cisco:switch:9500:cisco_catalyst_9500_series_manual
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| cisco:switch:9500:cisco_catalyst_9500_series_manual [2025/02/24 09:43] β aperez | cisco:switch:9500:cisco_catalyst_9500_series_manual [2025/09/11 01:08] (current) β aperez | ||
|---|---|---|---|
| Line 7: | Line 7: | ||
| ---- | ---- | ||
| + | Switch#show running-config interface Port-channel2 | ||
| Switch#show interfaces status | Switch#show interfaces status | ||
| Switch#show mac address-table | Switch#show mac address-table | ||
| Line 644: | Line 644: | ||
| ---- | ---- | ||
| + | ====== SSH ====== | ||
| + | |||
| + | **SSH Configuration on Cisco IOS XE 17.12.03** | ||
| + | |||
| + | configure terminal | ||
| + | hostname MyRouter | ||
| + | ip domain-name mynetwork.local | ||
| + | crypto key generate rsa modulus 2048 | ||
| + | username admin privilege 15 secret MyStrongPassword | ||
| + | ip ssh version 2 | ||
| + | line vty 0 4 | ||
| + | transport input ssh | ||
| + | exec-timeout 10 0 ! 10 minutes, 0 seconds | ||
| + | login local | ||
| + | exit | ||
| + | |||
| + | configure terminal | ||
| + | ip ssh server algorithm encryption aes256-ctr aes192-ctr aes128-ctr | ||
| + | end | ||
| + | |||
| + | write memory | ||
| + | |||
| + | show ip ssh | ||
| + | show run | include ssh | ||
| + | |||
| + | ---- | ||
| + | ---- | ||
| + | ! | ||
| + | ip access-list extended OSPF-MULTICAST | ||
| + | 10 permit ospf any any | ||
| + | 20 permit ip any host 224.0.0.5 | ||
| + | 30 permit ip any host 224.0.0.6 | ||
| + | 40 permit ip any any | ||
| + | ! | ||
| + | interface Port-channel1 | ||
| + | | ||
| + | | ||
| + | mtu 9100 | ||
| + | ip access-group OSPF-MULTICAST in | ||
| + | | ||
| + | ! | ||
| + | interface Port-channel2 | ||
| + | | ||
| + | | ||
| + | mtu 9100 | ||
| + | ip access-group OSPF-MULTICAST in | ||
| + | | ||
| + | speed nonegotiate | ||
| + | ! | ||
| + | interface GigabitEthernet0/ | ||
| + | vrf forwarding Mgmt-vrf | ||
| + | no ip address | ||
| + | | ||
| + | ! | ||
| + | interface TwentyFiveGigE1/ | ||
| + | | ||
| + | | ||
| + | mtu 9100 | ||
| + | | ||
| + | | ||
| + | udld port aggressive | ||
| + | | ||
| + | | ||
| + | ! | ||
| + | interface TwentyFiveGigE1/ | ||
| + | | ||
| + | | ||
| + | mtu 9100 | ||
| + | | ||
| + | | ||
| + | udld port aggressive | ||
| + | | ||
| + | | ||
| + | ! | ||
| + | interface TwentyFiveGigE1/ | ||
| + | | ||
| + | | ||
| + | | ||
| + | mtu 9100 | ||
| + | fec cl74 | ||
| + | ! | ||
| + | interface TwentyFiveGigE1/ | ||
| + | mtu 9100 | ||
| + | ! | ||
| + | interface TwentyFiveGigE1/ | ||
| + | | ||
| + | | ||
| + | | ||
| + | mtu 9100 | ||
| + | fec cl74 | ||
| + | ! | ||
| + | interface TwentyFiveGigE1/ | ||
| + | mtu 9100 | ||
| + | ! | ||
| + | interface TwentyFiveGigE1/ | ||
| + | | ||
| + | | ||
| + | | ||
| + | mtu 9100 | ||
| + | fec cl74 | ||
| + | ! | ||
| + | interface TwentyFiveGigE1/ | ||
| + | mtu 9100 | ||
| + | ! | ||
| + | interface TwentyFiveGigE1/ | ||
| + | | ||
| + | | ||
| + | | ||
| + | mtu 9100 | ||
| + | fec cl74 | ||
| + | ! | ||
| + | interface TwentyFiveGigE1/ | ||
