Leaf-Spine Deployment and Best Practices Guide
Leaf-Spine Deployment and Best Practices Guide
Guide
Deploying leaf-spine networks in the data center with Dell EMC Networking and Cisco
Nexus multilayer switches
Dell EMC Networking Solutions Engineering
July 2017
Revisions
Date Rev. Description Authors
THIS WHITE PAPER IS FOR INFORMATIONAL PURPOSES ONLY, AND MAY CONTAIN TYPOGRAPHICAL ERRORS AND TECHNICAL
INACCURACIES. THE CONTENT IS PROVIDED AS IS, WITHOUT EXPRESS OR IMPLIED WARRANTIES OF ANY KIND.
Copyright © 2017 Dell Inc. All rights reserved. Dell and the Dell EMC logo are trademarks of Dell Inc. in the United States and/or other jurisdictions. All
other marks and names mentioned herein may be trademarks of their respective companies.
Core
Spine 1 Aggregation
Access
Traditional network architecture
Due to increasing east-west traffic within the data center (server-server, server-storage, etc.), an alternative to
the traditional access-aggregation-core network model is becoming more widely used. This architecture,
shown in Figure 2, is known as a Clos or leaf-spine network and is designed to minimize the number of hops
between hosts.
Spine
Leaf
Leaf-spine architecture
In a leaf-spine architecture, the access layer is referred to as the leaf layer. Servers and storage devices
connect to leaf switches at this layer. At the next level, the aggregation and core layers are condensed into a
single spine layer. Every leaf switch connects to every spine switch to ensure that all leaf switches are no
more than one hop away from one another. This minimizes latency and the likelihood of bottlenecks in the
network.
A leaf-spine architecture is highly scalable. As administrators add racks to the data center, a pair of leaf
switches are added to each new rack. Spine switches may be added as bandwidth requirements increase.
The connections between leaf and spine switches can be layer 2 (switched) or layer 3 (routed). This
deployment guide provides step-by-step configuration examples of both topologies. It includes examples
using Dell EMC Networking switches at both the leaf and spine layers and examples with Cisco Nexus
switches at the spine layer. The objective is to enable a network administrator or engineer with traditional
networking experience to deploy a layer 2 or layer 3 leaf-spine architecture using the examples provided.
Underlined Monospace Text CLI examples that wrap the page. This text is entered as a single
command.
Bold Monospace Text Used to distinguish CLI examples from surrounding text.
The layer 2 and layer 3 topologies each use two leaf switches at the top of each rack configured as a Virtual
Link Trunking (VLT) pair. VLT allows all connections to be active while also providing fault tolerance. As
administrators add racks to the data center, two leaf switches configured for VLT are added to each new rack.
The total number of leaf-spine connections is equal to the number of leaf switches multiplied by the number of
spine switches. Bandwidth of the fabric may be increased by adding connections between leafs and spines
as long as the spine layer has capacity for the additional connections.
Spine 1 Spine
Spine22 External
L3 Connection Network
L2 Connection
ECMP
L3 L3
Leaf 1 VLTi Leaf 2 Leaf 3 VLTi Leaf 4 Edge Leaf VLTi Edge Leaf
L2 L2
Rack 1 Rack 2 Rack n
For connections to external networks, layer 3 links are added between the spines and a pair of edge leafs.
VLT
Leaf 1 VLTi Leaf 2 Leaf 3 VLTi Leaf 4 Edge Leaf VLTi Edge Leaf
Rack 1 Rack 2 Rack n
• For each VLAN, the layer 2 topology creates one large broadcast domain across the fabric. The layer
3 topology has the benefit of containing broadcast domains to each rack.
• The layer 2 topology is limited to 4094 VLANs across the fabric. The layer 3 topology allows up to
4094 VLANs per rack.
• The layer 2 topology is limited to two physical switches at the spine layer (configured as VLT peers).
In a layer 3 topology, additional spines may be added as needed to provide additional paths and
bandwidth. Therefore, a layer 3 topology is more scalable and is better suited for very large networks.
