nexus 01 guide confi

version 6.1(3)hostname Nexus01no system admin-vdc

!! -------------- Auto Generated -------------- !!vdc Nexus01 id 1 limit-resource module-type f2 cpu-share 5 allocate interface Ethernet3/1-48 limit-resource vlan minimum 16 maximum 4094 limit-resource monitor-session minimum 0 maximum 2 limit-resource monitor-session-erspan-dst minimum 0 maximum 23 limit-resource vrf minimum 2 maximum 4096 limit-resource port-channel minimum 0 maximum 768 limit-resource u4route-mem minimum 96 maximum 96 limit-resource u6route-mem minimum 24 maximum 24 limit-resource m4route-mem minimum 58 maximum 58 limit-resource m6route-mem minimum 8 maximum 8 limit-resource monitor-session-inband-src minimum 0 maximum 1cfs eth distribute

!! -------------- Unlike Catalyst, most features are disabled on Nexus, Enable only what you need -------------- !!feature pimfeature eigrpfeature udldfeature interface-vlanfeature netflowfeature hsrpfeature lacpfeature dhcpfeature vpc

clock protocol ntp vdc 1

logging level l2fm 5username admin password 5 FAKEPASS***** role network-adminip domain-lookupip domain-name issinc.comip name-server 10.0.0.10 10.0.0.15

radius-server host 10.0.0.12 key 7 "FAKERADIUSKEY" authentication accounting aaa group server radius RADIUSServer server 10.0.0.12 source-interface Vlan100

!! -------------- SNMP ACL -------------- !!ip access-list 7 10 remark ~~~~ SNMP Server ~~~~ 30 permit ip 10.0.0.106/0 any 40 remark ~~~~ END SNMP Server ~~~~

!! --------------Voice ACL Applied to VLAN 1105 -------------- !!ip access-list VoiceACL 1 remark ~~~~~ Voice ACL ~~~~~ 10 permit ip any 10.0.0.10/32 20 permit ip any 10.0.0.15/32 !! -------------- The next line of the ACL is necessary to allow HSRP V2 messages between the 2 Nexus Switches -------------- !! 29 permit ip any 224.0.0.102/32 30 permit ip 10.0.105.0/24 10.0.100.0/24 40 permit ip 10.0.105.0/24 10.0.101.0/24 150 remark ~~~~~ End Voice ACL ~~~~~

!! -------------- Auto Generated -------------- !!copp profile strictsnmp-server location MDFsnmp-server user admin network-admin auth md5 0x******** priv 0x********* localizedkeyrmon event 1 log trap public description FATAL(1) owner PMON@FATALrmon event 2 log trap public description CRITICAL(2) owner PMON@CRITICALrmon event 3 log trap public description ERROR(3) owner PMON@ERRORrmon event 4 log trap public description WARNING(4) owner PMON@WARNINGrmon event 5 log trap public description INFORMATION(5) owner PMON@INFO

!! -------------- SNMP Setup and using ACL 7-------------- !!snmp-server community ****** group network-operatorsnmp-server community ****** use-acl 7

!! -------------- Our Nexus' are NTP masters for our network and are synced and authenticated with NIST -------------- !!ntp server 24.56.178.141 key 12345ntp server 132.163.4.107 prefer key 12345ntp authenticatentp authentication-key 12345 md5 ************ 7ntp loggingntp master 2

aaa authentication login default group RADIUSServer

!! -------------- Static Default Gateway to the ASA Active IP address You CANNOT run a routing protocol between an ASA and the Nexus pair if the ASAs are on a vPC link -------------- !!ip route 0.0.0.0/0 10.0.255.18

ip pim ssm range 232.0.0.0/8ip pim pre-build-sptvrf context management

!! -------------- For brevity I've removed the majority of the VLANs from this config -------------- !!vlan 1,10,12,20,30,40,50,60,80,100,998,999,1105,

!! -------------- Netflow Config -------------- !!flow exporter FLOW-EXPORTER-1 destination 10.0.0.106 transport udp 2055 source Vlan100 version 5flow record FLOW-RECORD-1 match ipv4 source address match ipv4 destination address match transport source-port match transport destination-port collect counter bytes collect counter packetssampler FLOW-SAMPLER-1 mode 10 out-of 1000flow monitor FLOW-MONITOR-1 record FLOW-RECORD-1 exporter FLOW-EXPORTER-1

