What is the difference between the vPC peer link and the peer keepalive, and what happens when each one fails?
Show the answer
Say this first
The peer link is a port-channel that carries vPC VLAN traffic and the control sync between the peers. The peer keepalive is a separate layer 3 heartbeat, usually over mgmt0, on UDP 3200, sent every second with a 5-second timeout. It only exists to tell "peer link down" from "peer dead". Keepalive down alone: no traffic impact, just an alarm. Peer link down with keepalive up: the secondary suspends its vPC member ports and its vPC VLAN SVIs, and the primary carries everything. Both down: each thinks the other is dead, which is dual-active.
Go deeper
Failure table
| Peer link | Keepalive | Result |
|---|---|---|
| Up | Down | Nothing changes for traffic. Fix the keepalive before anything else fails. |
| Down | Up | Secondary suspends its vPCs and vPC VLAN SVIs. Orphan ports stay up but are stranded. |
| Down | Down | Dual-active. Both keep forwarding without sync. Unpredictable. |
Roles
Primary and secondary are decided by role priority (lower wins, default 32667), then by system MAC. The election is not preemptive, so after a reload the roles may stay swapped.
Design rules
- Peer link: at least two members on different line cards or ASICs.
- Keepalive: never over the peer link. Use mgmt0 in the management VRF, or a dedicated routed link in its own VRF.
auto-recovery: lets the secondary take over when it concludes the primary is really gone, and lets a switch that boots alone bring its vPCs up after a delay (240 seconds by default).
Arista MLAG difference
Arista sends MLAG heartbeats over the peer link itself, on a dedicated VLAN (4094 by convention). For
split-brain protection you add peer-address heartbeat over the management network and a
dual-primary detection action.
They will ask next
Why must the keepalive not run over the peer link?
Then a peer link failure always takes the keepalive with it. Both peers think the other is dead and you are in dual-active every time.
What are type 1 and type 2 consistency checks?
Type 1 parameters must match or the vPC is suspended: for example STP mode, LACP mode, speed and MTU. With graceful consistency check (the default), only the secondary suspends. Type 2 mismatches log a warning and can still cause subtle forwarding problems.
Traps
- Saying a keepalive failure takes vPCs down. It does not while the peer link is up.