/6/5

Last applied Hash Distribution Algorithm: Adaptive


EtherChannel Concepts EtherChannel Hash

vss# show etherchannel load-balance hash-result interface port-channel 120

switch 1 ip 192.168.220.10 192.168.10.10

Computed RBH: 0x4

Would select Gi1/2/1 of Po120

A command can be invoked to assist in determining which link in the bundle will be used - it can use

various hash inputs to yield an 8-bucket RBH value that will correspond to one of the port channel

members…

Note: specify switch <id> when using hash result command, if not VSS assumes switch <1> while commuting hash

results from the hardware.

44



45

Sup2T Etherchannel Load-Balance Schemes VSS2T(config)# port-channel load-balance ?

dst-ip Dst IP Addr

dst-mac Dst Mac Addr

dst-mixed-ip-port Dst IP Addr and TCP/UDP Port

dst-port Dst TCP/UDP Port

mpls Load Balancing for MPLS packets

src-dst-ip Src XOR Dst IP Addr

src-dst-mac Src XOR Dst Mac Addr

src-dst-mixed-ip-port Src XOR Dst IP Addr and TCP/UDP Port

src-dst-port Src XOR Dst TCP/UDP Port

src-ip Src IP Addr

src-mac Src Mac Addr

src-mixed-ip-port Src IP Addr and TCP/UDP Port

src-port Src TCP/UDP Port

vlan-dst-ip Vlan, Dst IP Addr

vlan-dst-mixed-ip-port Vlan, Dst IP Addr and TCP/UDP Port

vlan-src-dst-ip Vlan, Src XOR Dst IP Addr

vlan-src-dst-mixed-ip-port Vlan, Src XOR Dst IP Addr and TCP/UDP Port

vlan-src-ip Vlan, Src IP Addr

vlan-src-mixed-ip-port Vlan, Src IP Addr and TCP/UDP Port



46

Sup720 Etherchannel Load-Balance Schemes VSS(config)# port-channel load-balance ?

dst-ip Dst IP Addr


dst-mixed-ip-port Dst IP Addr and TCP/UDP Port


mpls Load Balancing for MPLS packets



src-dst-mixed-ip-port Src XOR Dst IP Addr and TCP/UDP Port


src-ip Src IP Addr


src-mixed-ip-port Src IP Addr and TCP/UDP Port




47

Catalyst 4500-E Sup7 and Catalyst 4500-X Etherchannel Load-Balance Schemes

VSS_Active(config)#port-channel load-balance ?

dst-ip Dst IP Addr






src-ip Src IP Addr




Catalyst 6500 VSS Enabled Campus Design

48

Unicast ECMP Traffic Flows

ECMP forwarding also favors locally attached interfaces

Hardware FIB inserts entries for ECMP routes using locally attached links

If all local links fail the FIB is programmed to forward across the VSL link

cr2-6500-vss#show ip route 10.121.0.0 255.255.128.0 longer-prefixes D 10.121.0.0/17

[90/3328] via 10.122.0.33, 2d10h, TenGigabitEthernet2/2/1




cr2-6500-vss#show mls cef 10.121.0.0 17 switch 1

Codes: decap - Decapsulation, + - Push Label

Index Prefix Adjacency

102400 10.121.0.0/17 Te1/2/2 , 0012.da67.7e40 (Hash: 0001)

Te1/2/1 , 0018.b966.e988 (Hash: 0002)

Four ECMP Entries

Two FIB Entries

SiSi SiSi

T1/2/1 T1/2/2

VSS Hardware and Software Requirements


VSS Is Supported on Catalyst 6500 and Catalyst 4500-E, and Catalyst 4500-X

Catalyst 6500 Catalyst 4500-E Catalyst 4500-X

Supervisors Sup2T, Sup720-10G Sup7-E, Sup7L-E

Sup8 VSS support schedule

for March CY 2014

N/A (Fixed)

Mixed/Asymmetric Chassis

Support

Yes Yes, beginning with release

3.5.0E

No, must pair using the same base

model type, either 16-port or 32-port.

Optional 8-port module is supported

Software Trains Sup2T - 12.2SY,

15.0SY, 15.1SY

3.5.0E

3.4.0SG

15.1(2)SG

3.5.0E,

3.4.0SG

Sup720-10G - 12.2SXH,

12.2SXI,12.2SXJ,

15.1SY

Quad-Sup SSO Sup2T 15.1SY1 No, Future Release N/A

Quad-Sup Uplink

Forwarding

Sup720-10G

12.2(33)SXI4

No, Future Release N/A


VSS Catalyst 6500 Hardware Requirements Supervisor Modules

51

VSS capable Supervisors

Supervisor Engine 2T

Supervisor Engine 720-10GE

VSL-capable 10GE uplinks

New forwarding engine ASICs

Interface indices and mappings allowing traffic forwarding across two chassis

MAC address learning across two chassis

VSS is not supported on Supervisor Engine 720 or other legacy Supervisor modules

VS-S720-10G-3C/XL

VS-S2T-10G/XL


VSS Hardware Requirements VSS Mode Supported Ethernet Modules with Supervisor Engine 2T*

52

Module Part # Description and DFC Option VSL Capable

WS-X6704-10G 10GE XEBPAK Fiber XENPAK Linecard with CFC No

WS-X6724-SFP 1000BASE-X Fiber SFP Linecard with CFC No


WS-X6748-GE-TX 10/100/1000 BASE-TX Linecard with CFC No

WS-X6816-10G-2T/2TXL 16 Port 10GE X2 Fiber Linecard with DFC4/DFC4XL Yes ( 4 ports in

performance mode)

WS-X6816-10T-2T/2TXL 16 Port 10GE Copper Linecard with DFC4/DFC4/XL Yes ( 4 ports in

performance mode)

WS-X6824-SFP-2T/2TXL 24 Port Fiber 1GE Linecard with DFC4/DFC4XL No

WS-X6848-SFP-2T/2TXL 48 Port Fiber 1GE Linecard with DFC4/DFC4XL No

WS-X6848-TX-2T/2TXL 48 Port Copper 1GE Linecard with DFC4/DFC4XL No

WS-X6908-10G-2T/2TXL 10 GE X2 Fiber Linecard with DFC4/DFC4XL Yes

WS-X6904-40G-2T/2TXL 4-Port 40 Gigabit Ethernet Fiber Module with DFC4 Yes

WS-X6148E-GE-45AT 48-Port 10/100/1000 Ethernet Module with EPoE Support No

* Check the Release Notes to verify minimum software required


VSS Hardware Requirements VSS Mode Service Module Support with Supervisor Engine 2T

53

Module Description VSS Minimum

Software

Service Module

Minimum Software

ACE30-MOD-K9 ACE20-MOD-K9

Application Control Engine (ACE) 15.0(1)SY A5(1.1)

WS-SVC-FWSM-1-K9 Firewall Services Module (FWSM) 12.2(50)SY 4.0(4)

WS-SVC-ASA-SM1-K9 ASA Services Module 15.0(1)SY 8.5(1.7)

WS-SVC-IDSM2-K9 Intrusion Detection System Services Module (IDSM-2)

Not Supported in

VSS Mode

Not supported in VSS

mode

WS-SVC-NAM-1

WS-SVC-NAM-2

WS-SVC-NAM3-6G-K9

Network Analysis Module (NAM1) Network Analysis Module (NAM2) Network Analysis Module (NAM3)

12.2(50)SY

15.0(1)SY1

3.6(1a)

5.0

WS-SVC-WISM-1-K9 Wireless Services Module (WiSM) 12.2(50)SY 3.2.171.6

WS-SVC-WISM2-1-K9

WS-SVC-WISM2-3-K9

WS-SVC-WISM2-5-K9

Wireless Services Module 2 (WiSM2)

15.0(1)SY 7.0 MR1 ver 7.0.116.0


VSS Hardware Requirements VSS Mode Supported Ethernet Modules with Supervisor Engine 720-10G*