| + | mtu 9100 | ||
| + | ! | ||
| + | interface TwentyFiveGigE1/ | ||
| + | | ||
| + | | ||
| + | | ||
| + | mtu 9100 | ||
| + | ! | ||
| + | interface TwentyFiveGigE1/ | ||
| + | mtu 9100 | ||
| + | ! | ||
| + | interface TwentyFiveGigE1/ | ||
| + | | ||
| + | | ||
| + | | ||
| + | mtu 9100 | ||
| + | fec cl74 | ||
| + | ! | ||
| + | interface TwentyFiveGigE1/ | ||
| + | mtu 9100 | ||
| + | ! | ||
| + | interface TwentyFiveGigE1/ | ||
| + | mtu 9100 | ||
| + | ! | ||
| + | interface TwentyFiveGigE1/ | ||
| + | mtu 9100 | ||
| + | ! | ||
| + | interface TwentyFiveGigE1/ | ||
| + | mtu 9100 | ||
| + | ! | ||
| + | interface TwentyFiveGigE1/ | ||
| + | mtu 9100 | ||
| + | ! | ||
| + | interface TwentyFiveGigE1/ | ||
| + | mtu 9100 | ||
| + | ! | ||
| + | interface TwentyFiveGigE1/ | ||
| + | mtu 9100 | ||
| + | ! | ||
| + | interface TwentyFiveGigE1/ | ||
| + | mtu 9100 | ||
| + | ! | ||
| + | interface TwentyFiveGigE1/ | ||
| + | mtu 9100 | ||
| + | ! | ||
| + | interface TwentyFiveGigE1/ | ||
| + | | ||
| + | | ||
| + | mtu 9100 | ||
| + | | ||
| + | | ||
| + | udld port aggressive | ||
| + | | ||
| + | | ||
| + | ! | ||
| + | interface TwentyFiveGigE1/ | ||
| + | | ||
| + | | ||
| + | mtu 9100 | ||
| + | | ||
| + | | ||
| + | udld port aggressive | ||
| + | | ||
| + | | ||
| + | ! | ||
| + | | ||
| + | mtu 9100 | ||
| + | ! | ||
| + | interface HundredGigE1/ | ||
| + | mtu 9100 | ||
| + | ! | ||
| + | interface HundredGigE1/ | ||
| + | mtu 9100 | ||
| + | ! | ||
| + | interface HundredGigE1/ | ||
| + | mtu 9100 | ||
| + | |||
| + | ---- | ||
| + | ---- | ||
| + | ====== Troubleshooting PVST Inconsistency between Cisco 9500 and Aruba 6400 ====== | ||
| + | |||
| + | === π§ Context === | ||
| + | Connectivity issue between: | ||
| + | * **Cisco Catalyst 9500** β IP: `172.20.28.37` | ||
| + | * **Aruba 6400** β IP: `172.20.28.1` | ||
| + | Connected via: **Port-channel 2 (Po2)** | ||
| + | |||
| + | === β οΈ Symptom on Cisco === | ||
| + | Output from `show spanning-tree mst`: | ||
| + | Po2 Root BKN*400 P2p Bound(PVST) *PVST_Inc | ||
| + | |||
| + | **Meaning: | ||
| + | * '' | ||
| + | * '' | ||
| + | |||
| + | Cisco is running **MST**, but receives BPDUs from **PVST+ or RSTP** on the peer β risk of loop β port auto-blocked. | ||
| + | |||
| + | === π Root Cause === | ||
| + | Cisco MST expects MST BPDUs. If a non-MST BPDU (e.g., PVST+ or RSTP) is received: | ||
| + | * Cisco sees it as a protocol mismatch. | ||
| + | * The port is blocked to prevent potential Layer 2 loops. | ||
| + | |||
| + | === β Solution: Switched to RSTP === | ||
| + | |||
| + | == On Cisco 9500 == | ||
| + | <code bash> | ||
| + | conf t | ||
| + | spanning-tree mode rapid-pvst | ||
| + | end | ||
| + | write memory | ||
| + | </ | ||
| + | |||
| + | == On Aruba 6400 == | ||
| + | <code bash> | ||
| + | conf t | ||
| + | spanning-tree mode rstp | ||
| + | write memory | ||
| + | </ | ||
| + | |||
| + | **Result:** Port moved to '' | ||
| + | |||
| + | === π§ Verification Commands on Cisco === | ||
| + | ^ Command ^ Description ^ | ||
| + | | `show spanning-tree mst` | View STP mode, port roles, and state | | ||