!! -------------- For brevity I've removed the majority of the VLANs from this config -------------- !!vlan 10 name FirstFloorNvlan 12 name FirstFloorSvlan 20 name SecondFloorSvlan 30 name ThirdFloorSvlan 40 name FourthFloorvlan 50 name WirelessAccessvlan 60 name SecondFloorNvlan 80 name Specialvlan 100 name Serversvlan 998 name CoreL3Linkvlan 999 name InternetEdgevlan 1105 name Voip_WiFi

!! -------------- Nexus01 is the Spanning-tree Root Primary, Nexus02 is the Secondary-------------- !!spanning-tree vlan 1-3967 priority 24576

!! -------------- Nexus handles EIGRP very differently than Catalyst, route maps are required to redistribute static and connected routes -------------- !!route-map eigrp-direct-rt permit 10route-map eigrp-static-rt permit 10

!! -------------- HSRP Key for authenticated HSRP messages -------------- !!key chain hsrp-key key 0 key-string 7 FAKEHSRPKEY*****

service dhcpip dhcp relay

!! -------------- This is the VPC Config to allow the 2 switches to establish a peer relationship Nexus02 has a higher priority and the IPs for the keep alive are reversed, otherwise it has the same config -------------- !!vpc domain 100 role priority 10 peer-keepalive destination 1.255.255.2 source 1.255.255.1!! -------------- The VLAN that the 2 Nexus switches use to exchange EIGRP routes should be excluded from the peer-gateway feature -------------- !! peer-gateway exclude-vlan 998 auto-recovery ip arp synchronize

interface Vlan1 no ip redirects no ipv6 redirects

!! --------------Each VLAN is the same 10.x.x.3 on Nexus01 and 10.x.x.4 on Nexus02 -------------- !!!! -------------- Nexus02 has the default priority of 100 on each HSRP config making Nexus01 the primary -------------- !!interface Vlan10 ip flow monitor FLOW-MONITOR-1 input sampler FLOW-SAMPLER-1 no ip redirects ip address 10.0.1.3/24 no ipv6 redirects hsrp version 2 hsrp 10 authentication md5 key-chain hsrp-key preempt priority 110 ip 10.0.1.1 ip dhcp relay address 10.0.0.40 description ~~~~~ 1st Floor North Access ~~~~~ no shutdown

interface Vlan12 ip flow monitor FLOW-MONITOR-1 input sampler FLOW-SAMPLER-1 no ip redirects ip address 10.0.12.3/24 no ipv6 redirects hsrp version 2 hsrp 12 authentication md5 key-chain hsrp-key preempt priority 110 ip 10.0.12.1 ip dhcp relay address 10.0.0.40 description ~~~~~ 1st Floor South Access ~~~~~ no shutdown

interface Vlan20 ip flow monitor FLOW-MONITOR-1 input sampler FLOW-SAMPLER-1 no ip redirects ip address 10.0.2.3/24 no ipv6 redirects hsrp version 2 hsrp 20 authentication md5 key-chain hsrp-key preempt priority 110 ip 10.0.2.1 ip dhcp relay address 10.0.0.40 description ~~~~~ 2nd Floor South Access ~~~~~ no shutdown

interface Vlan30 ip flow monitor FLOW-MONITOR-1 input sampler FLOW-SAMPLER-1 no ip redirects ip address 10.0.3.3/24 no ipv6 redirects hsrp version 2 hsrp 30 authentication md5 key-chain hsrp-key preempt priority 110 ip 10.0.3.1 ip dhcp relay address 10.0.0.40 description ~~~~~ 3rd Floor South Access ~~~~~ no shutdown

interface Vlan40 ip flow monitor FLOW-MONITOR-1 input sampler FLOW-SAMPLER-1 no ip redirects ip address 10.0.4.3/24 no ipv6 redirects hsrp version 2 hsrp 40 authentication md5 key-chain hsrp-key preempt priority 110 ip 10.0.4.1 ip dhcp relay address 10.0.0.40 description ~~~~~ 4th Floor North Access ~~~~~ no shutdown