54

Module Part # Description and DFC Option VSL Capable

WS-X6704-10G 10GE XENPAK Fiber XENPAK Linecard with CFC No

WS-X6708-10G 10GE X2 Fiber Linecard with DFC3C/DFC3CXL Yes



WS-X6748-GE-TX 10/100/1000 BASE-TX Linecard with CFC No

WS-X6716-10G-2T/2TXL 16 Port 10GE X2 Fiber Linecard with DFC3C/DFC3CXL Yes ( 4 ports in

performance mode)

WS-X6716-10T-2T/2TXL 16 Port 10GE Copper Linecard with DFC3C/DFC3C/XL Yes ( 4 ports in

performance mode)

WS-X6724-SFP-2T/2TXL 24 Port Fiber 1GE Linecard with DFC3C/DFC3CXL No

WS-X6748-SFP-2T/2TXL 48 Port Fiber 1GE Linecard with DFC3C/DFC3CXL No

WS-X6748-TX-2T/2TXL 48 Port Copper 1GE Linecard with DFC3C/DFC3CXL No



VSS Hardware Requirements VSS Mode Service Module and SIP Module Support with Supervisor Engine 720-10G

55

Module Description VSS Minimum

Software

Service Module

Minimum Software

ACE10/ACE 20-6500-K9 Application Control Engine (ACE) 12.2(50)SXI A2(1.2)

WS-SVC-FWSM-1-K9 Firewall Services Module (FWSM) 12.2(33)SXI 4.0(4)

WS-SVC-IDSM2-K9 Intrusion Detection System Services Module (IDSM-2)

Not supported in

VSS mode

Not supported in

VSS mode

WS-SVC-NAM-1

WS-SVC-NAM-2

WS-SVC-NAM3-6G-K9

Network Analysis Module (NAM1) Network Analysis Module (NAM2) Network Analysis Module (NAM3)

12.2(33)SXH1

12.2(33)SXJ1

3.6(1a)

5.0

WS-SVC-WISM-1-K9 Wireless Services Module (WiSM) 12.2(33)SXI 3.2.171.6

7600-SIP-400 SPA Interface Processor 400 12.2(33)SXI4 N/A



VSS Hardware Requirements System PFC Mode Matrix

56

Linecard Type

Sup720-10G

(Standalone)

System wide PFC

Mode

DFC4 Not Supported

DFC3C PFC3C

DFC3B PFC3B*

DFC3A PFC3A*

DFC2 Not Supported

CFC PFC3C

Classic PFC3C

Sup720-10G

(VSS)

System wide PFC

Mode

Not Supported

PFC3C

Not Supported

Not Supported

Not Supported

PFC3C

Not Supported

Sup2T

(Standalone)

System Wide PFC

Mode

PFC4

Not Supported

Not Supported

Not Supported

Not Supported

PFC4

(6700-series)

6148 Series

Sup2T

(VSS)

System Wide PFC

Mode

PFC4

Not Supported

Not Supported

Not Supported

Not Supported

PFC4

(6700-series)

WS-X6148E-GE-45AT

(only)


VSS Hardware Requirements

Module Description # VSL-Ports 10GE

(capable)

VS-S2T-10G/XL Supervisor Engine 2T 2

WS-X6904-40G-2T/2TXL 4-Port 40 Gigabit Ethernet Fiber Module with DFC4 4-40G / 16-10G

WS-X6908-10G-2T/2TXL 10 GE Linecard 8

WS-X6816-10G-2T/2TXL 16 Port 10GE X2 Fiber Linecard with DFC4/DFC4XL Yes ( 4 ports in performance mode)

WS-X6816-10T-2T/2TXL 16 Port 10GE Copper Linecard with DFC4/DFC4/XL Yes ( 4 ports in performance mode)

Catalyst 6500 VSL Capable Interfaces

57

Virtual Switch

Domain

Virtual Switch Link

(VSL)

Switch 1 Switch 2

VS-S720-10G-3C/XL Supervisor Engine 720-10GE 2

WS-X6708-10G-3C/XL 10 GE Linecard 8

WS-X6716-10G-3C/XL 16 Port 10GE X2 Fiber Linecard with DFC3C/DFC3CXL 4 (Performance mode)

WS-X6716-10T-3C/XL 16 Port 10GE Copper Linecard with DFC3C/DFC3C/XL 4 (Performance mode)


Catalyst 4500-E and Catalyst 4500-X VSS Support

Software support begins with IOS XE 3.4.0SG

All 10G and 1G ports supported as VSL ports (Etherchannel rules apply, all ports must be either 10G or all 1G)

58

Catalyst 4500-E Series Catalyst 4500-X Series


Catalyst 4500E and 4500X VSS Support Matrix

59

Hardware Chassis Supervisor Modules

Catalyst 4500E 4503+E

4506+E

4507+E

4510R+E

Sup7E

Sup7LE

WS-X4748-RJ45+V

WS-X4712-SFP+E

WS-X4748-UPOE+E

WS-X4748-RJ45-E

WS-X4606-X2-E

WS-X4648-RJ45V-E

WS-X4648-RJ45V+E

WS-X4648-RJ45-E

WS-X4640-CSFP-E

WS-X4624-SFP-E

WS-X4612-SFP-E

Catalyst 4500X WS-C4500X-32SFP+

WS-C4500X-F-32SFP+

WS-C4500X16SFP+

WS-C4500X-F-16SFP+

WS-C4500X-24X-IPB

WS-C4500X-40X-ES

WS-C4500X-24X-ES

- C4KX-NM-8SFP+

All supported 4500E series modules are VSL capable

Legacy modules WS-45XX and WS-42XX are not supported


Catalyst 4500-E and Catalyst 4500-X VSS Software License Requirements

60

Catalyst 4500-E Series Catalyst 4500-X Series

Platform LAN Base IP Base Enterprise

Services Lite

Enterprise

Services

Catalyst 4500E

(Sup7E) N/A

Catalyst 4500E

(Sup7L-E) N/A

Catalyst 4500-X N/A N/A

Catalyst 4500-X LE *

Q1CY13 N/A N/A


VSS Feature Comparison: Cat4500E/X vs Cat6500

Capability Catalyst 6500 Catalyst 4500E/X Phase I

3.4xSG – Now shipping)

Catalyst 4500E/X Phase II

3.5.0E

Quad-sup VSS SSO Yes No No

Quad Sup Forwarding Uplinks Yes No Yes

Switchport-based Multi-chassis EC Yes Yes Yes

Routed Port Multi-chassis EC Yes No Yes

Split Brain Detection method Fast Hello, EPAgP EPAgP Fast Hello , EPAgP

Cross-chassis NSF/SSO Yes Yes Yes

Cross-chassis ISSU Yes Yes Yes

PoE LC support in VSS Yes Yes Yes

Asymmetric chassis (VSS between

different slot E-chassis or base model

X-series) Yes No Yes

Smart Install Director w/VSS Yes No (Standalone only)

Yes


Catalyst 4500 Series Feature Differences Between Standalone and VSS mode

Features Standalone VSS

UniDirectional Ethernet & UniDirectional

Link Routing Yes No

Connectivity Fault Management D8.1 Yes No

Resilient Ethernet Protocol and

associated features Yes No

Flexlinks Yes No

PVL,L2PT, Fast UDLD Yes No

WCCP - needs SSO compliance Yes No

Dot1q Tunnel (Legacy dot1q tunnel) Yes No

Vlan Translation (1:1, 1:2-Selective QinQ) Yes No

Mediatrace and Metadata – needs SSO

compliance Yes No

MACsec on VSL ports Yes No

EnergyWise Yes No


VSS Support with Catalyst 6800-series

63

Header 6807-XL 6880-X

VSS Support

VSS Quad-Sup SSO Not Applicable

Instant Access (IA) Future Release (March 2014)

Instant Access with VSS Quad-Sup SSO

Future Release Not Applicable


Always Verify Supported Hardware with Software Release Notes

Catalyst 6800/6500/4500 modular platforms are designed for very long product lifecycles

Investment Protection is a key design criteria

Overtime older hardware support is not carried forward with the newest software releases in order to minimize complexity, optimize performance, increase feature velocity or all of the above

New features are sometimes phased in with only the most relevant hardware support in the initial release

64

Before every deployment always read the Release Notes for the planned software release and check the Supported Hardware section to verify all components are supported.