• Overlay networks utilizing VXLAN (such as VMware NSX) require a layer 3 underlay network.
If none of the layer 2 limitations are a concern, it may ultimately come down to a matter of preference. This
guide provides examples of both topologies.
An S3048-ON installed in each rack provides 1GbE connectivity to the management network. The RJ-45
OOB management ports on each spine and leaf switch are connected to the S3048-ON switches as shown in
Figure 9. PowerEdge server iDRACs and Chassis Management Controllers (CMCs) are also connected for
server administration.
For the S3048-ON management switches, all ports used are in layer 2 mode and are in the default VLAN.
Rapid Spanning Tree Protocol (RSTP) is enabled as a precaution against loops. No additional configuration is
required.
Note: The management network used in the examples in this guide is 100.67.187.0/24.
Management
Network
Management Network
Note: A management network is not a requirement to configure or use a leaf-spine network, but is
recommended to efficiently manage servers, switches and storage devices.
The first three protocols are used in all layer 2 and layer 3 topology examples:
The remaining protocols are only used in the layer 3 topology examples:
5.1 VLT
VLT allows link aggregation group (LAG) terminations on two separate switches and supports a loop-free
topology. The two switches are referred to as VLT peers and are kept synchronized via an inter-switch link
called the VLT interconnect (VLTi). A separate backup link maintains heartbeat messages across the OOB
management network.
VLT provides layer 2 multipathing and load-balances traffic. VLT offers the following additional benefits:
In layer 2 leaf-spine topologies, VLT is used at both the leaf and spine layers.
In layer 3 topologies, VLT is only used at the leaf layer. An additional feature called VLT peer routing is
enabled on the leaf switches for connections to layer 3 networks. VLT peer routing:
• Enables one VLT node to act as the default gateway for its VLT peer
• Eliminates the need to use Virtual Router Redundancy Protocol (VRRP)
• Enables active-active load sharing
With peer routing enabled, traffic is routed through either VLT peer and is passed directly to the next hop
without needing to traverse the VLTi.
5.2 UFD
If a leaf switch loses all connectivity to the spine layer, by default the attached hosts continue to send traffic to
that leaf without a direct path to the destination. The VLTi link to the peer leaf switch handles traffic during
such a network outage, but this is not considered a best practice.
Dell EMC recommends enabling UFD, which detects the loss of upstream connectivity. An uplink-state group
is configured on each leaf switch, which creates an association between the uplinks to the spines and the
downlink interfaces.
In the event all uplinks fail on a switch, UFD automatically shuts down the downstream interfaces. This
propagates to the hosts attached to the leaf switch. The host then uses its link to the remaining switch to
continue sending traffic across the leaf-spine network.
5.3 RSTP
As a precautionary measure, Dell EMC recommends enabling RSTP on all switches that have layer 2
interfaces. Because VLT environments are loop-free, simultaneously running spanning tree is optional though
considered a best practice in case of switch misconfiguration or improperly connected cables. In properly
configured and connected leaf-spine networks, there are no ports blocked by spanning tree.
• BGP
• OSPF
• Intermediate System to Intermediate System (IS-IS)
5.4.1 BGP
BGP may be selected for scalability and is well suited for very large networks. BGP can be configured as
External BGP (EBGP) to route between autonomous systems or Internal BGP (IBGP) to route within a single
autonomous system.
Layer 3 leaf-spine networks use ECMP routing. EBGP and IBGP handle ECMP differently. By default, EBGP
supports ECMP without any adjustments. IBGP requires a BGP route reflector and the use of the AddPath
feature to fully support ECMP. To keep configuration complexity to a minimum, Dell EMC recommends EBGP
in leaf-spine fabric deployments.
BGP tracks IP reachability to the peer remote address and the peer local address. Whenever either address
becomes unreachable, BGP brings down the session with the peer. To ensure fast convergence with BGP,
Note: BGP fast fall-over is enabled manually on Dell EMC switches and is enabled by default on Cisco
Nexus 5600 series switches.
Examples using EBGP (BGPv4) are provided in the layer 3 topology examples in this guide.
