Octet

Build a vPC pair and dual-home a server with LACP

NX-OSWorking

Tasks

  1. Enable LACP and vPC and configure the vPC domain with the keepalive over the management VRF.
  2. Build the peer link as an LACP port-channel trunk.
  3. Enable peer-switch with matching STP priority, peer-gateway, auto-recovery and ARP sync.
  4. Create vPC 20 toward SRV1 on both switches.
  5. Verify the pair, the keepalive and the server bundle.

Solution

  1. 1Management, features and vPC domain on LEAF1LEAF1
    LEAF1 on NX-OS
    feature lacp
feature vpc
!
interface mgmt0
  vrf member management
  ip address 192.168.0.1/24
!
vlan 10,20
spanning-tree vlan 10,20 priority 4096
!
vpc domain 10
  role priority 10
  peer-keepalive destination 192.168.0.2 source 192.168.0.1 vrf management
  peer-switch
  peer-gateway
  auto-recovery
  ip arp synchronize

    LEAF2 uses role priority 20 and swaps the keepalive addresses. peer-switch makes both peers send BPDUs with the same bridge ID, so the STP priority must be identical on both.

  2. 2Peer link on LEAF1LEAF1
    LEAF1 on NX-OS
    interface Ethernet1/53-54
  description vPC peer link
  switchport
  switchport mode trunk
  switchport trunk allowed vlan 10,20
  channel-group 1 mode active
  no shutdown
!
interface port-channel1
  description vPC peer link
  switchport
  switchport mode trunk
  switchport trunk allowed vlan 10,20
  spanning-tree port type network
  vpc peer-link

    Same on LEAF2. Bring the keepalive up before the peer link so the pair forms cleanly.

  3. 3vPC toward SRV1 on LEAF1LEAF1
    LEAF1 on NX-OS
    interface Ethernet1/1
  description SRV1 nic1
  switchport
  switchport mode trunk
  switchport trunk allowed vlan 10,20
  channel-group 20 mode active
  no shutdown
!
interface port-channel20
  description SRV1
  switchport
  switchport mode trunk
  switchport trunk allowed vlan 10,20
  spanning-tree port type edge trunk
  vpc 20

    The vPC number must match on both peers. Keep it equal to the port-channel number to stay sane.

  4. 4The server sideSRV1
    SRV1 on Linux
    # /etc/netplan/01-bond.yaml on Ubuntu
network:
  version: 2
  ethernets:
    ens1f0: {}
    ens1f1: {}
  bonds:
    bond0:
      interfaces: [ens1f0, ens1f1]
      parameters:
        mode: 802.3ad
        lacp-rate: fast
        transmit-hash-policy: layer3+4
  vlans:
    bond0.10:
      id: 10
      link: bond0
      addresses: [10.10.10.11/24]

    Mode 802.3ad is LACP. The layer3+4 hash spreads flows across both links instead of pinning everything to one.

Verify

LEAF1 output
LEAF1# show vpc brief
Legend:
                (*) - local vPC is down, forwarding via vPC peer-link

vPC domain id                     : 10
Peer status                       : peer adjacency formed ok
vPC keep-alive status             : peer is alive
Configuration consistency status  : success
Per-vlan consistency status       : success
Type-2 consistency status         : success
vPC role                          : primary
Number of vPCs configured         : 1
Peer Gateway                      : Enabled
Dual-active excluded VLANs        : -
Graceful Consistency Check        : Enabled
Auto-recovery status              : Enabled, timer is off.(timeout = 240s)

vPC Peer-link status
---------------------------------------------------------------------
id    Port   Status Active vlans
--    ----   ------ -------------------------------------------------
1     Po1    up     10,20

vPC status
----------------------------------------------------------------------------
Id    Port          Status Consistency Reason                Active vlans
--    ------------  ------ ----------- ------                ---------------
20    Po20          up     success     success               10,20

Peer adjacency formed, keepalive alive, all consistency checks pass, LEAF1 is primary and vPC 20 is up with both VLANs.