High Availability


Virtual Switch Hot Standby

Virtual Switch Active


Virtual Switch Active incurs a supervisor outage

1

VSS Node Failure Protection Relies on SSO and NSF

66

Virtual Switch Active 2 Standby Supervisor takes over as Virtual switch Active

Virtual Switch Standby initiates graceful

restart Non Stop forwarding of packets will

continue using hardware entries as Switch-2 assumes active role

NSF aware neighbors exchange updates

with Virtual Switch Active

SiSi


VSS#config t

VSS(config)#router ospf 1

VSS(config-router)#nsf

VSS#show ip ospf

Routing Process "ospf 10" with ID 192.168.2.1

Start time: 00:15:29.344, Time elapsed: 23:12:03.484

Supports only single TOS(TOS0) routes

External flood list length 0

Non-Stop Forwarding enabled IETF NSF helper support enabled

Cisco NSF helper support enabled

Reference bandwidth unit is 100 mbps

High Availability NSF/SSO or Graceful Restart Configuration

67

Non Stop Forwarding or Graceful Restart configuration is required to maintain forwarding along last known good paths

Configuration is L3 routing protocol dependant

Example : OSPF Configuration


VSS Link Failure Protection Failure of MEC member – Upstream Traffic

68

SiSi SiSi

Convergence is determined by Access device link fail detection and Etherchannel convergence

Etherchannel convergence - typically 200ms

Typically only the flows on the failed link are effected

es dependiente de ese dispositivo


SiSi SiSi Convergence is determined by VSS

VSS Etherchannel convergence

Typically Sub - 200ms

Only the flows on the failed link are effected

VSS Link Failure Protection Failure of MEC member – Downstream Traffic

69

Dual-Active Scenarios


Dual-Active What is Dual-Active

71

VSS Active VSS Standby VSS Active

Port Channel

Port Channel

Dual-Active control plane scenario must be avoided. Multiple

methods available to detect and recover from this remote possibility

VSL


Dual- Active Scenario Three Phases to Restoration

72

Detection

– Enhanced PAgP

– Fast Hello

1

Active Active Recovery Active

• Recovery

‒ Admin down ports

‒ Recover the VSL

2

Standby Active

• Restoration

‒ VSL functional

‒ Reload recovery

chassis

3

Recommendation - Configure a minimum of two dual-active detection sessions (same or

different methods)


Dual-Active Detection - Option 1 Enhanced PAgP

73


Port Channel

Port Channel

VSL

%DUAL_ACTIVE-SW1_SP-1-DETECTION: Dual-active condition detected: all non-

VSL and non-excluded interfaces have been shut down

Trusted Port Channel for Dual-

Active Detection

Supported on Catalyst 6500,

Catalyst 4500-E, Catalyst 4500-X


Enhanced PAgP How it Works – Normal Operation

74

SiSi

Switch 2

Switch 1

Active

Standby

EPAgP

Peer

VSL

VSS

Trusted Port-Channel

configuration for dual-active

detection




VS

L

Enhanced PAgP How it Works – Dual-active detection

75

SiSi

Switch 2

Switch 1

Active

Standby

EPAgP

Peer

VSS

Active






Dual-Active Scenario Enhanced PAgP Configuration and Monitoring

76

switch virtual domain 100

dual-active detection pagp

dual-active detection pagp trust channel-group

20

dual-active detection pagp trust channel-group

25

vss01 #show switch virtual dual-active pagp

PAgP dual-active detection enabled: Yes

PAgP dual-active version: 1.1

Channel group 20 dual-active detect capability w/nbrs

Dual-Active trusted group: Yes

Dual-Active Partner Partner

Partner

Port Detect Capable Name Port

Version

Te1/3/5 Yes SW101 Te1/0/1 1.1

Te2/3/5 Yes SW101 Te1/0/2 1.1

Channel group 25 dual-active detect capability w/nbrs

Dual-Active trusted group: Yes

Dual-Active Partner Partner

Partner

Port Detect Capable Name Port

Version

Te1/3/4 No SW103 Te5/1 N/A

Te2/3/4 No SW103 Te6/1 N/A

Supported on Catalyst 6800, 6500,



Dual-Active Detection – Option 2 Detection Method – Fast Hello

77


Port Channel

Port Channel

VSL



VSLP Fast Hello


6500

Future Support on Catalyst

4500-E, Catalyst 4500-X


Fast Hello How it Works – Normal Operation

78

SiSi

Switch 2

Switch 1

Active

Standby

VSL

VSS Dedicated Heartbeat

Link for Fast Hello

session

Supported on Catalyst 6500




Fast Hello How it Works - Dual-active Detection

79

SiSi

Switch 2

Switch 1

Active

Standby

VS

L

VSS Dedicated Heartbeat

Link for Fast Hello

session



Supported on Catalyst 6500




Dual-Active Scenario Fast Hello Configuration and Operation

80

vss-switch1#show switch virtual dual-active fast-

hello

Fast-hello dual-active detection enabled: Yes

Fast-hello dual-active interfaces:

Port Local State Peer Port Remote State

---------------------------------------------------

Gi1/2/3 Link up Gi2/2/3 Link up

switch virtual domain 100

dual-active detection fast-hello

interface GigabitEthernet1/2/3

description “to VSS-SW2 gi2/2/3”

no switchport

no ip address

dual-active fast-hello

!

interface GigabitEthernet2/2/3

description “to VSS-SW1 gi1/2/3”

no switchport

no ip address

dual-active fast-hello


Dual-Active Recovery

81

VSS Active VSS Active

Port Channel

Port Channel



VSLP Fast Hello

Recovery Mode

Recovery Mode - Previously Active

switch will administratively down all of

it’s interfaces and attempt to recover

the VSL


Dual-Active Restoration

82

VSS Active

Port Channel

Port Channel

VSLP Fast Hello

Recovery Mode VSL

Chassi

s

Reload

VSS Standby


Enhanced PAgP

Hot Standby Active

Switch 1 Switch 2

VSLP VSLP

Switch 1 Switch 2

Hot Standby Active

VSLP Fast Hello Requires ePAgP capable

neighbor : 3750: 12.2(46)SE

4500: 12.2(44)SE

6500: 12.2(33)SXH1

Direct L2 Connection

Requires 12.2(33)SXI

Sub-second convergence

Sub-second convergence

High Availability Dual-Active Protocols

83

ePAgP Client Catalyst Systems

Catalyst 2960 *

Catalyst 3560X

Catalyst 3750X *

Catalyst 3850 **

Catalyst 4500E

Catalyst 4500X

Catalyst 6500E

* Cisco Catalyst 2960 FlexStack and 3750X StackWise-Plus cross-stack do

not support ePAgP

** Cisco Catalyst 3850 StackWise-480 cross-stack supports ePAgP


High Availability Dual-Active Detection – Exclude Interfaces

84

Upon detection of a Dual Active scenario, all interfaces on the

previous-Active switch will be brought down so as not to disrupt

the functioning of the remainder of the network.

The “exclude interfaces” include VSL port members as well as any pre-

configured ports which may be used for management purposes…

vs-vsl#conf t

Enter configuration commands, one per line. End with CNTL/Z.

vs-vsl(config)#switch virtual domain 100

vs-vsl(config-vs-domain)#dual-active exclude interface Gig 1/5/1

vs-vsl(config-vs-domain)#dual-active exclude interface Gig 2/5/1

vs-vsl(config-vs-domain)# ^Z

vs-vsl#


High Availability Dual Active: Recovery Mode

85

Important ! Do not make any configuration changes while in the Dual

Active Recovery mode.

