Table of Contents

n1000v_rn.fm

Cisco Nexus 1000V Release Notes, Release 5.2(1)SV3(1.2)

First Published: 2014-11-13

2016-04-01

This document describes the features, limitations, and restrictions for the Cisco Nexus 1000V for VMware Release 5.2(1)SV3(1.2). It also explains how to find information about bugs. The following table lists the change history for this document.

Date

Description

2016-04-01

Noted that scale limits for the Cisco Nexus 1000V Essential edition are half of the values of the Cisco Nexus 1000V Advanced edition.

2015-12-03

Added information about the access-class command in the Access Lists section.

2015-11-17

Added the SNMP User Accounts Must Be Reconfigured After an Upgrade section.

2015-09-24

Updated VTEP configuration limit information.

2015-01-30

Added the Deprecated and Removed Features section to note that vCenter plug-in support is deprecated.

2015-01-14

Noted that configuration container names must be unique.

2014-12-23

Added the ERSPAN section.

Content

This document includes the following sections:

- Introduction

- Software Compatibility with VMware

- Software Compatibility with Cisco Nexus 1000V

- New Software Features

- Changed Software Features

- Deprecated and Removed Features

- Limitations and Restrictions

- Using the Bug Search Tool

- Resolved Bugs

- MIB Support

- Documentation Feedback

- Related Documentation

- Obtaining Documentation and Submitting a Service Request

Introduction

The Cisco Nexus 1000V for VMware provides a distributed, Layer 2 virtual switch that extends across many virtualized hosts. The Cisco Nexus 1000V manages a data center defined by the vCenter Server. Each server in the data center is represented as a line card in the Cisco Nexus 1000V and can be managed as if it were a line card in a physical Cisco switch.

The Cisco Nexus 1000V consists of the following components:

- Virtual Supervisor Module (VSM), which contains the Cisco CLI, configuration, and high-level features.

- Virtual Ethernet Module (VEM), which acts as a line card and runs in each virtualized server to handle packet forwarding and other localized functions.

Software Compatibility with VMware

.

Note The Cisco Nexus 1000V supports all virtual machine network adapter types that VMware vSphere supports. Refer to the VMware documentation when choosing a network adapter. For more information, see the VMware Knowledge Base article #1001805.

Software Compatibility with Cisco Nexus 1000V

.

New Software Features

This section describes the new software features in Cisco Nexus 1000V 5.2(1)SV3(1.2).

Cisco TrustSec RBACL Logging

You can use role-based access control list (RBACL) logging to monitor flows that affect specific RBACLs. The RBACLs can be configured with the optional log keyword in each of the access control entries (ACEs).

When you configure an option, statistics for each flow that match the RBACL permit or deny conditions that you enter are logged in the software.

VDP on VLANs

The Virtual Station Interface (VSI) Discovery and Configuration Protocol (VDP) on the Cisco Nexus 1000V is part of the IEEE standard 802.1Qbg (Edge Virtual Bridging). VDP can detect and signal the presence of end hosts and define message exchanges with an adjacent VDP-capable bridge. You can now configure VDP on one or more VLANs.

Changed Software Features

This section describes the changed software features in Cisco Nexus 1000V Release 5.2(1)SV3(1.2).

Cisco Virtual Switch Update Manager

Cisco Virtual Switch Update Manager (VSUM) Release 1.1 lets you install a Cisco Nexus 1000V switch by creating a new VSM or by using an existing VSM that is on a Cisco Nexus Cloud Services Platform (CSP). In the earlier release, you could install a Cisco Nexus 1000V switch only by creating a new VSM.

.

Deprecated and Removed Features

Support of the vCenter plug-in is deprecated in this release. Cisco VSUM has replaced vCenter plug-in functionality.

Limitations and Restrictions

This section describes the limitations and restrictions of the Cisco Nexus 1000V for VMware.

Configuration Scale Limits

The following table lists the configuration scale limit information for the Cisco Nexus 1000V Advanced edition.

