Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Webcast-Catalyst9k
New Member

Private VLANs on FEX

Hello *,

regarding PVLANs and the Nexus, my understanding is that we cannot configure Private VLANs on a FEX trunk port with a NX-OS release older than 5.1(3)N2(1) for the Nexus5548... Is there any known workaround for this limitation (appart from performing a SW upgrade)?

Thank you in advance,

Fernando

1 ACCEPTED SOLUTION

Accepted Solutions
Silver

Private VLANs on FEX

Hello Fernando, 

I would say it all depends of your current architecture (where is the promiscuous port, routing device and so on…).

Maybe you are trying to extend a pvlan domain to an ESX vdswitch or a Nexus 1000v.;

If it is not possible to upgrade to 5.1(3)N2(1) and activate the ‘PVLAN on FEX trunk’ feature, please find some ideas :

  • Define the vlans to be secured as pvlans only on the END switches (* On the VMware vdSwitch, N1k, ..  *  On the outgoing switch where the promiscuous port is locally configured) but not on the N5k where they will be defined as regular vlans.

       Hence those vlans could be allowed on the FEX trunks, they will just be used for the transport of the flows.

       The drawback is that we may not connect ‘private-vlan hosts’ on the N5k/N2k (at least in the same pvlan domain).

  • Define and connect the trunk directly on the 5548 => Depending on the number of trunks you will need to define, some GLC-T are to be used for the connection.
  • Still depending on your environment => With the Nexus 1000v it is possible to define the uplink as a ‘promiscuous trunk’ directly connected to the routing device.
  • If possible within you environment and devices capabilities define the vlans to secure as regular vlans and implement ACLs to define the communication matrix.
  • I have never tested it and do not think it is a good idea =>  To dedicate interfaces for each pvlan between the N2K and the downstream resource.

If there is other alternatives there are welcomed.

Hope that helps.

Best regards.

Karim

2 REPLIES
Silver

Private VLANs on FEX

Hello Fernando, 

I would say it all depends of your current architecture (where is the promiscuous port, routing device and so on…).

Maybe you are trying to extend a pvlan domain to an ESX vdswitch or a Nexus 1000v.;

If it is not possible to upgrade to 5.1(3)N2(1) and activate the ‘PVLAN on FEX trunk’ feature, please find some ideas :

  • Define the vlans to be secured as pvlans only on the END switches (* On the VMware vdSwitch, N1k, ..  *  On the outgoing switch where the promiscuous port is locally configured) but not on the N5k where they will be defined as regular vlans.

       Hence those vlans could be allowed on the FEX trunks, they will just be used for the transport of the flows.

       The drawback is that we may not connect ‘private-vlan hosts’ on the N5k/N2k (at least in the same pvlan domain).

  • Define and connect the trunk directly on the 5548 => Depending on the number of trunks you will need to define, some GLC-T are to be used for the connection.
  • Still depending on your environment => With the Nexus 1000v it is possible to define the uplink as a ‘promiscuous trunk’ directly connected to the routing device.
  • If possible within you environment and devices capabilities define the vlans to secure as regular vlans and implement ACLs to define the communication matrix.
  • I have never tested it and do not think it is a good idea =>  To dedicate interfaces for each pvlan between the N2K and the downstream resource.

If there is other alternatives there are welcomed.

Hope that helps.

Best regards.

Karim

New Member

Private VLANs on FEX

Hello Karim,

thank you for your answer. Confirms my suspiction. Will have to analyse all the options to see if the current scenario still allows for PVLAN in the end devices...

Thanks and Best regards,

Fernando

1095
Views
0
Helpful
2
Replies
CreatePlease to create content