Switch 1 Switch 2

VSL

Recovery Active

If the config is changed the

system will not automatically

recover once the VSL

becomes active again

One must issue the “write

memory” command and then

reload the switch in recovery

mode using the “reload shelf”

command

VSS Supervisor Engine Redundancy


Why Do We Need In-Chassis Supervisor Redundancy with VSS?

Redundancy

– Maintain 100% forwarding capacity of the VSS after a Supervisor failure event

Resiliency

– Automate recovery of a failed Supervisor

– Increase availability for single-attached devices Service Modules are single attached devices

87


Control Plane Standby

Data Plane Active

VSS Single Sup Operation and Availability

SiSi

SiSi

VSS

Control Plane Active

Data Plane Active

100%

50%

Availab

le

Ban

dw

idth

Time

88


VSS Single Sup Operation Sup Fail Example

SiSi

SiSi

VSS


Data Plane Active Control Plane Active

Data Plane Active


Data Plane Active

100%

50%

Availab

le

Ban

dw

idth

Time

89


VSS Single Sup Operation Sup Fail Manual Repair Example

SiSi

SiSi

VSS Control Plane Standby

Data Plane Active Control Plane Standby

Data Plane Active Control Plane Active

Data Plane Active

100%

50%

Availab

le

Ban

dw

idth

Time

Lose 50 % Capacity until repaired

Undeterministic recovery time

Severe impact to any single–attached devices

90

VSS Quad-Sup SSO Catalyst 6500 Sup2T Only

Beginning with Release

15.1(1)SY1


VSS Supervisor Redundancy Sup2T Quad-Sup SSO (VS4O)

Automated Recovery

Sub-second convergence for single attached devices

SSO Redundancy

SiSi

SiSi


(Chassis)

Data Plane Active


Data Plane Active


Data Plane Active


(Chassis)

Data Plane Active


Data Plane Active

100%

50%

Availab

le

Ban

dw

idth

Time

50ms – 200ms


Data Plane Active

Sup2T Only

15.1.(1)SY1

95


VSS Redundancy Modes and Terminology

VSS Domain

In Chassis Active

(ICA)

In Chassis Standby (ICS)

In Chassis Active

(ICA)

In Chassis Standby

(ICS)

Role Resolution Protocol VSS Active VSS Standby

VS Switch ID 1 VS Switch ID 2

Sup2T Only

15.1.(1)SY1

V

SL

96


In Chassis

Redundancy

Domain

In Chassis

Redundancy

Domain

VSS Quad-Sup SSO Redundancy Domains

VSS Domain

In Chassis Active

(ICA)


In Chassis Active

(ICA)

In Chassis Standby

(ICS) VS Switch ID 1 VS Switch ID 2

Default Redundancy Domain (relacion)

SSO (syncronizar) VSS Active VSS Standby

SSO SSO

Sup2T Only

15.1.(1)SY1

97


In Chassis

Redundancy

Domain

In Chassis

Redundancy

Domain

VSS Quad-Sup SSO Redundancy Domains

VSS Domain

In Chassis Active

(ICA)


(Standby Hot Chassis)

In Chassis Active

(ICA)

In Chassis Standby

(ICS)

(Standby Hot Chassis) VS Switch ID 1 VS Switch ID 2

Default Redundancy Domain (relacion)

SSO VSS Active (Active)

VSS Standby Hot (Switchover Target)

SSO SSO

Sup2T Only

15.1.(1)SY1

98


VSS Quad Sup SSO Switchovers (First Switchover Example)

In Chassis

Redundancy

Domain

In Chassis

Redundancy

Domain

VSS Domain

In Chassis Active

(ICA)


(Standby Hot Chassis)

In Chassis Active

(ICA)

In Chassis Standby

(ICS)


Default Redundancy Domain

SSO VSS Active (Active)


SSO SSO

VSS Active (Active)


In Chassis Active

(ICA)

Sup2T Only

15.1.(1)SY1

99


Default Redundancy Domain

VSS Quad Sup SSO Switchovers (Second Switchover Example)

In Chassis

Redundancy

Domain

VSS Domain

In Chassis Active

(ICA)

In Chassis Standby

(ICS)


SSO

SSO

VSS Active (Active)


In Chassis Active

(ICA)

VSS Active (Active)


In Chassis Active

(ICA)

Sup2T Only

15.1.(1)SY1

100


ICS

VSS Quad-Sup “Z” Pattern Switchovers

Switchover of the VSS Active is always across chassis

Default redundancy domain is responsible for the VSS Active and Standby determination

VSS Active VSS Hot Standby

ICS ICS

VSS Active

VSS Hot Standby

ICS

ICS VSS Active VSS Hot Standby

ICS ICS

VSS Active

VSS Hot Standby

ICS


ICS ICS

T1

T1

T2

T2

T3

T3

T4

T4 T5

T5

SW1 SW2 SW3 SW4

Sup2T Only

15.1.(1)SY1

101


ICS

VSS Quad-Sup “Z” Pattern Switchovers

Switchover of the VSS Active is always across chassis

Default redundancy domain is responsible for the VSS Active and Standby determination

VSS Active VSS Hot Standby

ICS ICS

VSS Active

VSS Hot Standby

ICS


ICS ICS

VSS Active

VSS Hot Standby

ICS


ICS ICS

T1

T1

T2

T2

T3

T3

T4

T4 T5

T5

SW1 SW2 SW3 SW4

Sup2T Only

15.1.(1)SY1

102


VSS Quad-Sup SSO Supervisor Fail Event - Dataplane Convergence

SiSi

SiSi

SSO

100%

50%

Availab

le

Ban

dw

idth

Time

50ms – 200ms

SW1 North-South Traffic Convergence

100%

50%

Availab

le

Ban

dw

idth

Time

SW2 North-South Traffic Convergence

SW1 SW2

Sup2T Only

15.1.(1)SY1

Outage on the affected switch is dependant upon Ingress-egress ports port relation – local or across fabric

Linecard fabric switchover capabilities

103


Line Card Dataplane Switchover Dependencies – Local switched – Linecard Architecture

SiSi

SiSi

Sup2T Only

15.1.(1)SY1

104


Line Card Dataplane Switchover Dependencies (Cross-fabric)

Traffic between interfaces (T2/1/1 <> T2/2/2) is affected by the Sup switchover event

Active-to-Standby fabric convergence (Sup-slot5 > Sup slot6)

Actual convergence depends on the line card capabilities

WS-X6908-10G

WS-X6848-SFP

Sup2T

Sup2T

WS-X6908-10G

WS-X6848-SFP

SiSi

SiSi

T2/1/1

T2/2/1

SSO

VSS Switch ID 2

Sup2T Only

15.1.(1)SY1

105


Line Card Data Plane Switchover Backplane Fabric Channels Affect on Cross Module Traffic

106

Active

Supervisor

Standby

Supervisor

(ICS)

Line card Line card

Slot 5 Slot 6

Slot 1 Slot 2

C6506

Before Switchover


Line Card Data Plane Switchover Backplane Fabric Channels Affect on Cross Module Traffic

107

Active

Supervisor

Standby

Supervisor

(ICS)

Line card Line card

Slot 5 Slot 6

Slot 1 Slot 2

Active

Supervisor

Line card Line card

Slot 6

Slot 1 Slot 2

C6506 C6506

Before Switchover After Switchover


Catalyst 6500 Linecard Support hotSync Fabric and Fast-HW Notification

Linecard Model# hotSync Standby

Fabric

Fast-HW

Notification

6900-series Yes Yes

6800-series 10G Yes Yes

6700-series 10G Yes Yes

6704-10G Yes No

6800-series 1G Yes No

6700-series 1G Yes No

Classic N/A No

Sub-50ms

Convergence

108


Linecard Dataplane Switchover hotStandby Fabric Support

VSS4Sup#show fabric status sw 1

slot channel speed module fabric hotStandby

status status support

1 0 40G OK OK Y(hot)





