- Preface
- Overview of Cisco Unified Computing System
- Overview of Cisco UCS Manager
- Overview of Cisco UCS Manager GUI
- Configuring the Fabric Interconnects
- Configuring Ports and Port Channels
- Configuring Communication Services
- Configuring Authentication
- Configuring Organizations
- Configuring Role-Based Access Control
- Configuring DNS Servers
- Configuring System-Related Policies
- Managing Licenses
- Managing Virtual Interfaces
- Registering Cisco UCS Domains with Cisco UCS Central
- LAN Uplinks Manager
- VLANs
- Configuring LAN Pin Groups
- Configuring MAC Pools
- Configuring Quality of Service
- Configuring Network-Related Policies
- Configuring Upstream Disjoint Layer-2 Networks
- Configuring Named VSANs
- Configuring SAN Pin Groups
- Configuring WWN Pools
- Configuring Storage-Related Policies
- Configuring Fibre Channel Zoning
- Configuring Server-Related Pools
- Setting the Management IP Address
- Configuring Server-Related Policies
- Configuring Server Boot
- Deferring Deployment of Service Profile Updates
- Configuring Service Profiles
- Managing Power in Cisco UCS
- Managing Time Zones
- Managing the Chassis
- Managing Blade Servers
- Managing Rack-Mount Servers
- Starting the KVM Console
- CIMC Session Management
- Backing Up and Restoring the Configuration
- Recovering a Lost Password
VLANs
- About VLANs
- Guidelines for Creating, Deleting, and Modifying VLANs
- About the Native VLAN
- About the Access and Trunk Ports
- Named VLANs
- VLAN Port Limitations
- Configuring Named VLANs
- Community VLANs
- Viewing the VLAN Port Count
- VLAN Groups
- VLAN Permissions
About VLANs
A VLAN is a switched network that is logically segmented by function, project team, or application, without regard to the physical locations of the users. VLANs have the same attributes as physical LANs, but you can group end stations even if they are not physically located on the same LAN segment.
Any switch port can belong to a VLAN. Unicast, broadcast, and multicast packets are forwarded and flooded only to end stations in the VLAN. Each VLAN is considered a logical network, and packets destined for stations that do not belong to the VLAN must be forwarded through a router or bridge.
VLANs are typically associated with IP subnetworks. For example, all of the end stations in a particular IP subnet belong to the same VLAN. To communicate between VLANs, you must route the traffic. By default, a newly created VLAN is operational. Additionally, you can configure VLANs to be in the active state, which is passing traffic, or in the suspended state, in which the VLANs are not passing packets. By default, the VLANs are in the active state and pass traffic.
You can use the Cisco UCS Manager to manage VLANS. You can do the following:
Guidelines for Creating, Deleting, and Modifying VLANs
VLANs are numbered from 1 to 4094. All configured ports belong to the default VLAN when you first bring up a switch. The default VLAN (VLAN1) uses only default values. You cannot create, delete, or suspend activity in the default VLAN.
You configure a VLAN by assigning a number to it. You can delete VLANs or move them from the active operational state to the suspended operational state. If you attempt to create a VLAN with an existing VLAN ID, the switch goes into the VLAN submode, but does not create the same VLAN again. Newly created VLANs remain unused until you assign ports to the specific VLAN. All of the ports are assigned to VLAN1 by default. Depending on the range of the VLAN, you can configure the following parameters for VLANs (except for the default VLAN):
When you delete a specified VLAN, the ports associated to that VLAN are shut down and no traffic flows. However, the system retains all of the VLAN-to-port mappings for that VLAN. When you re-enable or recreate the specified VLAN, the system automatically re-instates all of the original ports to that VLAN.
About the Native VLAN
The native VLAN and the default VLAN are not the same. Native refers to VLAN traffic without an 802.1q header and can be assigned or not. The native VLAN is the only VLAN that is not tagged in a trunk, and the frames are transmitted unchanged.
You can tag everything and not use a native VLAN throughout your network, and the VLAN or devices are reachable because switches use VLAN 1 as the native by default.
The UCS Manager LAN Uplink Manager enables you to configure VLANs and to change the native VLAN setting. Changing the native VLAN setting requires a port flap for the change to take effect; otherwise, the port flap is continuous. When you change the native VLAN, there is a loss of connectivity for approximately 20-40 seconds.