| + | | `**show spanning-tree inconsistentports**` | **Detect ports blocked due to PVST_Inc** | | ||
| + | | `show spanning-tree detail` | STP root path and BPDU info | | ||
| + | | `show interfaces status` | Verify port operational state | | ||
| + | |||
| + | === π οΈ Key Recommendations === | ||
| + | * Prefer **RSTP** for mixed-vendor environments. | ||
| + | * If using **MST**: | ||
| + | * Ensure identical: | ||
| + | * `name` | ||
| + | * `revision` | ||
| + | * `VLAN-to-instance mapping` | ||
| + | * Avoid mixing PVST and MST without boundary configuration. | ||
| + | * Always verify port status using: | ||
| + | * `**show spanning-tree inconsistentports**` | ||
| + | |||
| + | |||
| + | ---- | ||
| + | ---- | ||
| + | |||
| + | |||
| + | ===== Comparison: Static VXLAN vs VXLAN EVPN ===== | ||
| + | |||
| + | The difference between **Static VXLAN** and **VXLAN EVPN (Ethernet VPN)** lies primarily in **how MACβVTEP (VXLAN Tunnel Endpoint) mappings are learned and distributed**, | ||
| + | |||
| + | ==== π Static VXLAN ==== | ||
| + | |||
| + | **π Definition: | ||
| + | VXLAN using manually defined tunnels (VTEP-to-VTEP), | ||
| + | |||
| + | **π Key Features:** | ||
| + | |||
| + | ^ Feature | ||
| + | | Control Plane | β None | | ||
| + | | MAC Learning | ||
| + | | Configuration | ||
| + | | Scalability | ||
| + | | BUM Traffic Handling| π Multicast or static flooding | ||
| + | | Typical Use Case | π§ͺ Labs, small campuses | ||
| + | |||
| + | ---- | ||
| + | |||
| + | ==== π VXLAN EVPN ==== | ||
| + | |||
| + | **π Definition: | ||
| + | VXLAN with a **BGP EVPN-based control plane**, which dynamically distributes MACβVNIβVTEP bindings across VTEPs. | ||
| + | |||
| + | **π Key Features:** | ||
| + | |||
| + | ^ Feature | ||
| + | | Control Plane | β BGP EVPN | | ||
| + | | MAC Learning | ||
| + | | Configuration | ||
| + | | Scalability | ||
| + | | BUM Traffic Handling| π« Minimized by control-plane | ||
| + | | Typical Use Case | π’ Data centers, cloud, multi-site | | ||
| + | |||
| + | ---- | ||
| + | |||
| + | ^ Summary | ||
| + | | Control Plane | β Manual / flood-based | ||
| + | | MAC Distribution | ||
| + | | Scalability | ||
| + | | Complexity | ||
| + | | Use Cases | Simple links, PtP, lab networks | ||
| + | |||
| + | ---- | ||
| + | |||
| + | ===== VXLAN EVPN L2VPN β CONTROL PLANE (Cisco) ===== | ||
| + | |||
| + | ==== β What is EVPN L2VPN Control Plane? ==== | ||
| + | |||
| + | EVPN (Ethernet VPN) is a BGP-based control plane protocol that enables: | ||
| + | * Dynamic distribution of MAC β VNI β VTEP bindings | ||
| + | * Elimination of unnecessary BUM flooding | ||
| + | * Improved scalability, | ||
| + | |||
| + | In Cisco platforms, EVPN functionality depends on hardware, software version (IOS-XE or NX-OS), and system roles. | ||
| + | |||
| + | ---- | ||
| + | |||
| + | ==== β Platforms that **Support EVPN Control Plane** ==== | ||
| + | |||
| + | ^ Platform | ||
| + | | Nexus 9000 | NX-OS | β Yes | Full L2/L3 EVPN support via BGP | | ||
| + | | Nexus 7000/ | ||
| + | | ASR 9000 | IOS XR | β Yes | Carrier-grade EVPN | | ||