Note The scale limits for the Cisco Nexus 1000V Essential edition are half of the values stated in the following table.

Table 1 Configuration Scale Limits for Cisco Nexus 1000V

Feature

VEM

DVS

Other

Hosts/DVS

—

250 (includes gateways)

—

Total vEth ports

1000

10,240

—

Ports per port profile

1024

2048

—

Port profiles

6144

6144

—

Physical NICs

32

2000

—

Physical trunks

32

2000

—

vEthernet trunks

32

1024

—

Port channels

8

1024

—

Active VLANs

4094

4094

—

VXLANs (bridge domains)

6144

6144

—

VXLAN gateway pairs

1

8

—

VXLAN mappings

512 per gateway

4094

—

VXLAN trunks

32

1024

—

VXLAN mappings per trunk

512

—

—

VXLAN VNI

1044

6144

—

VTEPs

4

1024

512 per bridge domain

BGP peers

8 VSM

—

—

Route reflectors

—

—

2 per VXLAN control plane

MAC addresses

32,000

—

—

MAC address per VLAN

4094

4094

—

DHCP IP bindings

1024

10,240

—

ACLs

128

128

—

ACEs per ACL

—

128

—

ACL instances

6000

42,000

6 instances per port

Net Flow policies

32,000 flows

- 64 monitor sessions

- 64 records

- 64 exporters

—

QoS policy maps

—

128

—

QoS class maps

—

1024

—

QoS class maps/policy maps

—

—

64

QoS instances (ingress and egress)

—

9000

—

Multicast groups

1024

1024

—

PVLANs

512

512

—

Port security MACs

2048

24,000

5 MACs per port

SPAN/ERSPAN sessions

64

64

—

Source interfaces per session

—

- 128 vEths

or

- 32 physical Eths or port channels

—

Source VLANs per session

—

32

—

Destination interfaces per session

—

32

—

SPAN sessions per source interface

—

4

—

Source profiles per session

—

16

—

Destination profiles per session

—

8

—

Cisco TrustSec

—

- 2000 IPSGT mappings

- 128 SGACLs

- 128 ACEs per SGACL

- 8 SXP peers

—

Number of VSMs per VC

—

—

64

Domain ID range

—

—

1–1023

VSG Release 5.2(1)VSG2(1.2) Limitations

:

Table 2 Configuration Scale Limits for Cisco Virtual Services Gateway

Feature

VEM

DVS

Number of VEM Modules

VSG

512 vEth ports per VEM

6,000 vEth ports

128 per DVS

AVS Release 5.2(1)SV3(1.2) Limitations

:

Table 3 Configuration Scale Limits for Cisco Application Virtual Switch

Feature

VEM

Top of Rack

AVS

300 vEth ports per VEM

40 VEM modules

VDP Release 5.2(1)SV3(1.2) Limitations

:

Table 4 Configuration Scale Limits for VSI Discovery Protocol

Feature

VEM

DVS

Number of VEM Modules

VDP

300 vEth ports per VEM

4000 vEth ports

128 per DVS

Configuration Container Names Must Be Unique

All Cisco Nexus 1000V VSM configuration containers—port profiles, bridge domains, ACLs, class maps, policy maps, and so on—must have unique names.

.

In later releases, you cannot create two configuration containers (for example, two port profiles) with the same name but different case sensitivity. During an upgrade, one of the port profiles with a duplicate name is deleted, which moves the corresponding ports in vCenter into quarantined state.

For example, do not create bridge domains with the same name (one uppercase, one lowercase) that point to different segments. (See Example 1 and Example 2.)