Native VLAN Guidelines
-
You can only configure native VLANs on trunk ports.
-
You can change the native VLAN on a UCS vNIC; however, the port flaps and can lead to traffic interruptions.
-
Cisco recommends using the native VLAN 1 setting to prevent traffic interruptions if using the Cisco Nexus 1000v switches. The native VLAN must be the same for the Nexus 1000v port profiles and your UCS vNIC definition.
-
If the native VLAN 1 setting is configured, and traffic routes to an incorrect interface, there is an outage, or the switch interface flaps continuously, there might be incorrect settings in your disjoint layer 2 network configuration.
-
Using the native VLAN 1 for management access to all of your devices can potentially cause problems if someone connects another switch on the same VLAN as your management devices.
About the Access and Trunk Ports
Access Ports on a Cisco Switch
Access ports only sends untagged frames and belongs to and carries the traffic of only one VLAN. Traffic is received and sent in native formats with no VLAN tagging. Anything arriving on an access port is assumed to belong to the VLAN assigned to the port.
You can configure a port in access mode and specify the VLAN to carry the traffic for that interface. If you do not configure the VLAN for a port in access mode, or an access port, the interface carries the traffic for the default VLAN, which is VLAN 1. You can change the access port membership in a VLAN by configuring the VLAN. You must create the VLAN before you can assign it as an access VLAN for an access port. If you change the access VLAN on an access port to a VLAN that is not yet created, the UCS Manager shuts down that access port.
If an access port receives a packet with an 802.1Q tag in the header other than the access VLAN value, that port drops the packet without learning its MAC source address.
Trunk Ports on a Cisco Switch
Trunk ports allow multiple VLANs to transport between switches over that trunk link. A trunk port can carry untagged packets simultaneously with the 802.1Q tagged packets. When you assign a default port VLAN ID to the trunk port, all untagged traffic travels on the default port VLAN ID for the trunk port, and all untagged traffic is assumed to belong to this VLAN. This VLAN is referred to as the native VLAN ID for a trunk port. The native VLAN ID is the VLAN that carries untagged traffic on trunk ports.
The trunk port sends an egressing packet with a VLAN that is equal to the default port VLAN ID as untagged; all the other egressing packets are tagged by the trunk port. If you do not configure a native VLAN ID, the trunk port uses the default VLAN.
Note | Changing the native VLAN on a trunk port, or an access VLAN of an access port flaps the switch interface. |
Named VLANs
A named VLAN creates a connection to a specific external LAN. The VLAN isolates traffic to that external LAN, including broadcast traffic.
The name that you assign to a VLAN ID adds a layer of abstraction that allows you to globally update all servers associated with service profiles that use the named VLAN. You do not need to reconfigure the servers individually to maintain communication with the external LAN.
You can create more than one named VLAN with the same VLAN ID. For example, if servers that host business services for HR and Finance need to access the same external LAN, you can create VLANs named HR and Finance with the same VLAN ID. Then, if the network is reconfigured and Finance is assigned to a different LAN, you only have to change the VLAN ID for the named VLAN for Finance.
In a cluster configuration, you can configure a named VLAN to be accessible only to one fabric interconnect or to both fabric interconnects.
Guidelines for VLAN IDs
You cannot create VLANs with IDs from 3968 to 4047 and 4092 to 4096. These ranges of VLAN IDs are reserved.
The VLAN IDs you specify must also be supported on the switch that you are using. For example, on Cisco Nexus 5000 Series switches, the VLAN ID range from 3968 to 4029 is reserved. Before you specify the VLAN IDs in Cisco UCS Manager, make sure that the same VLAN IDs are available on your switch.
VLANs in the LAN cloud and FCoE VLANs in the SAN cloud must have different IDs. Using the same ID for a VLAN and an FCoE VLAN in a VSAN results in a critical fault and traffic disruption for all vNICs and uplink ports using that VLAN. Ethernet traffic is dropped on any VLAN which has an ID that overlaps with an FCoE VLAN ID.
