Upstream Disjointed Layer-2 Networks

Upstream Disjoint Layer-2 Networks

Upstream disjoint layer-2 networks (disjoint L2 networks) are required if you have two or more Ethernet clouds that never connect, but must be accessed by servers or virtual machines located in the same Cisco UCS domain. For example, you could configure disjoint L2 networks if you require one of the following:

  • Servers or virtual machines to access a public network and a backup network

  • Servers or virtual machines for more than one customer are located in the same Cisco UCS domain, and that need to access the L2 networks for both customers in a multi-tenant system


Note

By default, data traffic in Cisco UCS works on a principle of mutual inclusion. All traffic for all VLANs and upstream networks travels along all uplink ports and port channels. If you have upgraded from a release that does not support upstream disjoint layer-2 networks, you must assign the appropriate uplink interfaces to your VLANs, or traffic for those VLANs continues to flow along all uplink ports and port channels.

The configuration for disjoint L2 networks works on a principle of selective exclusion. Traffic for a VLAN that is designated as part of a disjoint network can only travel along an uplink Ethernet port or port channel that is specifically assigned to that VLAN, and is selectively excluded from all other uplink ports and port channels. However, traffic for VLANs that are not specifically assigned to an uplink Ethernet port or port channel can still travel on all uplink ports or port channels, including those that carry traffic for the disjoint L2 networks.

In Cisco UCS, the VLAN represents the upstream disjoint L2 network. When you design your network topology for disjoint L2 networks, you must assign uplink interfaces to VLANs not the reverse.

For information about the maximum number of supported upstream disjoint L2 networks, see the appropriate Cisco UCS Configuration Limits for Cisco UCS Manager Guide.

Guidelines for Configuring Upstream Disjoint L2 Networks

When you plan your configuration for upstream disjoint L2 networks, consider the following:

Ethernet Switching Mode Must Be End-Host Mode

Cisco UCS only supports disjoint L2 networks when the Ethernet switching mode of the fabric interconnects is configured for end-host mode. You cannot connect to disjoint L2 networks if the Ethernet switching mode of the fabric interconnects is switch mode.

Symmetrical Configuration Is Recommended for High Availability

If a Cisco UCS domain is configured for high availability with two fabric interconnects, we recommend that both fabric interconnects are configured with the same set of VLANs.

VLAN Validity Criteria Are the Same for Uplink Ethernet Ports and Port Channels

The VLAN used for the disjoint L2 networks must be configured and assigned to an uplink Ethernet port or uplink Ethernet port channel. If the port or port channel does not include the VLAN, Cisco UCS Manager considers the VLAN invalid and does the following:

  • Displays a configuration warning in the Status Details area for the server.

  • Ignores the configuration for the port or port channel and drops all traffic for that VLAN.


Note

The validity criteria are the same for uplink Ethernet ports and uplink Ethernet port channels. Cisco UCS Manager does not differentiate between the two.

Overlapping VLANs Are Not Supported

Cisco UCS does not support overlapping VLANs in disjoint L2 networks. You must ensure that each VLAN only connects to one upstream disjoint L2 domain.

Each vNIC Can Only Communicate with One Disjoint L2 Network

A vNIC can only communicate with one disjoint L2 network. If a server needs to communicate with multiple disjoint L2 networks, you must configure a vNIC for each of those networks.

To communicate with more than two disjoint L2 networks, a server must have a Cisco VIC adapter that supports more than two vNICs.

Appliance Port Must Be Configured with the Same VLAN as Uplink Ethernet Port or Port Channel

For an appliance port to communicate with a disjoint L2 network, you must ensure that at least one uplink Ethernet port or port channel is in the same network and is therefore assigned to the same VLANs that are used by the appliance port. If Cisco UCS Manager cannot identify an uplink Ethernet port or port channel that includes all VLANs that carry traffic for an appliance port, the appliance port experiences a pinning failure and goes down.

For example, a Cisco UCS domain includes a global VLAN named vlan500 with an ID of 500. vlan500 is created as a global VLAN on the uplink Ethernet port. However, Cisco UCS Manager does not propagate this VLAN to appliance ports. To configure an appliance port with vlan500, you must create another VLAN named vlan500 with an ID of 500 for the appliance port. You can create this duplicate VLAN in the Appliances node on the LAN tab of the Cisco UCS Manager GUI or the eth-storage scope in the Cisco UCS Manager CLI. If you are prompted to check for VLAN Overlap, accept the overlap and Cisco UCS Manager creates the duplicate VLAN for the appliance port.