Example 1 Uppercase Example

VSM-DAOX-DVS1# show bridge-domain VXLAN14095

Bridge-domain VXLAN14095 (0 ports in all)

Segment ID: 12333 (Manual/Active)

Mode: Unicast-only

MAC Distribution: Disable

BGP control mode: Enable

Group IP: NULL

Encap Mode: VXLAN*

State: UP Mac learning: Enabled

Example 2 Lowercase Example

VSM-DAOX-DVS1# show bridge-domain vxlan14095

Bridge-domain vxlan14095 (0 ports in all)

Segment ID: 14095 (Manual/Active)

Mode: Unicast-only

MAC Distribution: Disable

BGP control mode: Enable

Group IP: 237.1.1.196

Encap Mode: VXLAN*

State: UP Mac learning: Enabled

Single VMware Data Center Support

The Cisco Nexus 1000V for VMware can be connected to a single VMware vCenter Server data center object. Note that this virtual data center can span multiple physical data centers.

Each VMware vCenter can support multiple Cisco Nexus 1000V VSMs per vCenter data center.

VDP

Implementing VDP on the Cisco Nexus 1000V has the following limitations and restrictions:

- The Cisco Nexus 1000V supports the Cisco DFA-capable VDP based on the IEEE Standard 802.1 Qbg, Draft 2.2, and does not support the Link Layer Discovery Protocol (LLDP). Therefore, the EVB type, length, and value are not originated or processed by the Cisco Nexus 1000V.

- The VDP implementation in the current release supports a matching LLDP-less implementation on the bridge side, which is delivered as part of the Cisco DFA solution. For more information on the Cisco DFA, see the Cisco DFA Solutions Guide.

- Timer-related parameters are individually configurable in the station and in the leaf.

- Connectivity to multiple unclustered bridges is not supported.

- IPv6 addresses in filter format are not supported.

- VDP is supported for only segmentation-based port profiles. VDP for VLAN-based port profiles is not supported.

- The dynamic VLANs allocated by VDP are local to the VEM; they should not be configured on the Cisco Nexus 1000V VSM.

- VDP is supported on VMware ESX releases 5.0, 5.1, and 5.5.

DFA

The DFA feature has the following limitations and restrictions:

- Fabric forwarding mode is not supported under the VLAN configuration.

ERSPAN

If the ERSPAN source and destination are in different subnets, and if the ERSPAN source is an L3 control VM kernel NIC attached to a Cisco Nexus 1000V VEM, you must enable proxy-ARP on the upstream switch.

If you do not enable proxy-ARP on the upstream switch (or router, if there is no default gateway), ERSPAN packets are not sent to the destination.

VMotion of VSM

VMotion of VSM has the following limitations and restrictions:

- VMotion of VSM is supported for both the active and standby VSM VMs. For high availability, we recommend that the active VSM and standby VSM reside on separate hosts.

- If you enable Distributed Resource Scheduler (DRS), you must use the VMware anti-affinity rules to ensure that the two virtual machines are never on the same host, and that a host failure cannot result in the loss of both the active and standby VSM.

- VMware VMotion does not complete when using an open virtual appliance (OVA) VSM deployment if the CD image is still mounted. To complete the VMotion, either click Edit Settings on the VM to disconnect the mounted CD image, or power off the VM. No functional impact results from this limitation.

- If you are adding one host in a DRS cluster that is using a vSwitch to a VSM, you must move the remaining hosts in the DRS cluster to the VSM. Otherwise, the DRS logic does not work, the VMs that are deployed on the VEM could be moved to a host in the cluster that does not have a VEM, and the VMs lose network connectivity.

.

Access Lists

ACLs have the following limitations and restrictions:

- VLAN-based ACLs (VACLs) are not supported.

- ACLs are not supported on port channels.

- The access-class command is not supported on the vty interface. Use management interface ACL for any access-list requirements.

NetFlow

The NetFlow configuration has the following limitations and restrictions:

- NetFlow Sampler is not supported.

- NetFlow Exporter format V9 is supported.

- NetFlow Exporter format V5 is not supported.

- NetFlow is not supported on port channels.

Port Security

Port security has the following limitations and restrictions:

- Port security is enabled globally by default.

- The feature/no feature port-security command is not supported.

- In response to a security violation, you can shut down the port.