VLAN 4048 is user configurable. However, Cisco UCS Manager uses VLAN 4048 for the following default values. If you want to assign 4048 to a VLAN, you must reconfigure these values:
-
After an upgrade to Cisco UCS, Release 2.0—The FCoE storage port native VLAN uses VLAN 4048 by default. If the default FCoE VSAN was set to use VLAN 1 before the upgrade, you must change it to a VLAN ID that is not used or reserved. For example, consider changing the default to 4049 if that VLAN ID is not in use.
-
After a fresh install of Cisco UCS, Release 2.0—The FCoE VLAN for the default VSAN uses VLAN 4048 by default. The FCoE storage port native VLAN uses VLAN 4049.
The VLAN name is case sensitive.
VLAN Port Limitations
Cisco UCS Manager limits the number of VLAN port instances that you can configure under border and server domains on a fabric interconnect.
Types of Ports Included in the VLAN Port Count
The following types of ports are counted in the VLAN port calculation:
-
Border uplink Ethernet ports
-
Border uplink Ether-channel member ports
-
FCoE ports in a SAN cloud
-
Ethernet ports in a NAS cloud
-
Static and dynamic vNICs created through service profiles
-
VM vNICs created as part of a port profile in a hypervisor in hypervisor domain
Based on the number of VLANs configured for these ports, Cisco UCS Manager tracks the cumulative count of VLAN port instances and enforces the VLAN port limit during validation. Cisco UCS Manager reserves some pre-defined VLAN port resources for control traffic. These include management VLANs configured under HIF and NIF ports.
VLAN Port Limit Enforcement
Cisco UCS Manager validates VLAN port availability during the following operations:
-
Configuring and unconfiguring border ports and border port channels
-
Adding or removing VLANs from a cloud
-
Configuring or unconfiguring SAN or NAS ports
-
Associating or disassociating service profiles that contain configuration changes
-
Configuring or unconfiguring VLANs under vNICs or vHBAs
-
Receiving creation or deletion notifications from a VMWare vNIC and from an ESX hypervisor
Note
This is outside the control of the Cisco UCS Manager.
-
Fabric interconnect reboot
-
Cisco UCS Manager upgrade or downgrade
Cisco UCS Manager strictly enforces the VLAN port limit on service profile operations. If Cisco UCS Manager detects that the VLAN port limit is exceeded, the service profile configuration fails during deployment.
Exceeding the VLAN port count in a border domain is less disruptive. When the VLAN port count is exceeded in a border domain Cisco UCS Manager changes the allocation status to Exceeded. To change the status back to Available, complete one of the following actions:
Configuring Named VLANs
Creating a Named VLAN
In a Cisco UCS domain that is configured for high availability, you can create a named VLAN that is accessible to both fabric interconnects or to only one fabric interconnect.
You cannot create VLANs with IDs from 3968 to 4047 and 4092 to 4096. These ranges of VLAN IDs are reserved.
The VLAN IDs you specify must also be supported on the switch that you are using. For example, on Cisco Nexus 5000 Series switches, the VLAN ID range from 3968 to 4029 is reserved. Before you specify the VLAN IDs in Cisco UCS Manager, make sure that the same VLAN IDs are available on your switch.
VLANs in the LAN cloud and FCoE VLANs in the SAN cloud must have different IDs. Using the same ID for a VLAN and an FCoE VLAN in a VSAN results in a critical fault and traffic disruption for all vNICs and uplink ports using that VLAN. Ethernet traffic is dropped on any VLAN which has an ID that overlaps with an FCoE VLAN ID.
Deleting a Named VLAN
If Cisco UCS Manager includes a named VLAN with the same VLAN ID as the one you delete, the VLAN is not removed from the fabric interconnect configuration until all named VLANs with that ID are deleted.
Before you delete a VLAN from a fabric interconnect, ensure that the VLAN was removed from all vNICs and vNIC templates.
Note | If you delete a VLAN that is assigned to a vNIC or vNIC template, the vNIC might allow that VLAN to flap. |
Community VLANs
Cisco UCS Manager supports Community VLANs in UCS Fabric Interconnects. Community ports communicate with each other and with promiscuous ports. Community ports have Layer 2 isolation from all other ports in other communities. A promiscuous port can communicate with all interfaces.
