标签：mac access secondary 缺陷 上下行 案例 end keepaliv -keep
1、案例拓扑图如下
interface port-channel100
vpc peer-link
interface Ethernet1/1
switchport mode trunk
channel-group 100 mode active
interface Ethernet1/2
switchport mode trunk
channel-group 100 mode active
N7K2的vpc配置
vpc domain 100
role priority 100
peer-keepalive destination 1.1.1.1 source 1.1.1.2
peer-gateway
interface port-channel100
vpc peer-link
interface Ethernet1/1
switchport mode trunk
channel-group 100 mode active
interface Ethernet1/2
switchport mode trunk
channel-group 100 mode active
2.2、N7K和5K之间使用背对背的VPC
这种方式与普通的vpc的区别是，n7k的下联启用vpc功能。n5k的上联链路也启用vpc功能。所有的互联口加入相同的vpc接口中。配置略
3、N5K 配置
3.1、vpc配置
n5k1
feature vpc
vpc domain 100
peer-switch
role priority 1
peer-keepalive destination 1.1.1.4 source 1.1.1.3
peer-gateway
interface port-channel5
des TO_N7K
vpc 5
interface port-channel10
des vpc_peer
vpc peer-link
n5k2
vpc domain 100
peer-switch
role priority 100
peer-keepalive destination 1.1.1.3 source 1.1.1.4
peer-gateway
interface port-channel5
des TO_N7K
vpc 5
interface port-channel10
vpc peer-link
3.2、 N5K下挂2k 使用port-channel 的方式
n5k1
feature fex
fex 107
pinning max-links 1
description "FEX107"
fex 108
pinning max-links 1
description "FEX0108"
interface port-channel107
switchport mode fex-fabric
fex associate 107
interface port-channel108
switchport mode fex-fabric
fex associate 108
3.3、其中5k 和2k 的port-channel 聚合方式使用on 方式不能用lacp，
5k和2k的互联不推荐使用静态pinning 方式。这种方式缺陷明显。某一条上联链路down掉后，下挂的fex接口会掉一大片。
2k通电下载5k的镜像show fex 看到2k online 状态说明fex ok了
n5k1 下面show fex 会看到有两台fex。 fex 107 fex 108
4、2k下使用增强vpc连接服务器
配置如下
N5K1
interface e107/1/1
channel-group 11 mode active
interface P11
switch mode access
switch access vlan 11
N5K2
interface e108/1/1
channel-group 11 mode active
interface P11
switch mode access
switch access vlan 11
普通的链路聚合就可以和服务器对接，不需要vpc。
5、外联区防火墙ASA1-2 使用三层模式接入网络，使用主备模式
5.1、ASA1 failover配置
failover
failover lan unit primary
failover lan interface FO Port-channel1
failover interface ip FO 11.1.1.1 255.255.255.0 standby 11.1.1.2
failover 链路使用是两条物理链路聚合接口。
5.2、上联链路
interface Port-channel2
des TO_N7K
nameif inside
security-level 100
ip address 10.1.1.2 255.255.255.0
下联链路interface Ethernet4
des TO_cisco3750x
nameif outside
security-level 0
ip address 10.1.2.1 255.255.255.0
5.3、 路由
asa 1与N7K之间启用静态路由，下一跳指到7k的hsrp的虚拟地址
route inside 172.16.1.0 255.255.255.0 10.1.1.254 内网路由
route outside 100.1.1.0 255.255.255.0 10.1.2.2 1 外网路由
5.4放行inside 到outside 的流量
access-list in_acl extended permit icmp 172.16.1.0 255.255.255.0 100.1.1.0 255.255.255.0
access-group in_acl in interface outside
5.5、ASA2只需要配置上行以及asa1的互联的链路聚合口以及failover就可以
配置
failover配置
failover
failover lan unit secondary
failover lan interface FO Port-channel1
failover interface ip FO 11.1.1.1 255.255.255.0 standby 11.1.1.2
链路聚合配置省略
6、ASA3-4使用asa的透明模式
6.1、failover 以及链路聚合配置省略
6.2、bridge-group配置，使用子接口方式封装vlan
interface Port-channel3
no nameif
security-level 0
!
interface Port-channel3.10
des TO_N7K
vlan 10
nameif outside
bridge-group 10
security-level 0
interface Ethernet4.10
des TO_cisco_3750
vlan 11
nameif inside
bridge-group 10
security-level 100
bvi接口需要和业务网段在同一个网段
interface BVI10
des bvi_interface
ip address 10.1.10.254 255.255.255.0
查看bridge-group
ASA3# sho bridge-group
Static mac-address entries: 0 (in use), 65535 (max)
Dynamic mac-address entries: 1 (in use), 65535 (max)
Bridge Group: 10
Interfaces:
Ethernet4.10
Port-channel3.10
Management System IP Address: 10.1.10.254 255.255.255.0
Management Current IP Address: 10.1.10.254 255.255.255.0
Management IPv6 Global Unicast Address(es):
N/A
Static mac-address entries: 0
Dynamic mac-address entries: 1
上下行交换机，使用trunk 模式封装相应的VLAN id即可。
6.3、方向n7k 和下联交换机3750x的ospf 流量
access-list inside_acl extended permit icmp any any
access-list inside_acl extended permit ospf any any
access-list out_acl extended permit icmp any any
access-list out_acl extended permit ospf any any
access-group inside_acl in interface inside
access-group out_acl in interface outside
标签：mac access secondary 缺陷 上下行 案例 end keepaliv -keep
原文地址：https://blog.51cto.com/1823203/2468057