interface Vlan50 ip flow monitor FLOW-MONITOR-1 input sampler FLOW-SAMPLER-1

no ip redirects ip address 10.0.5.3/24 no ipv6 redirects hsrp version 2 hsrp 50 authentication md5 key-chain hsrp-key preempt priority 110 ip 10.0.5.1 ip dhcp relay address 10.0.0.40 description ~~~~~ Wireless Access VLAN ~~~~~ no shutdown

interface Vlan60 ip flow monitor FLOW-MONITOR-1 input sampler FLOW-SAMPLER-1 no ip redirects ip address 10.0.6.3/24 no ipv6 redirects hsrp version 2 hsrp 60 authentication md5 key-chain hsrp-key preempt priority 110 ip 10.0.6.1 ip dhcp relay address 10.0.0.40 description ~~~~~ 2nd Floor North Access ~~~~~ no shutdown

interface Vlan80 ip flow monitor FLOW-MONITOR-1 input sampler FLOW-SAMPLER-1 no ip redirects ip address 10.0.8.3/24 no ipv6 redirects hsrp version 2 hsrp 80 authentication md5 key-chain hsrp-key preempt priority 110 ip 10.0.8.1 ip dhcp relay address 10.0.0.40 description ~~~~~ Special Vlan ~~~~~ no shutdown

interface Vlan100 ip flow monitor FLOW-MONITOR-1 input sampler FLOW-SAMPLER-1 no ip redirects ip address 10.0.0.3/24 no ipv6 redirects hsrp version 2 hsrp 100 authentication md5 key-chain hsrp-key preempt priority 110 ip 10.0.0.1 description ~~~~~ Corporate Servers ~~~~~ no shutdown

!! -------------- This VLAN is excluded from all vPC links except the peer link It allows Nexus01 and Nexus02 to exchange EIGRP routes -------------- !!interface Vlan998 ip flow monitor FLOW-MONITOR-1 input sampler FLOW-SAMPLER-1 ip address 10.0.255.33/30 ip router eigrp 10 description ~~~~~ Core Switch Layer 3 Interface ~~~~~ no shutdown

!! -------------- Internet Edge VLAN this is the VLAN the ASA firewalls sit in -------------- !!interface Vlan999 ip flow monitor FLOW-MONITOR-1 input sampler FLOW-SAMPLER-1 no ip redirects ip address 10.0.255.22/28 no ipv6 redirects hsrp version 2 hsrp 999 authentication md5 key-chain hsrp-key preempt priority 110 ip 10.0.255.17 description ~~~~~ Internet Edge VLAN ~~~~~ no shutdown

!! -------------- This VLAN includes and ACL that originally broke HSRP (both routers were active) see the note in the ACL previously in the config on allowing HSRP messages to be exchanged between the Nexus switches -------------- !!interface Vlan1105 ip access-group VoiceACL in

ip flow monitor FLOW-MONITOR-1 input sampler FLOW-SAMPLER-1 no ip redirects ip address 10.0.105.3/24 no ipv6 redirects ip pim sparse-mode ip pim dr-priority 100 hsrp version 2 hsrp 1105 authentication md5 key-chain hsrp-key preempt priority 110 ip 10.0.105.1 ip dhcp relay address 10.0.0.40 description ~~~~~ Wireless VoIP ~~~~~ no shutdown

!! -------------- This is the vPC peer-link -------------- !!interface port-channel1 switchport switchport mode trunk spanning-tree port type network vpc peer-link

!! -------------- This vPC connects the Nexus 7000 Core to the Nexus Data Center switches This is a called a back-to-back vPC -------------- !!!! -------------- It's a good idea to only allow the VLANs that are required on a vPC trunk port -------------- !!interface port-channel2 description ~~~~~ Nexus 5K Switches ~~~~~ switchport switchport mode trunk switchport trunk allowed vlan 2-9,11,13-19,21-29,31-39,41-49,51-59 switchport trunk allowed vlan add 61-79,81-114,119-1100,1106-1111 vpc 2

!! -------------- To the Primary ASA Firewall -------------- !!interface port-channel7 description ~~~~~ ASA FW 01 ~~~~~ switchport switchport access vlan 999 vpc 7

!! -------------- To the Secondary ASA Firewall -------------- !!interface port-channel8 description ~~~~~ 1NM1-CFW02 ~~~~~ switchport switchport access vlan 999 vpc 8