5.4.2 OSPF
OSPF is an interior gateway protocol that provides routing inside an autonomous network. OSPF routers send
link-state advertisements to all other routers within the same autonomous system areas. While generally more
memory and CPU intensive than BGP, OSPF may offer faster convergence. OSPF is often used in smaller
networks. Examples using OSPF (OSPFv2 for IPv4) are provided in the layer 3 topology examples in this
guide.
5.4.3 IS-IS
IS-IS, like OSPF, is a link-state routing protocol that computes the best path through the network. Though
supported, the protocol is not as widely used and is not covered in this document. To use IS-IS for routing,
consult the applicable switch’s user guide.
5.5 BFD
BFD is a protocol used to rapidly detect communication failures between two adjacent systems over a layer 3
link. It is a simple and lightweight replacement for existing routing protocol link state detection mechanisms.
Though optional, use of BFD is considered a best practice for optimizing a leaf-spine network.
BFD provides forwarding path failure detection times on the order of milliseconds rather than seconds as with
conventional routing protocols. It is independent of routing protocols and provides a consistent method of
failure detection when used across a network. Networks converge faster because BFD triggers link state
changes in the routing protocol sooner and more consistently.
Dell EMC Networking has implemented BFD at layer 3 with user datagram protocol (UDP) encapsulation.
BFD is supported with routing protocols including BGP, OSPF and IS-IS.
Spine 1 Spine 2
Path 1
Path 2
ECMP
ECMP is a routing technique used in a layer 3 leaf-spine topology for load balancing packets along these
multiple equal cost paths. ECMP is enabled on all leaf and spine switches, allowing traffic between leafs to be
load balanced across the spines.
64601 64602
ASNs should follow a logical pattern for ease of administration and allow for growth as additional leaf and
spine switches are added. In this example, an ASN with a "6" in the hundreds place represents a spine switch
(e.g. 64601) and an ASN with a "7" in the hundreds place represents a leaf switch (e.g. 64701).
6.2 IP addressing
Establishing a logical, scalable IP address scheme is important before deploying a leaf-spine topology. This
section covers the IP addressing used in the layer 3 examples in this guide.
All loopback addresses used are part of the 10.0.0.0/8 address space with each address using a 32-bit mask.
In this example, the third octet represents the layer, “1” for spine and “2” for leaf. The fourth octet is the
counter for the appropriate layer. For example, 10.0.1.1/32 is the first spine switch in the topology while
10.0.2.4/32 is the fourth leaf switch.
All addresses come from the same base IP prefix, 192.168.0.0/16 with the third octet representing the spine
number. For example, 192.168.1.0/31 is a two host subnet connected to Spine 1 while 192.168.2.0/31 is
connected to Spine 2. This IP scheme is easily extended as leaf and spine switches are added to the
network.
Link labels are provided in the table for quick reference with Figure 13.
Spine 1 Spine 2
A B C D E F G H
Note: The example point-to-point addresses use a 31-bit mask to save address space. This is optional and
covered in RFC 3021. Below is an example when setting an IP address with a 31-bit mask on a Dell EMC
S4048-ON. The warning message can be safely ignored on point-to-point interfaces.
S4048-Leaf-1(conf-if-fo-1/49)#ip address 192.168.1.1/31
% Warning: Use /31 mask on non point-to-point interface cautiously.
Note: The BGP ASNs and IP addresses defined in Section 6 are used here.
ECMP
Po 1 Po 1
Server 1 Server 2
IP Address 172.16.1.7/24 IP Address 10.60.1.7/24
Gateway 172.16.1.1 Gateway 10.60.1.1
Example 1: Layer 3 leaf-spine topology with Dell EMC leaf and spine switches
In Rack 1, VLAN 50 is used and devices in VLAN 50 are assigned IP addresses on the 172.16.1.0/24
network. With VLT peer routing enabled on S4048-Leaf1 and S4048-Leaf2, Server 1 may specify the IP
address assigned to VLAN 50 on either leaf, 172.16.1.1 or 172.16.1.2, as its default gateway. Traffic is load
balanced across both leafs.