5 0 20G OK OK N/A

5 1 20G OK OK N/A

6 0 20G OK OK N/A

6 1 20G OK OK N/A

WS-X6908-10G

WS-X6748-TX

WS-X6748-SFP

Sup2T

Sup2T

Sup2T Only

15.1.(1)SY1

109


Line Card Dataplane Switchover Dependencies (local switched)

Traffic between interfaces (T2/1/1 <> T2/1/2) is NOT affected by the Sup switchover event

Traffic between all local ports on the line card experiences no frame loss

WS-X6908-10G

WS-X6848-SFP

Sup2T

Sup2T

WS-X6908-10G

WS-X6848-SFP

SiSi

SiSi

T2/1/1

T2/1/2

SSO

VSS Switch ID 2

Sup2T Only

15.1.(1)SY1

110


Line Card Data Plane Switchover Backplane Fabric Channels Affect on Local Traffic

111

Active

Supervisor

Standby

Supervisor

(ICS)

Line card Line card

Slot 5 Slot 6

Slot 1 Slot 2

C6506

Before Switchover


Line Card Data Plane Switchover Backplane Fabric Channels Affect on Local Traffic

112

Active

Supervisor

Standby

Supervisor

(ICS)

Line card Line card

Slot 5 Slot 6

Slot 1 Slot 2

Active

Supervisor

Line card Line card

Slot 6

Slot 1 Slot 2

C6506 C6506

Before Switchover After Switchover


VSS Quad-Sup Viewing Redundancy Status vis CLI

VSS4Sup#show switch virtual redundancy

My Switch Id = 1

Peer Switch Id = 2

Last switchover reason = user forced

Configured Redundancy Mode = sso

Operating Redundancy Mode = sso


-----------------------------------------------

Current Software state = ACTIVE

Uptime in current state = 2 days, 18 hours, 15 minutes

Image Version = Cisco IOS Software, s2t54 Software (s2t54-ADVIPSERVICESK9-M), Version 15.1(1)WIA111.90, EARLY DEPLOYMENT ENGINEERING

WEEKLY BUILD, synced to V122_49_YST273_111_101108


Compiled Tue 02-Oct-12 14:34 by integ

BOOT = bootdisk:s2t54-advipservicesk9-mz.SSA.150-1.WIA111.90,1;

CONFIG_FILE =

BOOTLDR =



Control Plane State = ACTIVE


-----------------------------------------------

Current Software state = STANDBY HOT (CHASSIS)


Image Version = Cisco IOS Software, s2t54 Software (s2t54-ADVIPSERVICESK9-M), Version 15.1(1)WIA111.90, EARLY DEPLOYMENT ENGINEERING

WEEKLY BUILD, synced to V122_49_YST273_111_101108




CONFIG_FILE =

BOOTLDR =





-----------------------------------------------

Current Software state = STANDBY HOT (switchover target)


Image Version = Cisco IOS Software, s2t54 Software (s2t54-ADVIPSERVICESK9-M), Version 15.1(1)WIA111.90, EARLY DEPLOYMENT ENGINEERING WEEKLY

BUILD, synced to V122_49_YST273_111_101108




CONFIG_FILE =

BOOTLDR =





-----------------------------------------------

Current Software state = STANDBY HOT (CHASSIS)


Image Version = Cisco IOS Software, s2t54 Software (s2t54-ADVIPSERVICESK9-M), Version 15.1(1)WIA111.90, EARLY DEPLOYMENT ENGINEERING WEEKLY

BUILD, synced to V122_49_YST273_111_101108




CONFIG_FILE =

BOOTLDR =




VSS4Sup#

Sup2T Only

15.1.(1)SY1

113


VSS Quad-Sup File Systems Copying Image Before System Upgrade

VSS4Sup#show switch virtual




Local switch operational role: Virtual Switch Active


Peer switch operational role : Virtual Switch Standby

VSS4Sup#copy ftp: bootdisk:

Address or name of remote host []? 172.26.210.138

Source filename []? s2t54-advipservicesk9-mz.SSA.150-1.WIA111.90

Destination filename [s2t54-advipservicesk9-mz.SSA.150-1.WIA111.90]?

Accessing ftp://172.26.210.138/s2t54-advipservicesk9-mz.SSA.150-1.WIA111.90...

Loading s2t54-advipservicesk9-mz.SSA.150-1.WIA111.90 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

VSS4Sup#$sk:s2t54-advipservicesk9-mz.SSA.150-1.WIA111.90 ics-bootdisk:


Copy in progress...CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC

VSS4Sup#$sk:s2t54-advipservicesk9-mz.SSA.150-1.WIA111.90 sw1-slot5-bootdisk:



VSS4Sup#$dvipservicesk9-mz.SSA.150-1.WIA111.90 sw1-slot6-slavebootdisk:



Sup2T Only

15.1.(1)SY1

114


Migrate from VSS to VS4O

115


Reference Paper for VS4O

116

White Paper describes VS4O benefits, architecture and migration steps

http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps708/white_paper_c11-

729039.html


Migrate VSS to VS4O

Key steps in migrating to VS4O

Upgrade existing VSS to version 15.1(1)SY1

Establish a console connection for each supervisor module in the VSS

Prepare the first ICS supervisor module to boot the same image version as the active VSS

Insert the redundant supervisor module into the chassis (it does not matter which VSS chassis the redundant supervisor is inserted into first, the VSS active or VSS standby)

Verify the newly inserted supervisor boots as the ICS

Configure and connect the ICS supervisor ten gigabit uplink ports into the VSL (optional step, but recommended for configuration with an ICS in each chassis)

117

‟What if I my second supervisor module is running an older software version that does not support VS4O?”

What if I need to upgrade the

118


In-Chassis Redundant Supervisor Boot Behavior Scenarios

Active Supervisor in VSS Mode -

Running Image supporting VS40.

(15.1(1)SY1 or newer)

Active Supervisor in VSS mode -

Running Image Not Supporting

VS40. (15.1(1)SY or previous)

Standby in VSS mode running VS4O

capable image (15.1(1)SY1 or

newer)

boots as VS4O In-chassis SSO

Standby Hot

ICS will boot to RPR-mode

StandbyCold

Standby in Standalone mode running

VS4O capable image (15.1(1)SY1 or

newer)

ICS detects ICA in VSS mode and

automatically sets switch number

then resets and boots as VS4O In-

chassis SSO Standby Hot

ICS boots and detects ICA in VSS

mode, sets switch_number variable

and reset to rommon, Boot ICS again

to SY1 and ICS goes RPR-mode

Standby Cold

Standby booting with 15.1(1)SY or

older image in a standalone default

config

ICS will start to boot IOS and

recognize it is in an unsupported ICS

config and drop to rommon

Standby attempts to boot as

standalone ICS, will timeout waiting

on active then reload :||

Standby booting with 15.1(1)SY or

older image in a VSS config







ICS configured with config-register

0x2102

ICS boots to rommon ICS boots to rommon

119

In Chassis Active In

Ch

assis

Sta

nd

by


VSS Best Practice for Quad-Sup SSO

Always use at least one uplink from each Supervisor as part of the VSL. Consider using all the Supervisor uplink ports in the VSL (4 per chassis)

If using all 4 Supervisor uplinks (per chassis) “swap the 5s” or “swap the 4s” in order to maintain 20Gbps VSL even during a Supervisor fail event or reload event

Connect uplink and downlink on local linecards if possible, this will minimize traffic disruption across Supervisor switchover event

Must explicitly configure NSF (or NSR if supported) for routing protocol to provide minimum disruption to L3 routed interfaces

Use DFC enabled linecards with 512MB of available memory in order to minimize linecard reload time during EFSU (warm-reload)