Port Profiles

Port profiles have the following limitations and restrictions:

- There is a limit of 255 characters in a port-profile command attribute.

- We recommend that if you are editing or removing a port channel, you should migrate the interfaces that inherit the port channel port profile to a port profile with the desired configuration, rather than editing the original port channel port profile directly.

- When you remove a port profile that is mapped to a VMware port group, the associated port group and settings within the vCenter Server are also removed.

- Policy names are not checked against the policy database when ACL/NetFlow policies are applied through the port profile. It is possible to apply a nonexistent policy.

- The port profile name can be up to 80 alphanumeric characters, is not case-sensitive, and must be unique for each port profile on the Cisco Nexus 1000V. The port profile name cannot contain any spaces. The port profile name can include all the ASCII special characters except the forward slash (/), backslash (\), percent (%), and question mark (?).

Note If there are any existing port profiles (created in earlier Cisco Nexus 1000V releases) with names that contain a forward slash (/), backslash (\), percent (%), or question mark (?), you can continue to use them in this release.

SSH Support

Only SSH version 2 (SSHv2) is supported.

LACP

Only LACP offload to VEM is supported. Upgrades from earlier releases to this release change LACP to offload mode by default.

Cisco NX-OS Commands Might Differ from Cisco IOS

Be aware that the Cisco NX-OS CLI commands and modes might differ from those commands and modes used in the Cisco IOS software.

.

No Spanning Tree Protocol

The Cisco Nexus 1000V for VMware forwarding logic is designed to prevent network loops; therefore, it does not use the Spanning Tree Protocol. Packets that are received from the network on any link connecting the host to the network are not forwarded back to the network by the Cisco Nexus 1000V.

Cisco Discovery Protocol

The Cisco Discovery Protocol (CDP) is enabled globally by default.

CDP runs on all Cisco-manufactured equipment over the data link layer and does the following:

- Advertises information to all attached Cisco devices.

- Discovers and views information about those Cisco devices.

– CDP can discover up to 256 neighbors per port if the port is connected to a hub with 256 connections.

If you disable CDP globally, CDP is also disabled for all interfaces.

.

DHCP Not Supported for the Management IP

DHCP is not supported for the management IP. The management IP must be configured statically.

Upstream Switch Ports

We recommend that you configure spanning-tree port type edge on upstream switches for faster convergence.

The following commands are available to use on Cisco upstream switch ports in interface configuration mode:

- spanning-tree portfast

- spanning-tree portfast trunk

- spanning-tree portfast edge trunk

Interfaces

When the maximum transmission unit (MTU) is configured on an operationally up interface, the interface goes down and comes back up.

Supported MTU values vary according to underlying physical NIC capability.

Layer 3 VSG

When a VEM communicates with the Cisco VSG in Layer 3 mode, an additional header with 94 bytes is added to the original packet. You must set the MTU to a minimum of 1594 bytes to accommodate this extra header for any network interface through which the traffic passes between the Cisco Nexus 1000V and the Cisco VSG. These interfaces can include the uplink port profile, the proxy ARP router, or a virtual switch.

Copy Running-Config Startup-Config Command

When you are using the copy running-config startup-config command, do not press the PrtScn key. If you do, the command aborts.

SNMP User Accounts Must Be Reconfigured After an Upgrade

If you are upgrading from a release earlier than 5.2(1)SV3(1.1), the SNMP engine ID changes internally to a unique engine ID. You must reconfigure all SNMP user accounts to work with the new engine ID. Until the SNMP user accounts are reconfigured, all SNMPv3 queries fail. This restriction is associated with the defect CSCuo12696.

After an upgrade, the engine ID is shown as 128:0:0:9:3:2:0:12:0:0:0, as follows:

switch# show snmp user

______________________________________________________________

SNMP USERS

______________________________________________________________

User Auth Priv(enforce) Groups

____ ____ _____________ ______

______________________________________________________________

NOTIFICATION TARGET USERS (configured for sending V3 Inform)

______________________________________________________________

User Auth Priv

____ ____ ____

admin md5 des

(EngineID 128:0:0:9:3:2:0:12:0:0:0)

is an example that represents the SNMP user password.