!! -------------- Access Switch in the MDF with the Core Switches for 10/100Mb devices that cannot connect to the F2 card -------------- !!interface port-channel10 description ~~~~ Core Access devices ~~~~ switchport switchport mode trunk switchport trunk allowed vlan 100,111,115,152,160,200,999,1100-1101 vpc 10

!! -------------- Wireless LAN Controller 5508 -------------- !!interface port-channel11 description ~~~~~ 1NM1-CWL01 ~~~~~ switchport switchport mode trunk switchport trunk native vlan 50 switchport trunk allowed vlan 50,80,110,115-118,1105 vpc 11

!! -------------- Access Switch -------------- !!interface port-channel20 description ~~~~~ 1NM1-ASW01 ~~~~~ switchport switchport mode trunk switchport trunk allowed vlan 10,1101 vpc 20

!! -------------- Access Switch -------------- !!interface port-channel21 description ~~~~~ 1SI1-ASW01 ~~~~~ switchport switchport mode trunk switchport trunk allowed vlan 12,115,1112 vpc 21

!! -------------- Access Switch -------------- !!interface port-channel22 description ~~~~~ 2NI1-ASW01 ~~~~~ switchport

switchport mode trunk switchport trunk allowed vlan 60,110,1106 vpc 22

!! -------------- Access Switch -------------- !!interface port-channel23 description ~~~~~ 2SI1-ASW01 ~~~~~ switchport switchport mode trunk switchport trunk allowed vlan 20,130,152,1102 vpc 23

!! -------------- Access Switch -------------- !!interface port-channel24 description ~~~~~ 3SI1-ASW01 ~~~~~ switchport switchport mode trunk switchport trunk allowed vlan 30,1103 vpc 24

!! -------------- Access Switch -------------- !!interface port-channel25 description ~~~~~ 4NI1-ASW01 ~~~~~ switchport switchport mode trunk switchport trunk allowed vlan 40,80,130,1104 vpc 25

!! -------------- Peer Link Physical Port -------------- !!interface Ethernet3/1 description ~~~~ vPC peer-link ~~~~ switchport switchport mode trunk channel-group 1 mode active no shutdown

!! -------------- Peer Link Physical Port -------------- !!interface Ethernet3/2 description ~~~~ vPC peer-link ~~~~ switchport switchport mode trunk channel-group 1 mode active no shutdown

!! -------------- Data Center Switch Physical Port -------------- !!interface Ethernet3/3 description ~~~~~ 1SD1-DSW01 ~~~~~ switchport switchport mode trunk switchport trunk allowed vlan 2-9,11,13-19,21-29,31-39,41-49,51-59 switchport trunk allowed vlan add 61-79,81-114,119-1100,1106-1111 switchport trunk allowed vlan add 1113-4094 channel-group 2 mode active no shutdown

!! -------------- Data Center Switch Physical Port -------------- !!interface Ethernet3/4 description ~~~~~ 1SD1-DSW02 ~~~~~ switchport switchport mode trunk switchport trunk allowed vlan 2-9,11,13-19,21-29,31-39,41-49,51-59 switchport trunk allowed vlan add 61-79,81-114,119-1100,1106-1111 switchport trunk allowed vlan add 1113-4094 channel-group 2 mode active no shutdown

interface Ethernet3/5


!! -------------- ASA Firewall 01 Physical Port -------------- !!interface Ethernet3/7 description ~~~~~ 1NM1-CFW01 ~~~~~ switchport switchport access vlan 999 channel-group 7 mode active no shutdown

!! -------------- ASA Firewall 02 Physical Port -------------- !!interface Ethernet3/8 description ~~~~~ 1NM1-CFW02 ~~~~~ switchport switchport access vlan 999

channel-group 8 mode active no shutdown


!! -------------- Access Switch Physical Port -------------- !!interface Ethernet3/10 description ~~~~ 1NM1-CSW03 ~~~~ switchport switchport mode trunk switchport trunk allowed vlan 100,111,115,152,160,200,999,1100-1101 channel-group 10 mode active no shutdown

!! -------------- Wireless Controller Physical Port -------------- !!interface Ethernet3/11 description ~~~~~ 1NM1-CWL01 ~~~~~ switchport switchport mode trunk switchport trunk native vlan 50 switchport trunk allowed vlan 50,80,110,115-118,1105 channel-group 11 no shutdown