Default VLAN 1 Cannot Be Configured Explicitly on an Uplink Ethernet Port or Port Channel

Cisco UCS Manager implicitly assigns default VLAN 1 to all uplink ports and port channels. Even if you do not configure any other VLANs, Cisco UCS uses default VLAN 1 to handle data traffic for all uplink ports and port channels.


Note

After you configure VLANs in a Cisco UCS domain, default VLAN 1 remains implicitly on all uplink ports and port channels. You cannot explicitly assign default VLAN 1 to an uplink port or port channel, nor can you remove it from an uplink port or port channel.

If you attempt to assign default VLAN 1 to a specific port or port channel, Cisco UCS Manager raises an Update Failed fault.

Therefore, if you configure a Cisco UCS domain for disjoint L2 networks, do not configure any vNICs with default VLAN 1 unless you want all data traffic for that server to be carried on all uplink Ethernet ports and port channels and sent to all upstream networks.

VLANs for Both FIs Must be Concurrently Assigned

When you assign a port to a global VLAN, the VLAN is removed from all of the ports that are not explicitly assigned to the VLAN on both fabric interconnects. The ports on both FIs must be configured at the same time. If the ports are only configured on the first FI, traffic on the second FI will be disrupted.

Upstream Disjoint L2 Networks Pinning Considerations

Communication with an upstream disjoint L2 network requires that you ensure that the pinning is properly configured. Whether you implement soft-pinning or hard-pinning, a VLAN membership mismatch causes traffic for one or more VLANs to be dropped.

Soft-Pinning

Soft-pinning is the default behavior in Cisco UCS. If you plan to implement soft-pinning, you do not need to create LAN pin groups to specify a pin target for a vNIC. Instead, Cisco UCS Manager pins the vNIC to an uplink Ethernet port or port channel according to VLAN membership criteria.

With soft-pinning, Cisco UCS Manager validates data traffic from a vNIC against the VLAN membership of all uplink Ethernet ports and port channels. If you have configured disjoint L2 networks, Cisco UCS Manager must be able to find an uplink Ethernet port or port channel that is assigned to all VLANS on the vNIC. If no uplink Ethernet port or port channel is configured with all VLANs on the vNIC, Cisco UCS Manager does the following:

  • Brings the link down.

  • Drops the traffic for all of the VLANs on the vNIC.

  • Raises the following faults:

    • Link Down

    • VIF Down

Cisco UCS Manager does not raise a fault or warning about the VLAN configuration.

For example, a vNIC on a server is configured with VLANs 101, 102, and 103. Interface 1/3 is assigned only to VLAN 102. Interfaces 1/1 and 1/2 are not explicitly assigned to a VLAN, which makes them available for traffic on VLANs 101 and 103. As a result of this configuration, the Cisco UCS domain does not include a border port interface that can carry traffic for all three VLANS for which the vNIC is configured. As a result, Cisco UCS Manager brings down the vNIC, drops traffic for all three VLANs on the vNIC, and raises the Link Down and VIF Down faults.

hard-pinning

hard-pinning occurs when you use LAN pin groups to specify the pinning target for the traffic intended for the disjoint L2 networks. In turn, the uplink Ethernet port or port channel that is the pinning target must be configured to communicate with the appropriate disjoint L2 network.

With hard-pinning, Cisco UCS Manager validates data traffic from a vNIC against the VLAN membership of all uplink Ethernet ports and port channels, and validates the LAN pin group configuration to ensure it includes the VLAN and the uplink Ethernet port or port channel. If the validation fails at any point, Cisco UCS Manager does the following:

  • Raises a Pinning VLAN Mismatch fault with a severity of Warning.

  • Drops traffic for the VLAN.

  • Does not bring the link down, so that traffic for other VLANs can continue to flow along it.

For example, if you want to configure hard-pinning for an upstream disjoint L2 network that uses VLAN 177, do the following:

  • Create a LAN pin group with the uplink Ethernet port or port channel that carries the traffic for the disjoint L2 network.

