Configuring network DMZ, internal using Nexus 1000v

Hello peoples, this is my first post in the forums.

I am trying to build a profile for my customer with the following configuration;

4 x ESXi hosts on the DL380 G7 each with 12 GB of RAM, CPU Core X 5650 of 2 x 6, 8 x 1 GB NIC

2 x left iSCSI SAN.

The hardware components and several design features, on that I have no control, they were decided and I can't change, or I can't add additional equipment. Here's my constraints;

(1) the solution will use the shared for internal, external traffic and iSCSI Cisco network switches.

(2) the solution uses a single cluster with each of the four hosts within that group.

(3) I install and configure a Nexus 1000v in the environment (something I'm not want simply because I have never done it before). The customer was sold on the concept of a solution of cheap hardware and shared because they were told that using a N1Kv would solve all the problems of security.

Before I learned that I would have to use a N1Kv my solution looked like the following attached JPG. The solution used four distributed virtual switches and examples of how they were going to be configured is attached. Details and IP addresses are examples.

My questions are:

(1) what procedure should I use to set up the environment, should I build the dvSwtiches as described and then export it to the N1Kv?

(2) how should I document place this solution? In general in my description I will have a section explaining each switch, how it is configured, vital details, port groups etc. But all of this is removed and replaced with uplink ports or something is it not?

(3) should I be aiming to use a different switch by dvSwitch, or I can stem the heap and create groups of different ports, is it safe, is there a standard? Yes, I read the white papers on the DMZ and the Nexus 1000v.

(4) is my configuration safe and effective? Are there ways to improve it?

All other comments and suggestions are welcome.

Hello and welcome to the forums,

(1) what procedure should I use to set up the environment, should I build the dvSwtiches as described and then export it to the N1Kv?

N1KV replace dvSwitch, but there isn't that a N1KV ONLY where there are many dvSwitches N1KV would use the same rising in the world.

(2) how should I document place this solution? In general in my description I will have a section explaining each switch, how it is configured, vital details, port groups etc. But all of this is removed and replaced with uplink ports or something is it not?

If you use N1KV you rising the pSwitch to the N1KV.

If you use dvSwitch/vSwitch you uplink to the pSwitches to the individual dvSwitch/vSwitch in use.

(3) should I be aiming to use a different switch by dvSwitch, or I can stem the heap and create groups of different ports, is it safe, is there a standard? Yes, I read the white papers on the DMZ and the Nexus 1000v.

No standard and Yes in many cases, it can be considered secure. If your existing physical network relies on VLANs and approves the Layer2 pSwitches, then you can do the exact same thing in the virtual environment and be as safe as your physical environment.

However, if you need separation to the layer of pSwitch then you must maintain various vSwitches for this same separation. Take a look at this post http://www.virtualizationpractice.com/blog/?p=4284 on the subject.

(4) is my configuration safe and effective? Are there ways to improve it?

Always ways to improve. I would like to start looking into the defense-in-depth the vNIC and layers of edge within your vNetwork.

Best regards
Edward L. Haletky VMware communities user moderator, VMware vExpert 2009, 2010

Now available: url = http://www.astroarch.com/wiki/index.php/VMware_Virtual_Infrastructure_Security'VMware vSphere (TM) and Virtual Infrastructure Security' [/ URL]

Also available url = http://www.astroarch.com/wiki/index.php/VMWare_ESX_Server_in_the_Enterprise"VMWare ESX Server in the enterprise" [url]

Blogs: url = http://www.virtualizationpractice.comvirtualization practice [/ URL] | URL = http://www.astroarch.com/blog Blue Gears [url] | URL = http://itknowledgeexchange.techtarget.com/virtualization-pro/ TechTarget [url] | URL = http://www.networkworld.com/community/haletky Global network [url]

Podcast: url = http://www.astroarch.com/wiki/index.php/Virtualization_Security_Round_Table_Podcastvirtualization security Table round Podcast [url] | Twitter: url = http://www.twitter.com/TexiwillTexiwll [/ URL]

Tags: VMware

Similar Questions

Several vmk vMotion using Nexus 1000v?