LEAF1 output
LEAF1# show vpc peer-keepalive
vPC keep-alive status           : peer is alive

--Peer is alive for             : (3605) seconds, (512) msec
--Send status                   : Success
--Last send at                  : 2026.11.10 09:12:44 128 ms
--Sent on interface             : mgmt0
--Receive status                : Success
--Last receive at               : 2026.11.10 09:12:44 131 ms
--Received from interface       : mgmt0
--Last update from peer         : (0) seconds, (412) msec

vPC Keep-alive parameters
--Destination                   : 192.168.0.2
--Keepalive interval            : 1000 msec
--Keepalive timeout             : 5 seconds
--Keepalive hold timeout        : 3 seconds
--Keepalive vrf                 : management
--Keepalive udp port            : 3200
--Keepalive tos                 : 192

Keepalives go out and come back on mgmt0, not over the peer link. Default timers 1 second and 5 seconds, UDP 3200.

LEAF1 output
LEAF1# show port-channel summary
Flags:  D - Down        P - Up in port-channel (members)
        I - Individual  H - Hot-standby (LACP only)
        s - Suspended   r - Module-removed
        b - BFD Session Wait
        S - Switched    R - Routed
        U - Up (port-channel)
        p - Up in delay-lacp mode (member)
        M - Not in use. Min-links not met
--------------------------------------------------------------------------------
Group Port-       Type     Protocol  Member Ports
      Channel
--------------------------------------------------------------------------------
1     Po1(SU)     Eth      LACP      Eth1/53(P)   Eth1/54(P)
20    Po20(SU)    Eth      LACP      Eth1/1(P)

Both peer link members are bundled (P) and SRV1's link on this switch is in Po20. LEAF2 shows its own Eth1/1 in Po20.

SRV1 output
SRV1# grep -A3 'Aggregator ID' /proc/net/bonding/bond0
Aggregator ID: 1
Number of ports: 2
Actor Key: 21
Partner Key: 20
--
Aggregator ID: 1
Aggregator ID: 1

Both NICs joined the same aggregator, so the server sees LEAF1 and LEAF2 as one LACP partner. If the vPC were broken, the second NIC would sit in a different aggregator and carry no traffic.

Mistakes people make

  • Running the keepalive over the peer link. Losing the peer link then always means dual-active.
  • Enabling peer-switch with different STP priorities on the two peers.
  • Mismatched type 1 parameters on the vPC port-channel (for example mode or MTU), which suspend the vPC.
  • Using different vPC numbers for the same server on the two peers.
  • Single-attaching other devices to these VLANs without planning for orphan ports.

On other platforms

Arista MLAG for LEAF1. Peer communication runs over an SVI on VLAN 4094 across the peer link, so the management heartbeat is added for dual-primary detection.

Arista EOS
vlan 4094
   trunk group MLAGPEER
no spanning-tree vlan-id 4094
!
interface Ethernet53-54
   channel-group 1 mode active
interface Port-Channel1
   description MLAG peer link
   switchport mode trunk
   switchport trunk group MLAGPEER
interface Vlan4094
   ip address 10.255.255.1/30
!
mlag configuration
   domain-id MLAG10
   local-interface Vlan4094
   peer-address 10.255.255.2
   peer-link Port-Channel1
   peer-address heartbeat 192.168.0.2 vrf MGMT
   dual-primary detection delay 10 action errdisable all-interfaces
!
interface Ethernet1
   channel-group 20 mode active
interface Port-Channel20
   description SRV1
   switchport mode trunk
   switchport trunk allowed vlan 10,20
   mlag 20

Say it in the interview

"Keepalive first, over mgmt0 in the management VRF, then the peer link as an LACP trunk with two members. I add peer-switch with equal STP priorities, peer-gateway, auto-recovery and ARP sync. The server gets vPC 20 on both peers with matching settings. I verify with show vpc brief, the keepalive details, the port-channel summary, and the server's bond showing both NICs in one aggregator."