Be sure to copy the system image file to all Supervisor module file systems in the same relative location

120


VSS Quad-Sup SSO Key Takeaways

VSS Quad-Sup SSO provides

– Automated and sub-second recovery from a Sup fail event

– Sub-second recovery maintains 100% bandwidth for the VSS

– Maintains network availability for single attached devices

New Staggered EFSU process reduces the outage time associated with linecard reloads

Quad-Sup SSO is only supported on Sup2T , available in 15.1(1)SY1

Quad-Sup Uplink Forwarding is only supported on Sup720-10G

121

VSL Bandwidth Design Considerations

12

2


VSL Design Considerations

123

VSL Link Diversification

VSL Bandwidth Sizing

VSL QoS

Borderless Networks: Medium Enterprise Design Profile http://www.cisco.com/en/US/docs/solutions/Enterprise/Medium_Enterprise_Design_Profile/MEDP.html

http://www.cisco.com/en/US/docs/solutions/Enterprise/Medium_Enterprise_Design_Profile/MEDP.html


Minimum of two links provides protection from port and SFP failures

Separate linecard provides protection from certain interface failures on a single Supervisor

Diverse physical paths protect from physical layer outages

Requires a VSL-capable linecard

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

VSS Active

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

VSS Standby

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

Ten 1/5/4 Ten 2/5/4

Ten 1/1/1 Ten 2/1/1

VSL Design

124

link diversification (dual-sup design option #1)


Minimum of two links provides protection from port and SFP failures

Diverse physical paths protect from physical layer outages

No additional VSL-capable linecards are required (Minimal Cost)

VSL Design

125

Link Diversification (Dual-Sup Design Option #2)

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

VSS Active

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

VSS Standby

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

Ten 1/5/4 Ten 2/5/4

Ten 1/5/5 Ten 2/5/5


CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

VSS ICS

VSS Standby

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

Maintains 20Gbps VSL bandwidth in event of a Supervisor failure

Maintains at least one locally attached VSL link to active Supervisor no matter which Supervisor becomes active

Cost effective design that does not require additional VSL-capable linec ard compared to design option #2

Support staggered mode upgrade with Sup2T VS4O

ICS = In-Chassis Standby

VSL Design

126

Link Diversification (Quad-Sup Design Option #1)

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

Ten 1/5/4 Ten 2/5/4

Ten 1/5/5 Ten 2/5/5

VSS ICS

VSS Active

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

Ten 1/6/5

Ten 1/6/4

Ten 2/6/5

Ten 2/6/4


Maintains 30Gbps VSL bandwidth in the event of a Supervisor failure

Maintains at least one locally attached VSL link to active Supervisor no matter which Supervisor becomes active

Provides additional resiliency against multiple Supervisor failure events compared to design option #1

ICS= In Chassis Standby

VSL Design

127


CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

VSS ICS

VSS Standby

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

Ten 1/5/4 Ten 2/5/4

Ten 1/5/5 Ten 2/5/5

VSS ICS

VSS Active

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

Ten 1/6/5

Ten 1/6/4

Ten 2/6/5

Ten 2/6/4

Ten 1/1/1 Ten 2/1/1


Virtual Switch Link interfaces are restricted from QoS policy changes

- Class of Service based queuing is automatically added to the VSL port channel interfaces on VS-Sup720-10G, this is not applicable on VS-Sup2T systems (mls qos trust cos)

- Default CoS to Queue mapping is enforced

- Interface Maximum Transmission Unit (MTU) size is automatically set to 9216 bytes

Critical control traffic is automatically marked and receives priority queuing

- Control traffic is set with CoS=5 BPDU=1 (marked in VSL header)

Virtual Switch Link QoS


no switchport

no ip address


mls qos trust cos


Q3 Q2 Q1 Pri

Sup720-10G Example

128


Supervisor uplink ports can be configured in either of two modes

- Normal mode

All 1GigE and 10GigE ports are available

Shared queuing structure

TX 1p3q4t, RX 2q4t

- 10G-only mode

Only the 10G ports are available for active use

Additional queues and buffers are allocated for the 10G ports

TX 1p7q4t, RX 8q4t

Adjust Etherchannel queuing requirements as needed

- “no mls qos channel-consistency” removes the requirement that all ports in an etherchannel bundle have the same queuing structure

Supervisor Uplink Port Queuing Options


no switchport

no ip address


mls qos trust cos


129

In-Service Software Upgrades with VSS


VSS Software Upgrades Using the In Service Software Upgrade (ISSU) Infrastructure Streamlined Process to Perform Software Upgrades/Downgrades

1

ISSU

Loadversion

3

ISSU

Acceptversion

(Optional)

2

ISSU

Runversion

4

ISSU

Commitversion

131


Upgrade Process Overview with VSS Full Image Upgrade Process

132

Switch-1 Switch-2

Standby Active

LC

LC LC

ISSU LoadVersion

ISSU RunVersion

ISSU CommitVersion

LC

Switch-1 Switch-2

Active

LC

LC

Standby

LC

LC

= Old Version

= New Version

Active

LC

LC

Switch-1 Switch-2

Standby

LC

LC

Switch-1 Switch-2

Standby

LC

LC

Active

LC

LC


EFSU for VSS Quad-Sup SSO

New “Staggered” upgrade mode will upgrade one Supervisor module at a time

– Effective outage for an individual chassis is minimized because the supervisor modules do not reload with the linecards

– Staggered mode reloads the Supervisor modules separately from the linecards

– Linecards will reload on a per chassis basis during the process (similar to EFSU on Sup720) however the

– Staggered mode is the system default for Sup2T

– Optional “Tandem” mode will upgrade both Supervisors modules per chassis, same as operation with VS-Sup720-10G

Must use at least one Supervisor uplink port from each Supervisor module

– Needed to maintain VSL during linecard reloads

– Recommend using all four Sup uplinks for the VSL

142


CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

VSS ICS

VSS Standby

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

Maintains 20Gbps VSL bandwidth in event of a Supervisor failure

Maintains at least one locally attached VSL link to active Supervisor no matter which Supervisor becomes

active

Cost effective design that does not require additional VSL-capable linecard compared to design option #2

ICS = In-Chassis Standby

VSL Design

143


CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

Ten 1/5/4 Ten 2/5/4

Ten 1/5/5 Ten 2/5/5

VSS ICS

VSS Active

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

CFC or DFC Linecard

Ten 1/6/5

Ten 1/6/4

Ten 2/6/5

Ten 2/6/4


Staggered Mode Requires a VSL Connection Between All Supervisor Modules

144

VSS01#

*Apr 18 05:11:32.897: SW1: Cannot proceed with staggered ISSU

upgrade as VSL connection requirement is not met. Please issue

Config cli no issu upgrade staggered to disable staggered

upgrade


VSL Status and Detail

145

VSS01#show switch virtual link detail

VSL Status : UP

VSL Uptime : 21 hours, 45 minutes

VSL SCP Ping : Pass

VSL ICC Ping : Pass

VSL Control Link : Te1/2/4

VSL Encryption : Configured Mode - Off, Operational Mode - Off

LMP summary

Link info: Configured: 4 Operational: 4

Peer Peer Peer Peer Timer(s)running

Interface Flag State Flag MAC Switch Interface (Time remaining)

--------------------------------------------------------------------------------

Te1/1/4 vfsp operational vfsp 0013.5f1c.0680 2 Te2/1/4 T4(152ms)

T5(59.95s)


T5(59.95s)


T5(59.95s)


T5(59.98s)

Flags: v - Valid flag set f - Bi-directional flag set

s - Negotiation flag set p - Peer detected flag set

Timers: T4 - Hello Tx Timer T5 - Hello Rx Timer


ISSU Show Commands

VSS4Sup#show issu state

The system is configured to be upgraded in staggered mode.

4 nodes are found to be online.

Summary: the system will be upgraded in staggered mode.