Rack 2 is configured in an identical manner, except VLAN 60 is used and devices in VLAN 60 are assigned IP
addresses on the 10.60.1.0/24 network. Server 2 may specify the VLAN 60 IP address of either leaf,
10.60.1.1 or 10.60.1.2, as its default gateway.
Note: On S4048-ON switches, Telnet is enabled and SSH is disabled by default. Both services require the
creation of a non-root user account to login. If needed, it is a best practice to use SSH instead of Telnet for
security. SSH can optionally be enabled with the command: (conf)#ip ssh server enable.
A user account can be created to access the switch via SSH with the command
(conf)#username ssh_user sha256-password ssh_password
First, configure the serial console enable password and disable Telnet.
S4048-Leaf1 S4048-Leaf2
enable enable
configure configure
Set the hostname, configure the OOB management interface and default gateway. Enable LLDP and BFD.
Enable RSTP as a precaution. S4048-Leaf1 is configured as the primary RSTP root bridge using the
bridge-priority 0 command. S4048-Leaf2 is configured as the secondary RSTP root bridge using the
bridge-priority 4096 command.
S4048-Leaf1 S4048-Leaf2
hostname S4048-Leaf1 hostname S4048-Leaf2
Note: Dell EMC recommends that the VLTi is configured as a static LAG, without LACP, per the commands
shown below.
S4048-Leaf1 S4048-Leaf2
interface port-channel 127 interface port-channel 127
description VLTi description VLTi
channel-member fortyGigE 1/53 - 1/54 channel-member fortyGigE 1/53 - 1/54
no shutdown no shutdown
interface range fortyGigE 1/53 - 1/54 interface range fortyGigE 1/53 - 1/54
description VLTi description VLTi
no shutdown no shutdown
Configure each downstream server-facing interface with an LACP port channel. Configure each port channel
for VLT. Port channel 1 connects downstream to Server 1 and is configured as an RSTP edge port.
S4048-Leaf1 S4048-Leaf2
interface tengigabitethernet 1/4 interface tengigabitethernet 1/4
description Server 1 description Server 1
port-channel-protocol LACP port-channel-protocol LACP
port-channel 1 mode active port-channel 1 mode active
no shutdown no shutdown
Note: In this example, Server 1’s NIC is configured as an LACP NIC team. It is assigned the IP address
172.16.1.7/24. The SVI on either leaf, 172.16.1.1 or 172.16.1.2, is specified as Server 1’s default gateway.
The VLT peer routing feature will load balance traffic and provide fault tolerance if either leaf goes offline,
regardless of which leaf’s address is specified as the server’s gateway.
S4048-Leaf1 S4048-Leaf2
interface Vlan 50 interface Vlan 50
ip address 172.16.1.1/24 ip address 172.16.1.2/24
untagged Port-channel 1 untagged Port-channel 1
no shutdown no shutdown
The two upstream layer 3 interfaces connected to the spine switches are configured. Assign IP addresses per
Table 1. Configure a loopback interface to be used as the router ID. This is used with BGP or OSPF.
Note: If multiple loopback interfaces exist on a system, the interface with the highest numbered IP address
is used as the router ID. This configuration only uses one loopback interface.
S4048-Leaf1 S4048-Leaf2
interface fortyGigE 1/49 interface fortyGigE 1/49
description Spine-1 description Spine-1
ip address 192.168.1.1/31 ip address 192.168.1.3/31
no shutdown no shutdown
The command seq 10 permit 10.0.0.0/8 ge 24 includes all addresses in the 10.0.0.0/8 address
range with a mask greater than or equal to 24. This includes all loopback addresses used as router IDs as
well as the 10.60.1.0/24 network used on Leafs 3 and 4 as shown in Figure 14.
The command seq 20 permit 172.16.0.0/16 ge 24 includes the 172.16.1.0/24 network used on
Leafs 1 and 2 as shown in Figure 14.
S4048-Leaf1 S4048-Leaf2
route-map spine-leaf permit 10 route-map spine-leaf permit 10
match ip address spine-leaf match ip address spine-leaf
Include the point-to-point interfaces to each leaf pair in an ECMP group. Enable link bundle monitoring to
report when traffic is unevenly distributed across multiple links.