  • Configure at least one vNIC in the service profile with VLAN 177 and the LAN pin group.

  • Assign VLAN 177 to an uplink Ethernet port or port channel included in the LAN pin group

If the configuration fails at any of these three points, then Cisco UCS Manager warns of a VLAN mismatch for VLAN 177 and drops the traffic for that VLAN only.


Note

If changes are made to soft-pinning configurations resulting in vNIC VLANs not resolving with disjoint L2 uplink, a warning dialog box is displayed. The warning dialog box allows you to proceed with your configuration or cancel it. If you decide to proceed with the mis- configuration, you will experience a reduction is server traffic performance.

Configuring Cisco UCS for Upstream Disjoint L2 Networks

When you configure a Cisco UCS domain to connect with upstream disjoint L2 networks, you need to ensure that you complete all of the following steps.

Before you begin

Before you begin this configuration, ensure that the ports on the fabric interconnects are properly cabled to support your disjoint L2 networks configuration.

SUMMARY STEPS

  1. Configure Ethernet switching mode for both fabric interconnects in Ethernet End-Host Mode.
  2. Configure the ports and port channels that you require to carry traffic for the disjoint L2 networks.
  3. (Optional) Configure the LAN pin groups required to pin the traffic for the appropriate uplink Ethernet ports or port channels.
  4. Create one or more VLANs.
  5. Assign the desired ports or port channels to the VLANs for the disjoint L2 networks.
  6. Ensure that the service profiles for all servers that need to communicate with the disjoint L2 networks include the correct LAN connectivity configuration. This configuration ensures that the vNICs direct the traffic to the appropriate VLAN.

DETAILED STEPS

  Command or Action Purpose

Step 1

Configure Ethernet switching mode for both fabric interconnects in Ethernet End-Host Mode.

The Ethernet switching mode must be in End-Host Mode for Cisco UCS to be able to communicate with upstream disjoint L2 networks. For more information, see the LAN Ports and Port Channel chapter in this guide..

Step 2

Configure the ports and port channels that you require to carry traffic for the disjoint L2 networks.

Step 3

(Optional) Configure the LAN pin groups required to pin the traffic for the appropriate uplink Ethernet ports or port channels.

(Optional)

For more information, see Configuring a LAN Pin Group.

Step 4

Create one or more VLANs.

These can be named VLANs or private VLANs. For a cluster configuration, we recommend that you create the VLANs accessible to both fabric interconnects. For more information, see VLAN and Upstream Disjointed Layer-2 Networks chapters in this guide.

Step 5

Assign the desired ports or port channels to the VLANs for the disjoint L2 networks.

When this step is complete, traffic for these VLANs is be sent through the trunks for the assigned ports and/or port channels.

Step 6

Ensure that the service profiles for all servers that need to communicate with the disjoint L2 networks include the correct LAN connectivity configuration. This configuration ensures that the vNICs direct the traffic to the appropriate VLAN.

You can complete this configuration through one or more vNIC templates, or when you configure the networking options for the service profile. For more information about vNIC templates and service profiles, see the Cisco UCS Manager Storage Management Guide.

Assigning Ports and Port Channels to VLANs

SUMMARY STEPS

  1. UCS-A# scope eth-uplink
  2. UCS-A /eth-uplink # scope vlan vlan-name
  3. UCS-A /eth-uplink/vlan # create member-port fabric-interconnect slot-id port-id
  4. UCS-A /eth-uplink/vlan # create member-port-channel fabric-interconnect member-port-chan-id
  5. UCS-A /eth-uplink/vlan # commit-buffer

DETAILED STEPS

  Command or Action Purpose

Step 1

UCS-A# scope eth-uplink

Enters Ethernet uplink mode.

Step 2

UCS-A /eth-uplink # scope vlan vlan-name

Enters Ethernet uplink VLAN mode for the specified VLAN.

Step 3

UCS-A /eth-uplink/vlan # create member-port fabric-interconnect slot-id port-id

Assigns the specified VLAN to the specified uplink Ethernet port.

Step 4

UCS-A /eth-uplink/vlan # create member-port-channel fabric-interconnect member-port-chan-id

Assigns the specified VLAN to the specified uplink Ethernet port channel.