Slot = 1/5

RP State = Active

ISSU State = Init

Boot Variable = bootdisk:s2t54-advipservicesk9-mz.SSA.150-1.WIA111.90,1;

Slot = 2/5

RP State = Standby

ISSU State = Init


Slot = 1/6

RP State = Active-ICS

ISSU State = Init


Slot = 2/6

RP State = Standby-ICS

ISSU State = Init


147


Staggered Upgrade with Quad-Sup SSO Loadversion

A –V1

ICS –V1

S –V1

ICS –V1

R

#issu loadversion bootdisk:v1.bin

ISSU State = INIT

ISSU State = LV

Switch ID 1 Switch ID 2

ICS –V1

A –V1

ICS –V1

S –V1


ICS –V2

148


Staggered Upgrade with Quad-Sup SSO Loadversion (Step2)

This step occurs automatically, no CLI user required

Begins after the Sup in 2/2 reaches ICS Standby Hot running V2

The newly active Sup in (2,2) is running V2 software and causes linecard to reload with V2

A –V1

ICS –V1

S –V1

ICS –V1

R

ICS –V2

ISSU State = LV

ISSU State = LV

R


A –V1

ICS –V1

S –V1

ICS –V2


VSS Standby ICA (2,1) reloads causing an

SSO switchover event, linecards then reload

with new version to match the new ICA (2,2)

SSO S –V2

ICS –V1

149


Staggered Upgrade with Quad-Sup SSO Runversion

A –V1

ICS –V1

S –V1

ICS –V1

R

ISSU State = LV ICS –V1

S –V2

#issu runversion

A –V1

ICS –V1

S –V1

ICS –V1

ICS –V1

S –V2 S –V1

ICS –V1 ISSU State = RV

A –V2

150


Staggered Upgrade with Quad-Sup SSO Commitversion (Step1)

R

ISSU State = RV

#issu commitversion

ISSU State = CV1 A –V1

ICS –V1

S –V1

ICS –V1

ICS –V1

S –V2 S –V1

ICS –V1

A –V2

ICS –V2

ICS –V1

S –V1

ICS –V1

A –V2

151


Staggered Upgrade with Quad-Sup SSO Commitversion (Step2)

Linecards in Switch 1 reload with new version when the new ICA running v2 goes active

Linecards perform pre-download of software image if the linecard is capable (requires 512MB memory)

R

ISSU State = CV1

ISSU State = INIT ICS –V1 S –V1

A –V2

ICS –V2

A –V1

ICS –V1

S –V1

ICS –V1

ICS –V1

S –V2 S –V1

ICS –V1

A –V2

ICS –V2

R ICS –V2

S–V2

ICS –V2

R

R

152


EFSU Staggered Mode Time Table

1 2 3 4

100%

50%

loadversion runversion acceptversion commitversio

n

~1-2 min linecard

reload time

~1-2 min linecard

reload time


EFSU Staggered versus Tandem Mode

1 2 3 4

100

%

50

%

loadversion runversion acceptversion commitversion

~15min reload time ~15min reload time ~15min reload time

1 2 3 4

100

%

50

%

loadversion runversion acceptversion commitversion

~1-2 min

linecard

reload time

~1-2 min

linecard

reload time

Tandem Upgrade

Staggered Upgrade


ISSU Image Version Compatibility

155

Both software versions must support the ISSU infrastructure and the two images must be compatible for the upgrade process to proceed in SSO redundancy mode

Check the Cisco Feature Navigator or the Software Release Notes for listing of compatible release

In general Cisco will attempt to provide ISSU compatibility for releases within an 18 month time frame of each other


ISSU Image Compatibility Rules

156

18 month window release time frame

– exceptions for major releases or other significant changes between releases

ISSU requires the same software licenses between images

– IP Base to IP Base

– Advanced IP Service to Advanced IP Services

– Universal_lite to Universal_lite

ISSU is also not supported from a k9 image to a non-k9 image, or vice versa.


http://www.cisco.com/en/US/partner/products/hw/switches/ps708/prod_release_notes_list.html

ISSU Compatibility Matrix on Cisco.com

157

http://www.cisco.com/en/US/partner/products/hw/switches/ps708/prod_release_notes_list.html


VSS & EFSU Important Points

EFSU supported on Sup720-10G based systems with SXI software train and newer

EFSU supported on Sup2T based systems with 15.0(1)SY software and newer

Dual-homed connectivity is required for minimal traffic disruption with EFSU

– Single-homed devices will experience an outage when the attached chassis reloads

Software images files must be “ISSU compatible” (these are not VSS specific requirements)

– Must be the same image types, meaning “Native to Native” or “Modular to Modular”

– For Modular images, both images must use the same installation method, therefore “installed mode” or “binary mode”

– The software feature sets must be the same between the two software image files

Always Check the Release Notes for hardware and software compatibility

158


VSS Software Upgrades on Catalyst 4500-E and 4500-X Series ISSU Manual and Automatic Methods

159

The Catalyst 4500-E and Catalyst 4500-X support ISSU upgrades in VSS mode similar to what is supported on the Catalyst 6500

– Traditional four step ISSU upgrade, described as the “manual method”

Catalyst 4500-E and Catalyst 4500-X support “ISSU Changeversion” command using a single command to execute the upgrade

– single command ISSU upgrade “automatic method”

ISSU Changeverison performs the ISSU upgrade without user intervention

– scheduling option

– quick option skips the intermediate trial phase upgrade, faster overall upgrade process

Deployment Considerations and Best Practices



161

Virtual Switch Domain

A Virtual Switch Domain ID is allocated during the conversion process and

represents the logical grouping the 2 physical chassis within a VSS. It is

possible to have multiple VS Domains throughout the network…

Use a UNIQUE VSS Domain-ID for each VSS Domain throughout the network.

Various protocols use Domain-IDs to uniquely identify each pair.

VSS Domain 10

VSS Domain 30 VSS Domain 20



162

Router MAC Address Assignment

Recommendation is to use the virtual mac-address option. This eliminates the possibility of a duplicate MAC address in case the original Supervisor is ever reused within the same network.

Router MAC address =

0008.e3ff.fc0a

One router MAC address to represent both

physical chassis as a single logical device

Configuration options

‒ Burnt-In MAC address

‒ Virtual MAC address



163

Virtual Router MAC Address Assignment

Instead of using default chassis mac-address assignment, from 12.2(33)SXH2 onwards virtual mac-address can be specified as shown below

VSS(config-vs-domain)#switch virtual domain 10

VSS(config-vs-domain)#mac-address use-virtual

Configured Router mac address is different from operational value. Change will take

effect after config is saved and the entire Virtual Switching System (Active and Standby)

is reloaded.

The use-Virtual MAC address is assigned from a reserved pool of MAC addresses appended with the VSS domain id. The reserved pool is 0008.e3ff.fc00 to 0008.e3ff.ffff.