S4048-Leaf1 S4048-Leaf2
ecmp-group 1 ecmp-group 1
interface fortyGigE 1/49 interface fortyGigE 1/49
interface fortyGigE 1/50 interface fortyGigE 1/50
link-bundle-monitor enable link-bundle-monitor enable
Configure UFD. This shuts the downstream interfaces if all uplinks fail. The hosts attached to the switch use
the remaining LACP port member to continue sending traffic across the fabric.
S4048-Leaf1 S4048-Leaf2
uplink-state-group 1 uplink-state-group 1
description Disable downstream ports description Disable downstream ports
in event all uplinks fail in event all uplinks fail
downstream TenGigabitEthernet 1/1-1/48 downstream TenGigabitEthernet 1/1-1/48
upstream fortyGigE 1/49,1/50 upstream fortyGigE 1/49,1/50
end end
write write
First, enable BGP with the router bgp ASN command. The ASN is from Figure 11.
The bgp bestpath as-path multipath-relax enables ECMP. The maximum-paths ebgp 2
command specifies the maximum number of parallel paths to a destination to add to the routing table. This
number should be equal to or greater than the number of spines, up to 64.
BFD settings are configured to 100 millisecond send/receive intervals. The multiplier is the number of packets
that must be missed to declare a session down.
Finally, exit configuration mode and save the configuration with the end and write commands.
S4048-Leaf1 S4048-Leaf2
enable enable
configure configure
end end
write write
First, enable OSPF is enabled with the router ospf process-id command (valid range is 1-65535).
The maximum-paths 2 command enables ECMP and specifies the maximum number of parallel paths to a
destination to add to the routing table. This number should be equal to or greater than the number of spines,
up to 64.
BFD settings are configured to 100 millisecond send/receive intervals. The multiplier is the number of packets
that must be missed to declare a session down.
Finally, exit configuration mode and save the configuration with the end and write commands.
S4048-Leaf1 S4048-Leaf2
enable enable
configure configure
end end
write write
Note: On Z9100-ON switches, Telnet is enabled and SSH is disabled by default. Both services require the
creation of a non-root user account to login. If needed, it is a best practice to use SSH instead of Telnet for
security. SSH can optionally be enabled with the command: (conf)#ip ssh server enable.
A user account can be created to access the switch via SSH with the command
(conf)#username ssh_user sha256-password ssh_password
First, configure the serial console enable password and disable Telnet.
Z9100-Spine1 Z9100-Spine2
enable enable
configure configure
Set the hostname, configure the OOB management interface and default gateway. Set the hostname,
configure the OOB management interface and default gateway. Enable LLDP and BFD.
Set the port speed of the four ports connected to the leaf switches to 40GbE.
Z9100-Spine1 Z9100-Spine2
hostname Z9100-Spine1 hostname Z9100-Spine2
Note: If multiple loopback interfaces exist on a system, the interface with the highest numbered IP address
is used as the router ID. This configuration only uses one loopback interface.
Z9100-Spine1 Z9100-Spine2
interface fortyGigE 1/1/1 interface fortyGigE 1/1/1
description Leaf 1 fo1/49 description Leaf 1 fo1/50
ip address 192.168.1.0/31 ip address 192.168.2.0/31
no shutdown no shutdown
The command seq 10 permit 10.0.0.0/8 ge 24 includes all addresses in the 10.0.0.0/8 address
range with a mask greater than or equal to 24. This includes all loopback addresses used as router IDs as
well as the 10.60.1.0/24 network used on Leafs 3 and 4 as shown in Figure 14.
The command seq 20 permit 172.16.0.0/16 ge 24 includes the 172.16.1.0/24 network used on
Leafs 1 and 2 as shown in Figure 14.
Z9100-Spine1 Z9100-Spine2
route-map spine-leaf permit 10 route-map spine-leaf permit 10
match ip address spine-leaf match ip address spine-leaf
Include the point-to-point interfaces to each leaf pair in an ECMP group. Enable link bundle monitoring to
report when traffic is unevenly distributed across multiple links.