Hello
We would like to use several for vMotion vmkernel ports in an environment with a Nexus 1000v dVS.
We work in an environment where the vMotion traffic crosses a dVS VMware and it works surprisingly well. We would like to use this new feature cool vSphere5 using the vmk vmotion ports attached to a Nexus 1000v? Is this possible? Someone has it in production?
Thanks in advance.

Œuvres multi-NIC with any active VMotion VMkernel portgroup vMotion, no matter if it is using standard, vDS switches VMware or a third party such as the Cisco Nexus 1000v vDS.

-Andreas

VM - FEX and Nexus 1000v relationship

Hello

I'm new in the world of virtulaization and I need to know what the relationship between Cisco Nexus 1000v and Cisco VM - FEX? and when to use VM - FEX and when to use Nexus 1000v.

Concerning

Ahmed,

Nexus 1000v is a Distributed Switch that allows you to manage your VEM, see this relationship as a supervisor-LineCard relationship.

VM - FEX gives you the opportunity to bypass the vSwitch embarked on each host ESXi (VEM) for example.

With VM - FEX, you see the virtual machines as if they were directly connected to the Parent switch (N7K / 5K for example), making it the parent spend management (cause there is more no vSwitch in the middle).

This is a good topic that can be discussed and is difficult to summarize in a few lines, you read something in particular? any questions or doubts we can help clarify?

-Kenny

Cisco Nexus 1000V - DMZ - ARP

Hello
Thanks for reading.
I have a virtual (VM1) connected to a Nexus 1000V distributed switch. The willing 1000V of a connection to our DMZ (physically, an interface on our Cisco ASA 5520) which has 3 other virtual machines that are used successfully to the top in the demilitarized zone. The problem is that a SHOW on the SAA ARP shows the other VM addresses MAC but not VM1.
The properties for all the VMS (including VM1) participating in the demilitarized zone are the same:
- Tag network
- VLAN ID
- Port group
- State - link up
- DirectPath i/o - inactive "path Direct I/O has been explicitly disabled for this port.
The only important difference between VM1 and the others is that they are multihomed agents and have one foot in our private network. I think that the absence of a private IP VM1 is not the source of the problem. All virtual machines recognized as directly connected to the ASA (except VM1).
Have you ever seen this kind of thing before?
Thanks again for reading!
Bob

The systems team:
1. Rebuilt the virtual machine
2. Moved to another cluster
3. Configured for DMZ interface
Something that they got the visible VM to the FW.

Nexus 1000v, UCS, and Microsoft NETWORK load balancing

Hi all

I have a client that implements a new Exchange 2010 environment. They have an obligation to configure load balancing for Client Access servers. The environment consists of VMware vShpere running on top of Cisco UCS blades with the Nexus 1000v dvSwitch.

Everything I've read so far indicates that I must do the following:

1 configure MS in Multicast mode load balancing (by selecting the IGMP protocol option).

2. create a static ARP entry for the address of virtual cluster on the router for the subnet of the server.

3. (maybe) configure a static MAC table entry on the router for the subnet of the server.

3. (maybe) to disable the IGMP snooping on the VLAN appropriate in the Nexus 1000v.

My questions are:

1. any person running successfully a similar configuration?

2 are there missing steps in the list above, or I shouldn't do?

3. If I am disabling the snooping IGMP on the Nexus 1000v should I also disable it on the fabric of UCS interconnections and router?

Thanks a lot for your time,.

Aaron

Aaron,

The steps above you are correct, you need steps 1-4 to operate correctly. Normally people will create a VLAN separate to their interfaces NLB/subnet, to prevent floods mcast uncessisary frameworks within the network.

To answer your questions

(1) I saw multiple clients run this configuration

(2) the steps you are correct

(3) you can't toggle the on UCS IGMP snooping. It is enabled by default and not a configurable option. There is no need to change anything within the UCS regarding MS NLB with the above procedure. FYI - the ability to disable/enable the snooping IGMP on UCS is scheduled for a next version 2.1.
```
This is the correct method untill the time we have the option of configuring static multicast mac entries on

the Nexus 1000v.  If this is a feature you'd like, please open a TAC case and request for bug CSCtb93725 to be linked to your SR.
This will give more "push" to our develpment team to prioritize this request.
Hopefully some other customers can share their experience.
Regards,
```
Robert

Configuration of the channel of port on nexus 1000V

Hello

I'm new on nexus 1000V, the configuration is as follows, UCS chassis with 4 blades full-width connected to 2 FI 6248UP.

each FI's uplink to a n5k (no mail ORDER).

is there any configuration model the nexus 1000v? How to configure port-channel?