!! -------------- Remote Building Routed Link 1 (EIGRP prefers this link to the lower bandwidth link connected to Nexus02 -------------- !!interface Ethernet3/15 description ~~~~~ 2NM1-CSW01 Microwave Connection ~~~~~ ip flow monitor FLOW-MONITOR-1 input sampler FLOW-SAMPLER-1 ip address 10.0.255.9/29 ip router eigrp 10 no shutdown

!! -------------- MPLS Router 1 Connection 1 (another routed link with different /30 IPs is connected to Nexus02) -------------- !!interface Ethernet3/16 description ~~~~~ 1NM1-CRT01 MPLS WAN ~~~~~ ip flow monitor FLOW-MONITOR-1 input sampler FLOW-SAMPLER-1 ip address 10.0.255.37/30 ip router eigrp 10 no shutdown

!! -------------- MPLS Router 2 Connection 1 (another routed link with different /30 IPs is connected to Nexus02) -------------- !!interface Ethernet3/17 description ~~~~~ 1NM1-CRT02 MPLS WAN ~~~~~ ip flow monitor FLOW-MONITOR-1 input sampler FLOW-SAMPLER-1 ip address 10.0.255.45/30 ip router eigrp 10 no shutdown



!! -------------- Access Switch Physical Port -------------- !!interface Ethernet3/20

description ~~~~~ 1NM1-ASW01 ~~~~~ switchport switchport mode trunk switchport trunk allowed vlan 10,1101 channel-group 20 mode active no shutdown

!! -------------- Access Switch Physical Port -------------- !!interface Ethernet3/21 description ~~~~~ 1SI1-ASW01 ~~~~~ switchport switchport mode trunk switchport trunk allowed vlan 12,115,1112 channel-group 21 mode active no shutdown

!! -------------- Access Switch Physical Port -------------- !!interface Ethernet3/22 description ~~~~~ 2NI1-ASW01 ~~~~~ switchport switchport mode trunk switchport trunk allowed vlan 60,110,1106 channel-group 22 mode active no shutdown

!! -------------- Access Switch Physical Port -------------- !!interface Ethernet3/23 description ~~~~~ 2SI1-ASW01 ~~~~~ switchport switchport mode trunk switchport trunk allowed vlan 20,130,152,1102 channel-group 23 mode active no shutdown

!! -------------- Access Switch Physical Port -------------- !!interface Ethernet3/24 description ~~~~~ 3SI1-ASW01 ~~~~~ switchport switchport mode trunk switchport trunk allowed vlan 30,1103 channel-group 24 mode active no shutdown

!! -------------- Access Switch Physical Port -------------- !!interface Ethernet3/25 description ~~~~~ 4NI1-ASW01 ~~~~~ switchport switchport mode trunk switchport trunk allowed vlan 40,80,130,1104 channel-group 25 mode active no shutdown

!! -------------- Ports 3/26 through 3/48 omitted -------------- !!

!! -------------- Peer Keep-Alive IP -------------- !!!! -------------- All 4 Management 0 interfaces are plugged into a switch with a private VLAN to allow an out of band keep-alive -------------- !!interface mgmt0 ip address 1.255.255.1/24

clock timezone MST -7 0clock summer-time MDT 2 Sun Mar 02:00 1 Sun Nov 02:00 60line consoleline vty!! -------------- I used ISSU to upgrade both Nexus switch sot 6.1.3 without issue on this setup -------------- !!boot kickstart bootflash:/n7000-s2-kickstart.6.1.3.bin sup-1boot system bootflash:/n7000-s2-dk9.6.1.3.bin sup-1boot kickstart bootflash:/n7000-s2-kickstart.6.1.3.bin sup-2boot system bootflash:/n7000-s2-dk9.6.1.3.bin sup-2

!! --------------Nexus EIGRP is different, notice there are no network statement and instead several interfaces are running eigrp 10 -------------- !!router eigrp 10 default-metric 102400 10 255 1 1500 redistribute direct route-map eigrp-direct-rt redistribute static route-map eigrp-static-rt

!! -------------- Very important command! Read up on hardware glean throttling Cisco should have this on by default -------------- !!hardware ip glean throttle

logging server 10.0.0.202 6

nexus 01 guide confi

Documents