| + | | Catalyst 9500X | IOS-XE | ||
| + | | Catalyst 9600 | IOS-XE | ||
| + | |||
| + | ---- | ||
| + | |||
| + | ==== π« Platforms with **Limited or No EVPN Support** ==== | ||
| + | |||
| + | ^ Platform | ||
| + | | Catalyst 9500 | IOS-XE | ||
| + | | Catalyst 9400 | IOS-XE | ||
| + | | Catalyst 9300 | IOS-XE | ||
| + | | Catalyst 9200 | IOS-XE | ||
| + | | Catalyst 3850 | IOS-XE | ||
| + | |||
| + | ---- | ||
| + | |||
| + | ==== β οΈ EVPN Requirements on Catalyst Platforms (when applicable) ==== | ||
| + | |||
| + | * Minimum IOS-XE version: **17.9.1** | ||
| + | * Required licenses: | ||
| + | * `network-advantage` | ||
| + | * `dna-advantage` | ||
| + | * SDM Template: | ||
| + | * Must be set to `vxlan-routing` (not available on non-X models) | ||
| + | * Configuration method: | ||
| + | * `l2vpn evpn`, `vni`, `rd`, `route-target`, | ||
| + | |||
| + | ---- | ||
| + | |||
| + | ==== π§± Alternative: | ||
| + | |||
| + | For platforms without EVPN, VXLAN can be deployed in **static mode**: | ||
| + | * Define `interface nve1` | ||
| + | * Assign `source-interface` (Loopback) | ||
| + | * Configure `member vni XXXX` | ||
| + | * Use `ingress-replication protocol static` | ||
| + | * Add `peer-ip A.B.C.D` for each remote VTEP | ||
| + | |||
| + | Requires manual mapping and tunnel definition between all VTEPs. | ||
| + | |||
| + | ---- | ||
| + | |||
| + | ==== π Useful Show Commands (Catalyst) ==== | ||
| + | |||
| + | Check software version: | ||
| + | `show version` | ||
| + | |||
| + | Check license status: | ||
| + | `show license summary` | ||
| + | |||
| + | Check SDM template: | ||
| + | `show sdm prefer` | ||
| + | |||
| + | ---- | ||
| + | |||
| + | ==== π Typical Error When EVPN Not Supported ==== | ||
| + | |||
| + | Trying to configure: | ||
| + | `l2vpn evpn` | ||
| + | `vni XXXX l2` | ||
| + | `rd auto` | ||
| + | |||
| + | Returns: | ||
| + | `% Invalid input detected at ' | ||
| + | |||
| + | π This indicates the command is **not supported** in this platform or SDM template. | ||
| + | |||
| + | ---- | ||
| + | |||
| + | ==== β Recommendation ==== | ||
| + | |||
| + | To deploy EVPN-based VXLAN in Cisco networks: | ||
| + | * Use **Nexus (e.g., 9300, 9500)** or **C9500X with `vxlan-routing`** | ||
| + | * Confirm licensing and SDM support | ||
| + | * Use **Static VXLAN** on Catalyst platforms without EVPN capability | ||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | ---- | ||
| + | |||
| + | |||
| + | ===== VXLAN β Core Terminology and Nomenclature ===== | ||
| + | |||
| + | VXLAN (Virtual Extensible LAN) is a tunneling technology that enables Layer 2 overlay networks over Layer 3 IP infrastructures. Below is the essential terminology you need to master: | ||
| + | |||
| + | ---- | ||
| + | |||
| + | ==== π 1. VNI β VXLAN Network Identifier ==== | ||
| + | |||
| + | * **Definition: | ||
| + | * **Range:** 0 to 16,777,215 (2^24 - 1) | ||
| + | * **Purpose: | ||
| + | * **Example: | ||
| + | VLAN 700 β VNI 10700 | ||
| + | |||
| + | ---- | ||
| + | |||
| + | ==== π 2. VTEP β VXLAN Tunnel Endpoint ==== | ||
| + | |||