Thank you.

Hello

We recommend using mac pinning ("channel-group auto mode on mac - pinning") when N1KV is used on the blades of the UCS.

Next doc provides good overview on best practices.

Best practices in deploying Cisco Nexus 1000V switches in the Cisco UCS B and C series series Cisco UCS Manager servers

http://www.Cisco.com/en/us/prod/collateral/switches/ps9441/ps9902/white_paper_c11-558242.html

HTH

Padma

Update Virtual Center 5.0 to 5.1 (using Cisco Nexus 1000V)

Need advice on upgrading production please.
current environment
Race of Virtual Center 5.0 as a virtual machine to connect to oracle VM DB
3 groups
1: 8 blades of ESXI 5.0 IBM cluster, CLuster 2: 5 IBM 3850 x 5
2 cisco Nexus 1000v of which cluster only 1 use.
I know that the procedure of upgrading to 5.1
1. create DB SSO, SSO of installation
2 upgrading VC to 5.1
3. install WEB CLient set up AD authentication
IT IS:
I have problems with the Nexus 1000? I hope the upgrade will treat them as he would a distributed switch and I should have no problem.

He wj, treat the Nexus as a dVS.

migration from 4.1 to 5.1 hosts/guests of Nexus 1000V to VDS using CLI power

Is there scripts out there that will migrate to a host and guests on this respective host of a virtual center of ESXi 4.1 with Nexus 1000v switch, for a new virtual Center 5.1 with a VDS of VMWare ESXi.
I don't want to upgrade the host 5.1, or guests. only move them from 4.1 to 5.1 Virtual Center and upgrade at a later date

Maybe can the Gabe migration distributed vSwitch in vCenter new post help?

The Nexus 1000V loop prevention

Hello

I wonder if there is a mechanism that I can use to secure a network against the loop of L2 packed the side of vserver in Vmware with Nexus 1000V environment.

I know, Nexus 1000V can prevent against the loop on the external links, but there is no information, there are features that can prevent against the loop caused by the bridge set up on the side of the OS on VMware virtual server.

Thank you in advance for an answer.

Concerning

Lukas

Hi Lukas.

To avoid loops, the N1KV does not pass traffic between physical network cards and also, he silently down traffic between vNIC is the bridge by operating system.

http://www.Cisco.com/en/us/prod/collateral/switches/ps9441/ps9902/guide_c07-556626.html#wp9000156

We must not explicit configuration on N1KV.

Padma

Design/implementation of Nexus 1000V

Hi team,

I have a premium partner who is an ATP on Data Center Unified Computing. He has posted this question, I hope you can help me to provide the resolution.

I have questions about nexus 1KV design/implementation:

-How to migrate virtual switches often to vswitch0 (in each ESX server has 3 vswitches and the VMS installation wizard will only migrate vswicht0)? for example, to other vswitchs with other vlan... Please tell me how...
-With MUV (vmware update manager) can install modules of MEC in ESX servers? or install VEM manually on each ESX Server?
-Assuming VUM install all modules of MEC, MEC (vib package) version is automatically compatible with the version of vmware are?
-is the need to create port of PACKET-CONTROL groups in all THE esx servers before migrating to Nexus 1000? or only the VEM installation is enough?
-According to the manual Cisco VSM can participate in VMOTION, but, how?... What is the recommendation? When the primary virtual machines are moving, the secondary VSM take control? This is the case with connectivity to all virtual machines?
-When there are two clusters in a vmware vcenter, how to install/configure VSM?
-For the concepts of high availability, which is the best choice of design of nexus? in view of the characteristics of vmware (FT, DRS, VMOTION, Cluster)
-How to migrate port group existing Kernel to nexus iSCSI?... What are the steps? cisco manual "Migration from VMware to Cisco Nexus 1000V vSwitch" show how to generate the port profile, but
How to create iSCSI target? (ip address, the username/password)... where it is defined?
-Assuming that VEM licenses is not enough for all the ESX servers, ¿will happen to connectivity of your virtual machines on hosts without licenses VEM? can work with vmware vswitches?