- Creating a Community VLAN
- Creating Promiscuous Access on Appliance Port
- Creating a Promiscuous Trunk on Appliance Port
Creating a Community VLAN
In a Cisco UCS domain configured for high availability, you can create a Community VLAN accessible to both fabric interconnects or to only one fabric interconnect.
You cannot create VLANs with IDs from 3968 to 4047 and 4092 to 4096. These ranges of VLAN IDs are reserved.
The VLAN IDs you specify must also be supported on the switch that you are using. For example, on Cisco Nexus 5000 Series switches, the VLAN ID range from 3968 to 4029 is reserved. Before you specify the VLAN IDs in Cisco UCS Manager, make sure that the same VLAN IDs are available on your switch.
VLANs in the LAN cloud and FCoE VLANs in the SAN cloud must have different IDs. Using the same ID for a VLAN and an FCoE VLAN in a VSAN results in a critical fault and traffic disruption for all vNICs and uplink ports using that VLAN. Ethernet traffic is dropped on any VLAN which has an ID that overlaps with an FCoE VLAN ID.
Step 1 | In the Navigation pane, click LAN. | ||||||||||||||||||||
Step 2 | On the LAN tab, click the LAN node. | ||||||||||||||||||||
Step 3 | In the Work pane, click the VLANs tab. | ||||||||||||||||||||
Step 4 | On the icon
bar to the right of the table, click
+.
If the + icon is disabled, click an entry in the table to enable it. | ||||||||||||||||||||
Step 5 | In the
Create
VLANs dialog box, complete the following fields:
| ||||||||||||||||||||
Step 6 | If you clicked
the
Check
Overlap button, do the following:
| ||||||||||||||||||||
Step 7 | Click
OK.
Cisco UCS Manager adds the Community VLAN to one of the following VLANs nodes: |
Creating Promiscuous Access on Appliance Port
Cisco UCS Manager supports Promiscuous access on appliance ports. The following procedure details the configurations steps.
Step 1 | In the Navigation pane, click the LAN tab. |
Step 2 | On the LAN tab, expand . The Interfaces pane displays. |
Step 3 | In the Interfaces paneon the icon bar to the right of the table, click + . The Appliance Links pane displays. |
Step 4 | In the Appliance Links pane, click the Unconfigured Ethernet Ports to expand the . All available Unconfigured Ethernet Ports display. |
Step 5 | Click the Unconfigured Ethernet Ports that you want to make an Appliance Port. |
Step 6 | Click Make Appliance Port. The Configure as Appliance Port confirmation box displays. |
Step 7 | Click Yes to configure the appliance port. The Configure Appliance Port dialog box opens. |
Step 8 | On the LAN tab, expand . |
Step 9 | Expand Appliance Ports. |
Step 10 | Click the appliance port for which you want to modify the properties. |
Step 11 | In the Interfaces paneon the icon bar to the right of the table, click the Modify icon. The Properties for Appliance Interface dialog box displays. |
Step 12 | In the VLANs pane, click the Access radio button. |
Step 13 | Select a Primary VLAN from the Select VLAN drop-down list to assign to the appliance port. A list of secondary VLANs associated with the primary VLAN displays. |
Step 14 | Select a set
of secondary VLANs allowed on the port.
Selecting an Isolated or Community VLAN turns the VLAN into a Promiscuous Port. If you select the Primary VLAN from the Select VLAN drop-down list, you must select the required secondary VLAN. |
Step 15 | Click Apply to configure Promiscuous Access on Appliance Port. |
Creating a Promiscuous Trunk on Appliance Port
Cisco UCS Manager supports Promiscuous Trunks on appliance ports. The following procedure details the configurations steps.
Step 1 | In the Navigation pane, click the LAN tab. |
Step 2 | On the LAN tab, expand . The Interfaces pane displays. |
Step 3 | In the Interfaces paneon the icon bar to the right of the table, click + . The Appliance Links pane displays. |
Step 4 | In the Appliance Links pane, click the Unconfigured Ethernet Ports to expand the . All available Unconfigured Ethernet Ports display. |
Step 5 | Click the Unconfigured Ethernet Ports that you to want make an Appliance Port. |
Step 6 | Click Make Appliance Port. The Configure as Appliance Port confirmation box displays. |
Step 7 | Click Yes to configure the appliance port. |
Step 8 | On the LAN tab, expand . |
Step 9 | Expand Appliance Ports. |
Step 10 | Click the appliance port for which you want to modify the properties. |
Step 11 | In the Interfaces pane on the icon bar to the right of the table, click the Modify icon. The Properties for Appliance Interface dialog box displays. |
Step 12 | In the VLANs pane, click the Trunk radio button. |
Step 13 | Select a
VLAN from the available VLANs.
