Enjoy this latest post on the control plane functions of the vPC. This is part of the link aggregation section of the exam requirements in CCIE Data Center.
Our previous post on this subject focused on the data plane. You can find it here: https://www.ajsnetworking.com/ccie-dc-written-1-1-a-link-aggregation-vpc-data-plane/
The vPC Control Plane
The vPC peer link between your vPC peers is the workhorse for the control plane messages (BPDUs, LACP, CFSoE) that must flow between them. The control plane is responsible for the following:
- Exchange of Layer 2 forwarding tables for the vPC peers – MAC addresses learned on one switch are instantly synced to the other switch using CFSoE; this reduces traffic on the vPC peer link
- Consistency and compatibility checks – CFSoE exchanges information to ensure both peer support vPC and that he member ports are in a compatible state
- Sync IGMP snooping information – inbound IGMP traffic triggers synchronization much like MAC address learning
- Monitor the status of vPC member ports – orphan port behavior may occur due to failure conditions
- Sync the ARP tables of the vPC peers – again CFSoE is used to keep these important tables in sync; this speeds convergence if one of the vPC peers must reload
- Determine the primary and secondary vPC peer devices – the primary is responsible for the processing of BPDUs; the election is non-preemptive
- Agree on LACP and STP parameters – this is needed because the vPC announces itself to the downstream switch as a single logical switch
For even more information – check out this Cisco documentation at https://www.cisco.com/c/en/us/products/collateral/switches/nexus-5000-series-switches/design_guide_c07-625857.html
Here is an important question about the data plane with your vPC. Is the vPC peer link (typically an EtherChannel) between your vPC peer switches used for forwarding data traffic? In a “normal” network condition, the answer is no. The vPC peer link is not used for the data traffic of the vPC and is considered to be an extension of the control plane between the vPC peer switches. The vPC peer link carries the following type of traffic:
- vPC control traffic, such as Cisco FSoE, BPDUs, and LACP messages
- Flooding traffic, such as broadcast, multicast, and unknown unicast traffic
- Traffic from orphan ports
So we note that the peer link is used specifically for switch management traffic and occasionally for the data packets from failed network ports. This behavior of our vPCs enables the solution to scale because the bandwidth requirement for the vPC peer link is not directly related to the total bandwidth of all vPC ports.
What about loop prevention? One of the most important forwarding rules for a vPC is exactly about that as I have shown in the illustration above. Note this sample traffic flow:
- A packet enters the vPC peer switch via a vPC member port.
- The packet then goes to the other peer switch via the peer link
- The packet is then not allowed to exit the switch on the vPC member port.
- This packet can exit on any other type of port, such as an L3 port or an orphan port.
This rule prevents the packets that are received on a vPC from being flooded back onto the same vPC by the other peer switch.
What about this traffic from orphan ports? Understand there are two types of orphan ports for this discussion:
- The first type of orphan port is the one that is connected to an orphan device and is not part of any vPC configuration. For this type of orphan port, normal switch forwarding rules are applied. The traffic for this type of orphan port can use a vPC peer link as a transit link to reach the devices on the other vPC peer switch.
- The second type of orphan port is the one that is a member of a vPC configuration, but the other peer switch has lost all the associated vPC member ports. For this type of orphan port, the vPC loop avoidance rule is disabled. In this special case, the vPC peer switch will be allowed to forward the traffic that is received on the peer link to one of the remaining active vPC member ports.
CFSoE is used to synchronize the Layer 2 forwarding tables between the vPC peer switches. Therefore, there is no dependency on the regular MAC address learning between the vPC peer switches. CFSoE-based MAC address learning is applicable only to the vPC ports. This method of learning is not used for the ports that are not part of the vPC configuration.
Virtual Port Channel master really does begin with a knowledge of the components that make them up. This post assumes you are familiar with the very basics of virtual port channels – knowledge you have gained through CCNA/CCNP Data Center.
Here are the components of the vPC:
- vPC peers – two switches that act as a single logical switch to the downstream device.
- vPC peer link – a link between the vPC peers that is used to synchronize state. Consider two physical links in a port channel. MAC address table synchronization, as well as other control plane, functions synchronize over this link.
- Cisco Fabric Services – this protocol is responsible for synchronization between the peers. CFSoE is run. STP is modified to keep the peer link ports forwarding.
- vPC peer keepalive link – Layer 3 communication link between the vPC peers to act as a secondary test of connectivity.
- vPC – the virtual port channel depicts itself to the downstream device as a single logical switch. The downstream device does not need virtual port channel support. It forms its standard port channel configuration.
- vPC member ports – a member of the vPC on the vPC peer switch.
- vPC domain – a numeric identifier for the vPC domain.
- Orphan device – a device that is connected to only one peer in the vPC.
- Orphan port – the switchport that connects to an orphan device.
- vPC VLANs – the VLANs permitted to use the vPC. They must be permitted on the peer link.
- Non vPC VLANs – the VLANs not permitted on the vPC.