I have to install nexus 1000V in vmware with VDI plataform, with multiple ESX servers, with 3 vswitch on each ESX Server, with several machinne virtual running, two groups defined with active vmotion and DRS and the iSCSI storage Center

I have several manuals Cisco on nexus, but I see special attention in our facilities, migration options is not a broad question, you you have 'success stories' or customers experiences of implementation with migration with nexus?

Thank you in advance.

Jojo Santos

Cisco partner Helpline presales

Thanks for the questions of Jojo, but this question of type 1000v is better for the Nexus 1000v forum:

https://www.myciscocommunity.com/Community/products/nexus1000v

Answers online. I suggest you just go in a Guides began to acquire a solid understanding of database concepts & operations prior to deployment.

jojsanto wrote:

Hi Team,

I have a premium partner who is an ATP on Data Center Unified Computing. He posted this question, hopefully you can help me provide resolution.

I have questions about nexus 1KV design/implementation:

-How migrate virtual switchs distint to vswitch0 (in each ESX server has 3 vswitches and the installation wizard of VMS only migrate vswicht0)?? for example others vswitchs with others vlan.. please tell me how...

[Robert] After your initial installation you can easily migrate all VMs within the same vSwitch Port Group at the same time using the Network Migration Wizard. Simply go to Home - Inventory - Networking, right click on the 1000v DVS and select "Migrate Virtual Machine Networking..." Follow the wizard to select your Source (vSwitch Port Groups) & Destination DVS Port Profiles

-With VUM (vmware update manager) is possible install VEM modules in ESX Servers ??? or must install VEM manually in each ESX Server?

[Robert] As per the Getting Started & Installation guides, you can use either VUM or manual installation method for VEM software install.

http://www.cisco.com/en/US/docs/switches/datacenter/nexus1000/sw/4_0_4_s_v_1_3/getting_started/configuration/guide/n1000v_gsg.html

-Supposing of VUM install all VEM modules, the VEM version (vib package) is automatically compatible with build existen vmware version?

[Robert] Yes. Assuming VMware has added all the latest VEM software to their online repository, VUM will be able to pull down & install the correct one automatically.

-is need to create PACKET-MANAGEMENT-CONTROL port groups in ALL esx servers before to migrate to Nexus 1000? or only VEM installation is enough???

[Robert] If you're planning on keeping the 1000v VSM on vSwitches (rather than migrating itself to the 1000v) then you'll need the Control/Mgmt/Packet port groups on each host you ever plan on running/hosting the VSM on. If you create the VSM port group on the 1000v DVS, then they will automatically exist on all hosts that are part of the DVS.

-According to the Cisco manuals VSM can participate in VMOTION, but, how? .. what is the recommendation?..when the primary VMS is moving, the secondary VSM take control?? that occurs with connectivity in all virtual machines?

[Robert] Since a VMotion does not really impact connectivity for a significant amount of time, the VSM can be easily VMotioned around even if its a single Standalone deployment. Just like you can vMotion vCenter (which manages the actual task) you can also Vmotion a standalone or redundant VSM without problems. No special considerations here other than usual VMotion pre-reqs.

-When there two clusters in one vmware vcenter, how must install/configure VSM?

[Robert] No different. The only consideration that changes "how" you install a VSM is a vCenter with multiple DanaCenters. VEM hosts can only connect to a VSM that reside within the same DC. Different clusters are not a problem.

-For High Availability concepts, wich is the best choices of design of nexus? considering vmware features (FT,DRS, VMOTION, Cluster)

[Robert] There are multiple "Best Practice" designs which discuss this in great detail. I've attached a draft doc one on this thread. A public one will be available in the coming month. Some points to consider is that you do not need FT. FT is still maturing, and since you can deploy redundany VSMs at no additional cost, there's no need for it. For DRS you'll want to create a DRS Rule to avoid ever hosting the Primar & Secondary VSM on the same host.

