Data Center · Nexus vPC
Design a production-grade vPC domain on Nexus 9000 or Nexus 7000: peer-link, peer-keepalive, role priority, system-mac, and member port-channels — with copy-paste CLI for both peers.
vPC looks simple until the first peer-link goes down at 2am. Good design means orphan-port suspend, matched system MAC, keepalive on a separate physical link (mgmt0 VRF), and role priority that survives a reload. This tool bakes those defaults in.
You get two CLI blocks — one per peer. They are nearly identical except for role priority, keepalive source/destination, and interface names. Apply both in a change window; the peer-link comes up first, then keepalive exchanges role, then member port-channels resume forwarding.
The classic failure modes: (1) keepalive on the same path as peer-link, so a fiber cut kills both and both peers declare primary — split-brain; (2) missing orphan-port suspend so single-homed servers on the secondary peer are stranded during a peer-link failure; (3) mismatched system MAC causing STP bridge ID flap; (4) auto-recovery disabled so after a reload the domain hangs waiting for peer-alive.
Best practice: keepalive on mgmt0 in a dedicated VRF (or a routed SVI on a different physical card), role priority explicitly set on both peers with a 100-value gap, system-mac under vpc domain, and auto-recovery enabled. Dual-active exclusion (peer-switch, peer-gateway) is a must.
Yes on Nexus 9000 — it makes both peers advertise the same STP bridge ID, preventing topology change on peer-link failure. Required for vPC+ and strongly recommended for standard vPC.
mgmt0 is fine for most deployments. Use a dedicated routed SVI only if your mgmt network is unreliable or shared with production control plane.
Yes — the default 30s is usually too short. Bump to 150-240s if downstream devices take time to converge (many SVIs, HSRP, or LISP).
Peer-A priority 100, Peer-B priority 200. Peer-link Po10 over Eth1/49-50 (100G). Keepalive 10.0.0.1↔10.0.0.2 in management VRF. Member Po100 trunked to downstream FI cluster. Orphan-port suspend enabled for single-homed backup host.
Peer-link Po10 over Eth3/1-2 (40G). Keepalive via routed SVI Vlan99 on back-to-back cable. System-mac explicitly set (system-mac 0000.0000.0020) to avoid MAC-address-table churn on reload.