From the list of VLANs, you can select multipleIsolated,Community, Primary and Regular VLANs to apply on the port to make it a promiscuous trunk port. |
Step 14 | Click Apply to configure Promiscuous on Trunk on Appliance Port. |
Viewing the VLAN Port Count
Step 1 | In the Navigation pane, click Equipment. | ||||||||||
Step 2 | Expand . | ||||||||||
Step 3 | Click the fabric interconnect for which you want to view the VLAN port count. | ||||||||||
Step 4 | In the Work pane, click the General tab. | ||||||||||
Step 5 | In the General tab, click the down arrows on the VLAN Port Count bar to expand that area. Cisco UCS Manager GUI displays the following details:
|
VLAN Groups
VLAN groups allow you to group VLANs on Ethernet uplink ports, by function or by VLANs that belong to a specific network. You can define VLAN membership and apply the membership to multiple Ethernet uplink ports on the fabric interconnect.
Note | Cisco UCS Manager supports a maximum of 200 VLAN Groups. If Cisco UCS Manager determines that you create more than 200 VLAN groups, the system disables VLAN compression. |
You can configure inband and out-of-band (OOB) VLAN groups to use to access the Cisco Integrated Management Interface (CIMC) on blade and rack servers. Cisco UCS Manager supports OOB IPv4 and inband IPv4 and IPv6 VLAN groups for use with the uplink interfaces or uplink port channels.
After you assign a VLAN to a VLAN group, any changes to the VLAN group are applied to all Ethernet uplink ports that are configured with the VLAN group. The VLAN group also enables you to identify VLAN overlaps between disjoint VLANs.
You can configure uplink ports under a VLAN group. When you configure an uplink port for a VLAN group, that uplink port will support all the VLANs that are part of the associated VLAN groups and individual VLANs that are associated with the uplink using LAN Uplinks Manager, if any. Further, any uplink that is not selected for association with that VLAN group will stop supporting the VLANs that are part of that VLAN group.
You can create VLAN groups from the LAN Cloud or from the LAN Uplinks Manager.
- Creating a VLAN Group
- Editing the Members of a VLAN Group
- Modifying the Organization Access Permissions for a VLAN Group
- Deleting a VLAN Group
Creating a VLAN Group
You can create a VLAN Group from LAN Cloud or the LAN Uplinks Manager. This procedure explains creating a VLAN group from the LAN Cloud. You can create separate VLAN groups to use for inband and out-of-band access using service profiles.
Step 1 | In the Navigation pane, click LAN. |
Step 2 | Expand . |
Step 3 | Right-click
LAN
Cloud and choose
Create
VLAN Group from the drop-down list.
The Create VLAN Group wizard launches. |
Step 4 | In the Select VLANs dialog box, specify the name and VLANs, then click Next. |
Step 5 | (Optional) In Add Uplink Ports dialog box, select the Uplink Ports from the list and add the ports to the Selected Uplink Ports, then click Next. |
Step 6 | (Optional) In Add Port Channels dialog box, select the Port Channels, and add the port channels to the Selected Port Channels, then click Next. |
Step 7 | (Optional) In
the
Org
Permissions
dialog box, select the appropriate groups from the list,
then click
Next.
The VLANs that belong to the group that you are creating can only access the groups that you select. |
Step 8 | Click
Finish.
This VLAN group is added to the list of VLAN Groups under . |
Editing the Members of a VLAN Group
Step 1 | In the Navigation pane, click LAN. |
Step 2 | Expand . |
Step 3 | In the Navigation pane, click VLAN Groups to expand the VLAN group list. |
Step 4 | From the list of
VLAN groups, choose the VLAN group name to edit the group member VLANs.
You can use the Shift key or Ctrl key to select multiple entries. |
Step 5 | Right-click the
highlighted VLAN group or VLAN groups and choose
Edit
VLAN Group Members.