-How to migrate existent Kernel iSCSI port group to nexus? .. what are the steps? in cisco manual"Migration from VMware vSwitch to Cisco Nexus 1000V" show how to generate the port-profile, but
how to create the iSCSI target? (ip address, user/password) ..where is it defined?

[Robert] You can migrate any VMKernel port from vCenter by selecting a host, go to the Networking Configuration - DVS and select Manage Virtual Adapters - Migrate Existing Virtual Adapter. Then follow the wizard. Before you do so, create the corresponding vEth Port Profile on your 1000v, assign appropriate VLAN etc. All VMKernel IPs are set within vCenter, 1000v is Layer 2 only, we don't assign Layer 3 addresses to virtual ports (other than Mgmt). All the rest of the iSCSI configuration is done via vCenter - Storage Adapters as usual (for Targets, CHAP Authentication etc)

-Supposing of the licences of VEM is not enough for all ESX servers,, ¿will happen to the connectivity of your virtual machines in hosts without VEM licences? ¿can operate with vmware vswitches?

[Robert] When a VEM comes online with the DVS, if there are not enough available licensses to license EVERY socket, the VEM will show as unlicensed. Without a license, the virtual ports will not come up. You should closely watch your licenses using the "show license usage" and "show license usage " for detailed allocation information. At any time a VEM can still utilize a vSwitch - with or without 1000v licenses, assuming you still have adapters attached to the vSwitches as uplinks.

I must install nexus 1000V in vmware plataform with VDI, with severals Servers ESX, with 3 vswitch on each ESX Server, with severals virtual machinne running, two clusters defined with vmotion and DRS active and central storage with iSCSI

I have severals cisco manuals about nexus, but i see special focus in installations topics, the options for migrations is not extensive item, ¿do you have "success stories" or customers experiences of implementation with migrations with nexus?

[Robert] Have a good look around the Nexus 1000v community Forum. Lots of stories and information you may find helpful.

Good luck!

[Nexus 1000v] Vincent can be add in VSM

Hi all

due to my lab, I have some problems with Nexus 1000V when VEM cannot add in VSM.

+ VSM has already installed on ESX 1 (stand-alone or ha) and you can see:

See the Cisco_N1KV module.

Status of Module Type mod Ports model

--- ----- -------------------------------- ------------------ ------------

1 active 0 virtual supervisor Module Nexus1000V *.

HW Sw mod

--- ---------------- ------------------------------------------------

1 4.2 (1) SV1(4a) 0.0

MOD-MAC-Address (es) series-Num

--- -------------------------------------- ----------

1 00-19-07-6c-5a-a8 na 00-19-07-6c-62-a8

Server IP mod-Server-UUID servername

--- --------------- ------------------------------------ -------------------

1 10.4.110.123 NA NA

+ on ESX2 installed VEM

[[email protected] / * / ~] status vem #.

VEM modules are loaded

Switch name Num used Ports configured Ports MTU rising ports

128 3 128 1500 vmnic0 vSwitch0

VEM Agent (vemdpa) is running

[[email protected] / * / ~] #.

all advice to do this.

Thank you very much

Doan,

Need more information.

The reception was added via vCenter to DVS 1000v successfully?

If so, there is probably a problem with your control communication VLAN between the MSM and VEM. Start here and ensure that the VIRTUAL local area network has been created on all intermediate switches and it is allowed on each end-to-end trunk.

If you're still stuck, paste your config running of your VSM.