Step 1 Delete the username:

switch(config)#no snmp user admin auth md5 paswd123 engineID 128:0:0:9:3:2:0:12:0:0:0

Step 2 Use one of the following options to recreate the username:

Option 1

switch(config)# snmp user admin auth md5 paswd123

Option 2

switch(config)# snmp-server user admin auth md5 paswd123 priv aes-128 paswd123

Step 3 Confirm that the engine ID has been updated, as follows:

Option 1

switch# show snmp user

______________________________________________________________

SNMP USERS

______________________________________________________________

User Auth Priv(enforce) Groups

____ ____ _____________ ______

admin md5 no network-operator

______________________________________________________________

NOTIFICATION TARGET USERS (configured for sending V3 Inform)

______________________________________________________________

User Auth Priv

____ ____ ____

Option 2

switch(config)# show snmp user

______________________________________________________________

SNMP USERS

______________________________________________________________

User Auth Priv(enforce) Groups

____ ____ _____________ ______

admin md5 aes-128(no) network-operator

______________________________________________________________

NOTIFICATION TARGET USERS (configured for sending V3 Inform)

______________________________________________________________

User Auth Priv

____ ____ ____

Step 4 Verify that the engine ID is unique:

switch# show snmp engineID

Local SNMP engineID: [Hex] 8000000903005056A0544E

[Dec] 128:000:000:009:003:000:080:086:160:084:078

Using the Bug Search Tool

Use the Bug Search tool to search for a specific bug or to search for all bugs in a release.

.

. The Bug Search page opens.

Note If you do not have a Cisco.com username and password, you can register for them at http://tools.cisco.com/RPF/register/register.do.

.

Step 4 To search for bugs in the current release:

. (Leave the other fields empty.)

b. When the search results are displayed, use the filter tools to find the types of bugs you are looking for. You can search for bugs by modified date, status, severity, and so forth.

link.

Resolved Bugs

lists the bug ID and description of a select number of resolved high-priority bugs in the Cisco Nexus 1000V for VMware.

Table 5 Resolved Bugs

ID

Description

The Nexus 1000V VSM includes a version of bash that is affected by the vulnerabilities identified by the Common Vulnerability and Exposures (CVE) IDs:

- CVE-2014-6271

- CVE-2014-6277

- CVE-2014-7169

- CVE-2014-6278

- CVE-2014-7186

- CVE-2014-7187

command displays none of the configured port-profiles.

MIB Support

The Cisco Management Information Base (MIB) list includes Cisco proprietary MIBs and many other Internet Engineering Task Force (IETF)-standard MIBs. These standard MIBs are defined in Requests for Comments (RFCs). To find specific MIB information, you must examine the Cisco proprietary MIB structure and related IETF-standard MIBs supported by the Cisco Nexus 1000V.

The MIB Support List is available at the following FTP site:

Documentation Feedback

To provide technical feedback on this document or report an error or omission, please send your comments to:

We appreciate your feedback.

Related Documentation

The Cisco Nexus 1000V documentation is available at the following URL:

Application Virtual Switch Documentation

ASA 1000V Cloud Firewall Documentation

Cloud Services Platform Documentation

Prime Network Services Controller Documentation

Virtual Application Container Services Documentation

Virtual Security Gateway Documentation

Obtaining Documentation and Submitting a Service Request

.

Subscribe to What’s New in Cisco Product Documentation, which lists all new and revised Cisco technical documentation, as an RSS feed and deliver content directly to your desktop using a reader application. The RSS feeds are a free service.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks . Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)

Internet Protocol (IP) addresses used in this document are for illustration only. Examples, command display output, and figures are for illustration only. If an actual IP address appears in this document, it is coincidental.

© 2014–2016 Cisco Systems, Inc. All rights reserved.