Octet

Say this first

An orphan port is a port in a vPC VLAN that is not a vPC member: a single-attached server, a firewall with one link, or the standby NIC of an active/standby team. When the peer link fails, the secondary suspends its vPCs and vPC VLAN SVIs but leaves orphan ports up. A device on the secondary's orphan port keeps link but cannot reach anything. The fix is to dual-attach it, or to configure vpc orphan-port suspend so the port goes down with the vPCs and the host fails over to its NIC on the primary.

Go deeper

In normal operation

Traffic for an orphan port often crosses the peer link: anything that arrives on the other peer (from the uplinks, or hashed there by a vPC-attached device) has to cross to reach it. Size the peer link for it.

Finding them

show vpc orphan-ports lists every orphan port per VLAN.

Fixing them

NX-OS

interface Ethernet1/10
  description SRV2 nic1, active-standby team
  vpc orphan-port suspend

Use it on physical ports facing hosts that can fail over to a second NIC on the other peer. For devices with one NIC, the real fix is a second link.

They will ask next

Can a router run a routing protocol to both vPC peers over a vPC?
Historically it was not supported, because routed packets crossing the peer link hit the loop prevention rule. Newer NX-OS releases support it with layer3 peer-router in the vPC domain. The classic advice is separate routed links from the router to each peer.

Traps

Moving single-attached devices to the primary and calling it fixed. Roles are not preemptive and swap after a reload.

How did you do?