Kind regards

Robert

Remove the ' system VLAN "Nexus 1000V port-profile

We have a Dell M1000e blade chassis with a number of Server Blade M605 ESXi 5.0 using the Nexus 1000V for networking. We use 10 G Ethernet fabric B and C, for a total of 4 10 cards per server. We do not use the NIC 1 G on A fabric. We currently use a NIC of B and C fabrics for the traffic of the virtual machine and the other card NETWORK in each fabric for traffic management/vMotion/iSCSI VM. We currently use iSCSI EqualLogic PS6010 arrays and have two configuration of port-groups with iSCSI connections (a physical NIC vmnic3 and a vmnic5 of NIC physical).
We have added a unified EMC VNX 5300 table at our facility and we have configured three VLANs extra on our network - two for iSCSI and other for NFS configuration. We've added added vEthernet port-profiles for the VLAN of new three, but when we added the new vmk # ports on some of the ESXi servers, they couldn't ping anything. We got a deal of TAC with Cisco and it was determined that only a single port group with iSCSI connections can be bound to a physical uplink both.
We decided that we would temporarily add the VLAN again to the list of VLANS allowed on the ports of trunk of physical switch currently only used for the traffic of the VM. We need to delete the new VLAN port ethernet-profile current but facing a problem.
The Nexus 1000V current profile port that must be changed is:
The DenverMgmtSanUplinks type ethernet port profile
VMware-port group
switchport mode trunk
switchport trunk allowed vlan 2308-2306, 2311-2315
passive auto channel-group mode
no downtime
System vlan 2308-2306, 2311-2315
MGMT RISING SAN description
enabled state
We must remove the list ' system vlan "vlan 2313-2315 in order to remove them from the list" trunk switchport allowed vlan.
However, when we try to do, we get an error about the port-profile is currently in use:
vsm21a # conf t
Enter configuration commands, one per line. End with CNTL/Z.
vsm21a (config) #-port ethernet type DenverMgmtSanUplinks profile
vsm21a(config-port-Prof) # system vlan 2308-2306, 2311-2312
ERROR: Cannot delete system VLAN, port-profile in use by Po2 interface
We have 6 ESXi servers connected to this Nexus 1000V. Originally they were MEC 3-8 but apparently when we made an update of the firmware, they had re - VEM 9-14 and the old 6 VEM and associates of the Channel ports, are orphans.
By example, if we look at the port-channel 2 more in detail, we see orphans 3 VEM-related sound and it has no ports associated with it:
Sho vsm21a(config-port-Prof) # run int port-channel 2
! Command: show running-config interface port-canal2
! Time: Thu Apr 26 18:59:06 2013
version 4.2 (1) SV2 (1.1)
interface port-canal2
inherit port-profile DenverMgmtSanUplinks
MEC 3
vsm21a(config-port-Prof) # sho int port-channel 2
port-canal2 is stopped (no operational member)
Material: Port Channel, address: 0000.0000.0000 (bia 0000.0000.0000)
MTU 1500 bytes, BW 100000 Kbit, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA
Port mode is trunk
Auto-duplex, 10 Gb/s
Lighthouse is off
Input stream control is turned off, output flow control is disabled
Switchport monitor is off
Members in this channel: Eth3/4, Eth3/6
Final cleaning of "show interface" counters never
102 interface resets
We can probably remove the port-channel 2, but assumed that the error message on the port-profile in use is cascading on the other channel ports. We can delete the other port-channel 4,6,8,10 orphans and 12 as they are associated with the orphan VEM, but we expect wil then also get errors on the channels of port 13,15,17,19,21 and 23 who are associated with the MEC assets.
We are looking to see if there is an easy way to fix this on the MSM, or if we need to break one of the rising physical on each server, connect to a vSS or vDS and migrate all off us so the Nexus 1000V vmkernel ports can clean number VLAN.

You will not be able to remove the VLAN from the system until nothing by using this port-profile. We are very protective of any vlan that is designated on the system command line vlan.

You must clean the canals of old port and the old MEC. You can safely do 'no port-channel int' and "no vem" on devices which are no longer used.

What you can do is to create a new port to link rising profile with the settings you want. Then invert the interfaces in the new port-profile. It is generally easier to create a new one then to attempt to clean and the old port-profile with control panel vlan.

I would like to make the following steps.

Create a new port-profile with the settings you want to

Put the host in if possible maintenance mode

Pick a network of former N1Kv eth port-profile card

Add the network adapter in the new N1Kv eth port-profile

Pull on the second NIC on the old port-profile of eth

Add the second network card in the new port-profile

You will get some duplicated packages, error messages, but it should work.

The other option is to remove the N1Kv host and add it by using the new profile port eth.