VSS# show interface vlan 1

Vlan1 is up, line protocol is up

Hardware is EtherSVI, address is 0008.e3ff.fc0a (bia 0008.e3ff.fc0a)



164

Dual-Attach Whenever Possible

SiSi SiSi

SiSi SiSi

Dual-Attach connected devices whenever possible

Etherchannel and CEF hashing algorithms have been modified for VSS to always favor locally attached interfaces

With a dual-attached design

Data traffic will not traverse the VSL under normal conditions, only control traffic will traverse the VSL

Data traffic will traverse the VSL if there is a failure event and there no local interfaces are available


VSL Bandwidth Sizing

165

How Many Links are Needed in the VSL? The VSL is an Etherchannel

– Supports up to eight links

Consider possible failure scenarios – Fiber, SFP, Interface, Line Card, Supervisor, downstream

switch interfaces

Consider the bandwidth needed for any Service Modules

Consider the bandwidth needed for any SPAN sessions

SiSi SiSi

SiSi SiSi


VSS High Availability

166

NSF – Configuration and Monitoring

Router# show ip ospf Routing Process "ospf 100" with ID 10.120.250.4 Start time: 00:01:37.484, Time elapsed: 3w2d Supports Link-local Signaling (LLS) <snip> Non-Stop Forwarding enabled, last NSF restart 3w2d ago (took 31 secs)

Router# show ip protocol

*** IP Routing is NSF aware ***

Routing Protocol is "eigrp 100 100"

<snip>

EIGRP NSF-aware route hold timer is 240s

EIGRP NSF enabled

Recommendation: Non-Stop Forwarding is required for sub-sec supervisor switchover convergence with L3 Routing Protocols

EIGRP OSPF

Switch(config)#router ospf 100

Switch(config-router#nsf

Switch(config)#router eigrp 100

Switch(config-router#nsf


• NSF is intended to provide availability through route convergence avoidance

• Fast IGP timers are intended to provide availability through fast route convergence

• In an NSF environment dead timer must be greater than:

SSO recovery + Routing Protocol restart + time to send first hello

Applicable in VSS and Quad Sup VSS mode

• Recommendation –

Do not configure aggressive timer Layer 2 protocols, i.e. Fast UDLD

Do not configure aggressive timer Layer 3 protocols, i.e. OSPF Fast Hello, BFD etc. Keep all protocol timers at default settings

Sub-second Protocol Timers and NSF/SSO

167

VSS

Distribution

L3

Core

Active Standby


Dual-Active Detection

168

SiSiSiSi

VSLP Fast-Hello

or BFD

Redundant

VSL Fiber

ePAgP

ePAgP

Recommendations:

Use MEC with ePAgP or MEC with VSLP Fast Hello for faster VSL link loss convergence results.

Enable BOTH ePAgP and direct heart-beat link based VSLP Fast Hello methods (if possible )

Enable ePAgP to core (if access-layer is not ePAgP capable


Operational Management

169

Reloading the VSS

Should there be a requirement to reload the entire Virtual Switching System (both chassis), the

command “reload” can be used to accomplish this task…

vss#reload

Warning: This command will reload the entire Virtual Switching System (Active and Standby

Switch).

Proceed with reload? [confirm]

1d04h: %SYS-5-RELOAD: Reload requested by console. Reload Reason: Reload Command.

***

*** --- SHUTDOWN NOW ---

***

1d04h: %SYS-SP-5-RELOAD: Reload requested

System Bootstrap, Version 8.5(1)

Copyright (c) 1994-2006 by cisco Systems, Inc.

Cat6k-Sup720/SP processor with 1048576 Kbytes of main memory

<…snip…>

Virtual Switch


Operational Management

170

Reloading a Member of the VSS

vss# redundancy reload ?

peer

shelf <1-2>

vss# redundancy reload shelf 2

Reload the entire remote shelf[confirm]

Preparing to reload remote shelf

vss#

Switch1 Switch2

Active Hot Standby vss# redundancy force-switchover

This will reload the active unit and

Force switchover to standby [confirm]

vss#

VSL

NEW command has been introduced to reload a SINGLE VSS member switch


Revert from VSS to Standalone

171

How to revert a system from VSS to Standalone mode

Use “Erase NVRAM” Exec level command – Will erase the startup-config and also set the VSS switch number ROMMON variables

on both switches to default value of 0

Reload the chassis after the “Erase NVRAM” and the system will boot as a standalone switch with a default configuration

core6506#erase nvram:

Erasing the nvram filesystem will remove all configuration files! Continue? [confirm]

*Jul 2 10:12:02.073: %SYS-SW1_SP-7-NV_BLOCK_INIT: Initialized the geometry of nvram

*Jul 2 10:12:04.627: %SYS-SW2_SPSTBY-7-NV_BLOCK_INIT: Initialized the geometry of nvram

core6506#

*Jul 2 10:12:05.243: %VS_GENERIC-SW2_SPSTBY-5-VS_SWITCH_NUMBER_CHANGE: Switch_number getting

changed from 2 to 0.

*Jul 2 10:12:05.347: %VS_GENERIC-SW1_SP-5-VS_SWITCH_NUMBER_CHANGE: Switch_number getting changed

from 1 to 0.


VSS Deployment Best Practices

DO

Use unique VSS domain-id within the same network

Save backup configuration file to all Supervisor file systems in the same relative location ,

for example both active & hot-standby bootdisk:

Use a minimum of one Supervisor uplink for the VSL, this provides for faster VSL bring up.

Dual-home connected devices whenever possible, use L2 or L3 Multi-Chassis

Etherchannel, L3 ECMP

Use ePAgP and VSLP Fast Hello Dual Active Protocol.

Enable NSF under routing protocols

172


VSS Deployment Best Practices Con’t

DO NOT ….

× Do Not Tune VSLP timers unless recommended by cisco

× Do Not Use preemption (VSS switch preemption has been removed from SXJ and SY

release trains)

× Do Not Issue “shutdown” on VSL port-channel interface for VSL failure testing, it creates

config mismatch. If you want to test the dual-active detection mechanisms simply disconnect

the VSL cables, this will create a realistic failure scenario without causing the configurations

to get out of sync.

× Do Not Change VSL hashing algorithm in production. It requires a shut/no shut on PO.

Shutting down VSL will cause traffic disruption and dual-active scenario.

173

Summary


Build redundant topology without First Hop Redundancy Protocols

No Spanning Tree blocking ports

Single control plane and management interface

Reduces the number of L3 routing protocol peers

Benefit 1: Simplifies Network Designs

175


No Spanning Tree Blocking Ports

Groups resources together and activates all available bandwidth across redundant Cisco Catalyst VSS switches

Enables standards-based link aggregation for server or service appliance connectivity, maximizing system bandwidth

Benefit 2: Scales System Capacity

176


Benefit 3: Increase Network Availability

Inter-chassis Stateful Failover enables real time applications to continue without disruption

Etherchannel based link resiliency provides sub-second recovery

Simplifies network designs reducing human error in network operations

177


Call to Action…

Visit the World of Solutions:-

Cisco Campus

Walk-in Labs

Technical Solutions Clinics

Meet the Engineer

Lunch Time Table Topics, held in the main Catering Hall

Recommended Reading: For reading material and further resources for this session, please visit www.pearson-books.com/CLMilan2014

178

http://www.pearson-books.com/CLMilan2014




Complete your online session evaluation

Complete four session evaluations and the overall conference evaluation to receive your Cisco Live T-shirt

Complete Your Online Session Evaluation

179


Reference Borderless Networks: Medium Enterprise Design Profile


Deployment and Support Cisco Catalyst 6500 Virtual Switching System Deployment Best Practices Migrate Standalone Cisco Catalyst 6500 Switch to Cisco Catalyst 6500 Virtual Switching System Troubleshoot Packet Flow in Cisco Catalyst 6500 Series Virtual Switching System 1440

VSS White Paper http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps9336/white_paper_c11_429338.pdf

Catalyst 6500 Series Configuration Guide http://www.cisco.com/en/US/partner/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/vss.ht

ml

Catalyst 4500 Series Configuration Guide http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/15.1.2/XE_340/configuration/guide/vss.html#wp1331458

181


http://www.cisco.com/en/US/partner/products/ps9336/products_tech_note09186a0080a7c837.shtml

http://www.cisco.com/en/US/partner/products/ps9336/products_tech_note09186a0080a7c74c.shtml

http://www.cisco.com/en/US/partner/products/ps9336/products_tech_note09186a0080a963a9.shtml

http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps9336/white_paper_c11_429338.pdf

http://www.cisco.com/en/US/partner/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/vss.html

http://www.cisco.com/en/US/partner/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/vss.html

http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/15.1.2/XE_340/configuration/guide/vss.html

http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/15.1.2/XE_340/configuration/guide/vss.html

Date post:	23-Apr-2018
Category:	Documents
Upload:	lethu
View:	243 times
Download:	9 times

Cisco Catalyst Virtual Switching...

Documents