Step 5

UCS-A /eth-uplink/vlan # commit-buffer

Commits the transaction to the system configuration.

After a port or port channel is assigned to one or more VLANs, it is removed from all other VLANs.

Example

The following example assigns uplink Ethernet ports to a named VLAN called VLAN100 on fabric interconnect A and commits the transaction: 

UCS-A# scope eth-uplink
UCS-A /eth-uplink # scope vlan VLAN100
UCS-A /eth-uplink/vlan # create member-port a 2
UCS-A /eth-uplink/vlan # create member-port a 4
UCS-A /eth-uplink/vlan* # commit-buffer
UCS-A /eth-uplink/vlan #

Removing Ports and Port Channels from VLANs

SUMMARY STEPS

  1. UCS-A# scope eth-uplink
  2. UCS-A /eth-uplink # scope vlan vlan-name
  3. UCS-A /eth-uplink/vlan # delete member-port fabric-interconnect slot-id port-id
  4. UCS-A /eth-uplink/vlan # delete member-port-channel fabric-interconnect member-port-chan-id
  5. UCS-A /eth-uplink/vlan # commit-buffer

DETAILED STEPS

  Command or Action Purpose

Step 1

UCS-A# scope eth-uplink

Enters Ethernet uplink mode.

Step 2

UCS-A /eth-uplink # scope vlan vlan-name

Enters Ethernet uplink VLAN mode for the specified VLAN.

Step 3

UCS-A /eth-uplink/vlan # delete member-port fabric-interconnect slot-id port-id

Deletes the specified Uplink Ethernet member port assignment from the VLAN.

Step 4

UCS-A /eth-uplink/vlan # delete member-port-channel fabric-interconnect member-port-chan-id

Deletes the specified Uplink Ethernet port channel assignment from the VLAN.

Step 5

UCS-A /eth-uplink/vlan # commit-buffer

Commits the transaction to the system configuration.

Important

 

If you remove all port or port channel interfaces from a VLAN, the VLAN returns to the default behavior and data traffic on that VLAN flows on all uplink ports and port channels. Based on the configuration in the Cisco UCS domain, this default behavior can cause Cisco UCS Manager to drop traffic for that VLAN. To avoid this occurrence, Cisco recommends that you assign at least one interface to the VLAN or delete the VLAN.

Example

The following example deletes the association between uplink Ethernet port 2 on fabric interconnect A and the named VLAN called MyVLAN and commits the transaction: 

UCS-A# scope eth-uplink
UCS-A /eth-uplink # scope vlan MyVLAN
UCS-A /eth-uplink/vlan # delete member-port a 2
UCS-A /eth-uplink/vlan* # commit-buffer
UCS-A /eth-uplink/vlan #

Viewing Ports and Port Channels Assigned to VLANs

SUMMARY STEPS

  1. UCS-A# scope eth-uplink
  2. UCS-A /eth-uplink # scope vlan vlan-name
  3. UCS-A /eth-uplink/vlan # show member-port [detail | expand]
  4. UCS-A /eth-uplink/vlan # show member-port-channel [detail | expand]
  5. UCS-A /eth-uplink/vlan # commit-buffer

DETAILED STEPS

  Command or Action Purpose

Step 1

UCS-A# scope eth-uplink

Enters Ethernet uplink mode.

Step 2

UCS-A /eth-uplink # scope vlan vlan-name

Enters Ethernet uplink VLAN mode for the specified VLAN.

Step 3

UCS-A /eth-uplink/vlan # show member-port [detail | expand]

Shows member ports assigned to the specified VLAN.

Step 4

UCS-A /eth-uplink/vlan # show member-port-channel [detail | expand]

Shows member port channels assigned to the specified VLAN.

Step 5

UCS-A /eth-uplink/vlan # commit-buffer

Commits the transaction to the system configuration.

Example

The following example displays the full details for uplink Ethernet ports assigned to a named VLAN called MyVLAN: 

UCS-A# scope eth-uplink
UCS-A /eth-uplink # scope vlan MyVLAN
UCS-A /eth-uplink/vlan # show member-port detail
Member Port:
    Fabric ID: A
    Slot ID: 1
    Port ID: 2
    Mark Native Vlan: No
UCS-A /eth-uplink/vlan #