Another option is to leave it. Unless it's really bother you no VMs will be able to use these ports-profile unless you create a port veth profile on this VLAN.

Louis

How to check and confirm the Nexus 1000V secondary work if primary goes off

Hello
I installed Nexus 1000V Primarry and secondary on different ESXis
but I have to turn off the primary, how to ensure that the school will be in charge and usually have any disconnection
the module displays them and seem to be ok
any other checks to do before continuing?
Thank you
Use "show system redundancy status. You can also manually failover

http://www.Cisco.com/en/us/docs/switches/Datacenter/nexus1000/SW/4_2_1_s_v_1_4/high_availability/configuration/guide/n1000v_ha_3system.html

The output from the example:
```
n1000v# show system redundancy status
```
```
Redundancy role
---------------
administrative: primary
operational: primary
```
Redundancy mode
---------------
administrative: HA
operational: HA
```
This supervisor (sup-1)
-----------------------
Redundancy state: Active
Supervisor state: Active
Internal state: Active with HA standby
```
Another supervisor (sup-2)
```
------------------------
Redundancy state: Standby
Supervisor state: HA standby
Internal state: HA standby
```

ESXi 5 and Nexus 1000v

Hello
I have an ESXi 5 but only NIC I am migrating the VSS for Nexus 1000v. I installed Nexus VEM correctly and do primary and secondary, VSMs configured uplink port groups all according to the guides from Cisco. When I try to add a host under the link, I have first to migrate the vnic0 for the Group of appropriate uplink ports and it then asks me to migrate the management port (I think it is vmk0) so if I create a group of ports on Nexus to migrate a management port or do not migrate at all I always lose connectivity to ESXi.
Can someone please share the configs of the Nexus 1000v and how to migrate properly vnic0 and vmk0 (with a single physical NETWORK adapter) so that I do not lose connectivity?
Thanks in advacne.
Remi

control is vlan 152 and package is 153.

You can make same vlan. We have supported using the same vlan for the control and the package for several years now.

Louis

Cisco Nexus 1000V Virtual Switch Module investment series in the Cisco Unified Computing System

Hi all
I read an article by Cisco entitled "Best practices in Deploying Cisco Nexus 1000V Switches Cisco UCS B and C Series series Cisco UCS Manager servers" http://www.cisco.com/en/US/prod/collateral/switches/ps9441/ps9902/white_paper_c11-558242.html

A lot of excellent information, but the section that intrigues me, has to do with the implementation of module of the VSM in the UCS. The article lists 4 options in order of preference, but does not provide details or the reasons underlying the recommendations. The options are the following:

============================================================================================================================================================
Option 1: VSM external to the Cisco Unified Computing System on the Cisco Nexus 1010

In this scenario, the virtual environment management operations is accomplished in a method identical to existing environments not virtualized. With multiple instances on the Nexus 1010 VSM, multiple vCenter data centers can be supported.
============================================================================================================================================================

Option 2: VSM outside the Cisco Unified Computing System on the Cisco Nexus 1000V series MEC

This model allows to centralize the management of virtual infrastructure, and proved to be very stable...
============================================================================================================================================================

Option 3: VSM Outside the Cisco Unified Computing System on the VMware vSwitch

This model allows to isolate managed devices, and it migrates to the model of the device of the unit of Services virtual Cisco Nexus 1010. A possible concern here is the management and the operational model of the network between the MSM and VEM devices links.
============================================================================================================================================================

Option 4: VSM Inside the Cisco Unified Computing System on the VMware vSwitch

This model was also stable in test deployments. A possible concern here is the management and the operational model of the network links between the MSM and VEM devices and switching infrastructure have doubles in your Cisco Unified Computing System.
============================================================================================================================================================

As a beginner for both 100V Nexus and UCS, I hope someone can help me understand the configuration of these options and equally important to provide a more detailed explanation of each of the options and the resoning behind preferences (pro advantages and disadvantages).

Thank you
Pradeep

No, they are different products. vASA will be a virtual version of our ASA device.

ASA is a complete recommended firewall.

Configuring network DMZ, internal using Nexus 1000v

Similar Questions

Maybe you are looking for