| + | * **Definition: | ||
| + | * **Purpose: | ||
| + | * **Key Point:** Each VTEP has a loopback or logical IP (used as tunnel endpoint). | ||
| + | * **Example: | ||
| + | Cisco VTEP IP = `172.18.32.33` | ||
| + | |||
| + | ---- | ||
| + | |||
| + | ==== π 3. NVE β Network Virtualization Edge ==== | ||
| + | |||
| + | * **Definition: | ||
| + | * **Command Example (IOS-XE):** | ||
| + | ```bash | ||
| + | interface nve1 | ||
| + | | ||
| + | | ||
| + | ``` | ||
| + | * **Note:** In NX-OS, you must use `feature nv overlay`; in IOS-XE itβs implicit. | ||
| + | |||
| + | ---- | ||
| + | |||
| + | ==== π 4. Bridge Domain (BD) ==== | ||
| + | |||
| + | * **Definition: | ||
| + | * **In IOS-XE:** Binding is done via: | ||
| + | ```bash | ||
| + | l2 vni 10700 vlan 700 | ||
| + | ``` | ||
| + | * **In NX-OS:** Itβs tied to a `bridge-domain` with its own config space. | ||
| + | |||
| + | ---- | ||
| + | |||
| + | ==== π 5. Ingress Replication ==== | ||
| + | |||
| + | * **Purpose: | ||
| + | * **Modes:** | ||
| + | - `static`: manual peer definition | ||
| + | - `multicast`: | ||
| + | |||
| + | ---- | ||
| + | |||
| + | ==== π 6. Underlay vs Overlay ==== | ||
| + | |||
| + | * **Underlay: | ||
| + | - The physical IP network that connects VTEPs (e.g., `172.18.32.0/ | ||
| + | - Uses IGP or static routing | ||
| + | * **Overlay: | ||
| + | - The logical L2 network created by VXLAN | ||
| + | - Carries tenant VLANs across routed core | ||
| + | |||
| + | ---- | ||
| + | |||
| + | ==== π 7. BUM β Broadcast, Unknown Unicast, Multicast ==== | ||
| + | |||
| + | * **Definition: | ||
| + | * **Handled in VXLAN by:** | ||
| + | - Static `ingress-replication` | ||
| + | - Multicast (if supported by underlay) | ||
| + | |||
| + | ---- | ||
| + | |||
| + | ==== π§Ύ Summary Table ==== | ||
| + | |||
| + | ^ Element | ||
| + | | VLAN | Traditional L2 segment | ||
| + | | VNI | VXLAN segment identifier | ||
| + | | VTEP (Local) | ||
| + | | VTEP (Remote) | ||
| + | | NVE Interface | ||
| + | | Underlay | ||
| + | | Overlay | ||
| + | |||
| + | ---- | ||
| + | |||
| + | ==== β
VXLAN overlays | ||
| + | |||
| + | allow to: | ||
| + | * Stretch VLANs across L3 boundaries | ||
| + | * Enable mobility and segmentation | ||
| + | * Scale beyond 4094 VLAN limit using 16 million VNIs | ||
| + | |||
| + | ---- | ||
| + | ---- | ||
| + | |||
| + | ====== VXLAN Static Configuration β Cisco 9500 β Aruba 6300 ====== | ||
| + | |||
| + | === π Architecture Summary === | ||
| + | |||
| + | ^ Parameter | ||
| + | | VTEP Loopback IP | 172.22.32.1 | ||
| + | | Transport IP | 172.18.32.33 (To Aruba) | ||
| + | | Transport Interface | ||
| + | | OSPF Area | 0 | 0 | | ||
| + | | VXLAN Mode | Static VXLAN | Static VXLAN | | ||
| + | | VXLAN Interface | ||
| + | | VNIs | 10001, 10700β10732 | ||
| + | | Inter-VXLAN Bridging | ||
| + | |||
| + | ---- | ||
| + | |||
| + | === π Cisco 9500 Configuration === | ||
| + | |||
| + | ==== πΉ 1. VTEP Loopback ==== | ||
| + | interface Loopback0 | ||
| + | ip address 172.22.32.1 255.255.255.255 | ||
| + | |||
| + | ==== πΉ 2. Transport Interface ==== | ||