The Modify VLAN Group VLAN Group Name dialog box opens. |
Step 6 | In the Modify VLAN Group VLAN Group Name dialog box, select the VLANs that you want to remove or add from the list and click Next. |
Step 7 | (Optional) In Add Port Channels pane, choose the Port Channels, and add them to the Selected Port Channels. |
Step 8 | (Optional) In
the
Org
Permissions pane, choose the appropriate groups from the list.
The VLANs that belong to the group that you are creating can only access the groups that you select. |
Step 9 | Click Finish. |
Step 10 | This VLAN group is modified based on your selections. |
Modifying the Organization Access Permissions for a VLAN Group
When you modify the organization access permissions for a VLAN group, the change in permissions applies to all VLANs that are in that VLAN group.
Step 1 | In the Navigation pane, click LAN. |
Step 2 | On the LAN tab, expand , select VLAN group name. |
Step 3 | In the Work pane, click the General tab. |
Step 4 | In
Actions, click
Modify
VLAN Groups Org Permissions.
The Modify VLAN Groups Org Permissions dialog box opens. |
Step 5 | In Org Permissions, do the following: |
Step 6 | Click OK. |
Deleting a VLAN Group
Step 1 | In the Navigation pane, click LAN. |
Step 2 | Expand . |
Step 3 | In the Navigation pane, click VLAN Groups to expand the VLAN group list. |
Step 4 | From the displayed list of VLAN groups, choose the VLAN group name you want to delete.
You can use the Shift key or Ctrl key to select multiple entries. |
Step 5 | Right-click the highlighted VLAN group or VLAN groups and choose Delete. |
Step 6 | If a confirmation dialog box displays, click Yes. |
VLAN Permissions
VLAN permissions restrict access to VLANs based on specified organizations and on the service profile organizations to which the VLANs belong. VLAN permissions also restrict the set of VLANs that you can assign to service profile vNICs. VLAN permissions is an optional feature and is disabled by default. You can enable or disable the feature based on your requirements. If you disable the feature, all of the VLANs are globally accessible to all organizations.
Note | If you enable the org permission inPermitted Orgs for VLAN(s) option displays in the Create VLANs dialog box. If you do not enable the Org Permissions, the Permitted Orgs for VLAN(s) option does not display. , when you create a VLAN, the |
Enabling the org permission allows you to specify the organizations for the VLAN. When you specify the organizations, the VLAN becomes available to that specific organization and all of the sub organizations below the structure. Users from other organizations cannot access this VLAN. You can also modify the VLAN permission anytime based on changes to your VLAN access requirements.
Caution | When you assign the VLAN org permission to an organization at the root level, all sub organizations can access the VLANs. After assigning the org permission at the root level, and you change the permission for a VLAN that belongs to a sub organization, that VLAN becomes unavailable to the root level organization. |
Enabling VLAN Permissions
Step 1 | In the Navigation pane, click LAN. |
Step 2 | Expand . |
Step 3 | In the Work pane, click the Global Policies tab. |
Step 4 | In the Org Permissions section, choose Enabled. |
Step 5 | Click Save Changes. |
Step 6 | If the Org Permissions option is successfully enabled, a confirmation message displays. Click OK to close the dialog box. |
Disabling VLAN Permissions
By default, VLAN permissions is disabled. You can enable VLAN permissions and assign a VLAN to a different network group or organization. You can also disable the VLAN permission globally; however, the permissions assigned to the VLANs continue to exist in the system, but are not enforced. If you want to use the org permissions later, you can enable the feature to use the assigned permissions.
Step 1 | In the Navigation pane, click LAN. |
Step 2 | Expand . |
Step 3 | In the Work pane, click the Global Policies tab. |
Step 4 | In the Org Permissions section, choose Disabled. |
Step 5 | Click Save Changes. |
Step 6 | If the Org Permissions option is successfully disabled, a confirmation message displays. Click OK to close the dialog box. |
Adding or Modifying VLAN Permissions
You can add or delete the permitted organization for a VLAN.
Note | When you add an organization as a permitted organization for a VLAN, all of the descendant organizations can access the VLAN. When you remove the permission to access a VLAN from an organization, the descendant organizations no longer have access to the VLAN. |