| + | interface TenGigabitEthernet1/ | ||
| + | | ||
| + | ip address 172.18.32.33 255.255.255.252 | ||
| + | no shutdown | ||
| + | |||
| + | ==== πΉ 3. OSPF ==== | ||
| + | router ospf 100 | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | ==== πΉ 4. Static Route ==== | ||
| + | ip route 172.22.32.2 255.255.255.255 172.18.32.34 | ||
| + | |||
| + | ==== πΉ 5. NVE Interface ==== | ||
| + | interface nve1 | ||
| + | no shutdown | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | ==== πΉ 6. Bridge Domains ==== | ||
| + | bridge-domain 1 | ||
| + | | ||
| + | |||
| + | bridge-domain 700 | ||
| + | | ||
| + | |||
| + | bridge-domain 712 | ||
| + | | ||
| + | |||
| + | bridge-domain 730 | ||
| + | | ||
| + | |||
| + | bridge-domain 732 | ||
| + | | ||
| + | |||
| + | ---- | ||
| + | |||
| + | === π§© Aruba 6300 Configuration === | ||
| + | |||
| + | ==== πΉ 1. Loopback Interface ==== | ||
| + | interface loopback 0 | ||
| + | ip address 172.22.32.2/ | ||
| + | |||
| + | ==== πΉ 2. Transport Interface ==== | ||
| + | interface 1/1/12 | ||
| + | | ||
| + | ip address 172.18.32.34/ | ||
| + | no shutdown | ||
| + | |||
| + | ==== πΉ 3. OSPF ==== | ||
| + | router ospf | ||
| + | | ||
| + | area 0.0.0.0 | ||
| + | | ||
| + | | ||
| + | |||
| + | ==== πΉ 4. Static Route ==== | ||
| + | ip route 172.22.32.1/ | ||
| + | |||
| + | ==== πΉ 5. VXLAN Interface ==== | ||
| + | interface vxlan 1 | ||
| + | | ||
| + | | ||
| + | |||
| + | ==== πΉ 6. VNI to VLAN Mapping ==== | ||
| + | vxlan vlan 1 vni 10001 | ||
| + | vxlan vtep 172.22.32.1 | ||
| + | |||
| + | vxlan vlan 700 vni 10700 | ||
| + | vxlan vtep 172.22.32.1 | ||
| + | |||
| + | vxlan vlan 712 vni 10712 | ||
| + | vxlan vtep 172.22.32.1 | ||
| + | |||
| + | vxlan vlan 730 vni 10730 | ||
| + | vxlan vtep 172.22.32.1 | ||
| + | |||
| + | vxlan vlan 732 vni 10732 | ||
| + | vxlan vtep 172.22.32.1 | ||
| + | |||
| + | ---- | ||
| + | |||
| + | === π§ͺ Validation Commands === | ||
| + | |||
| + | ==== πΈ Cisco 9500 ==== | ||
| + | show nve interface nve1 | ||
| + | show nve vni summary | ||
| + | show nve vni interface nve 1 | ||
| + | show nve peers | ||
| + | ping 172.22.32.2 source 172.22.32.1 | ||
| + | show mac address-table vlan 712 | ||
| + | |||
| + | ==== πΈ Aruba 6300 ==== | ||
| + | show interface vxlan 1 | ||
| + | show interface vxlan vni vteps | ||
| + | ping 172.22.32.1 source 172.22.32.2 | ||
| + | show mac-address-table vlan 712 | ||
| + | |||
| + | |||
| + | |||
| + | === β Notes === | ||
| + | |||
| + | * The VXLAN tunnels use **static replication** for simplicity and full control. | ||
| + | * Ensure **Loopback reachability** via static route or OSPF in both directions. | ||
| + | * For production EVPN deployment, BGP configuration will be required. | ||
| + | |||
| + | |||
| + | |||
| + | ---- | ||
| + | ---- | ||
| + | {{ : | ||
| + | |||
| + | {{pdfjs 46em >: | ||
| + | ---- | ||
| + | ---- | ||
| + | |||
| + | |||
| + | {{ : | ||
| + | |||
| + | {{pdfjs 46em >: | ||
| + | ---- | ||
| + | ---- | ||
cisco/switch/9500/cisco_catalyst_9500_series_manual.1740408229.txt.gz Β· Last modified: 2025/02/24 09:43 by aperez