Finally, exit configuration mode and save the configuration with the end and write commands.
Z9100-Spine1 Z9100-Spine2
ecmp-group 1 ecmp-group 1
interface fortyGigE 1/1/1 interface fortyGigE 1/1/1
interface fortyGigE 1/2/1 interface fortyGigE 1/2/1
link-bundle-monitor enable link-bundle-monitor enable
ecmp-group 2 ecmp-group 2
interface fortyGigE 1/3/1 interface fortyGigE 1/3/1
interface fortyGigE 1/4/1 interface fortyGigE 1/4/1
link-bundle-monitor enable link-bundle-monitor enable
end end
write write
First, enabled BGP with the router bgp ASN command. The ASN is from Figure 11.
The bgp bestpath as-path multipath-relax enables ECMP. The maximum-paths ebgp 2
command specifies the maximum number of parallel paths to a destination to add to the routing table. In this
topology, there are two equal cost best paths from a spine to a host, one to each leaf that the host is
connected.
BFD settings are configured to 100 millisecond send/receive intervals. The multiplier is the number of packets
that must be missed to declare a session down. Finally, exit configuration mode and save the configuration.
Z9100-Spine1 Z9100-Spine2
enable enable
configure configure
end end
write write
First, enable OSPF with the router ospf process-id command (valid range is 1-65535).
The maximum-paths 2 command enables ECMP and specifies the maximum number of parallel paths to a
destination to add to the routing table. In this topology, there are two equal cost best paths from a spine to a
host, one to each leaf that the host is connected.
BFD settings are configured to 100 millisecond send/receive intervals. The multiplier is the number of packets
that must be missed to declare a session down.
Finally, exit configuration mode and save the configuration with the end and write commands.
Z9100-Spine1 Z9100-Spine2
enable enable
configure configure
end end
write write
Command and output examples are provided for one spine and one leaf. Command output on other switches
is similar.
The first set of routes with a subnet mask of /32 are the IPs configured for router IDs.
S4048-Leaf1 has two paths to all other leafs and two paths to Server 2’s network, 10.60.1.0. There is one
path through each spine. If all paths do not appear, make sure the maximum-paths statement in the BGP
configuration is equal to or greater than the number of spines in the topology.
Note: The command show ip route <cr> can also be used to verify the information above as well as
static routes and direct connections.
The first set of routes with a subnet mask of /32 are the IPs configured for router IDs.
S4048-Leaf1 has two paths to all other leafs and two paths to Server 2’s network, 10.60.1.0. There is one
path through each spine. If all paths do not appear, make sure the maximum-paths statement in the OSPF
configuration is equal to or greater than the number of spines in the topology.
Note: The command show ip route <cr> can also be used to verify the information above as well as
static routes and direct connections.
Note: The output shown below is for BGP configurations as indicated by a B in the Clients column. On
OSPF configurations, the output is identical except there is an O in the Clients column.
S4048-Leaf1#show uplink-state-group
If an interface happens to be disabled by UFD, the show uplink-state-group command output will
appear as follows:
Note: When an interface has been disabled by UFD, the show interfaces interface command for
affected interfaces indicates it is error-disabled as follows:
S4048-Leaf-1#show interfaces te 1/4
TenGigabitEthernet 1/4 is up, line protocol is down(error-disabled[UFD])
-- Output truncated –-
Interface Designated
Name PortID Prio Cost Sts Cost Bridge ID PortID
---------- -------- ---- ------- ----------- ----- -------------------- --------
Po 1 128.2 128 1800 FWD(vlt) 0 0 f48e.3820.3729 128.2
Po 127 128.128 128 600 FWD(vltI) 0 0 f48e.3820.3729 128.128
Interface
Name Role PortID Prio Cost Sts Cost Link-type Edge
---------- ------ -------- ---- ------- ----------- ------- --------- ----
Po 1 Desg 128.2 128 1800 FWD 0 (vlt) P2P Yes
Po 127 Desg 128.128 128 600 FWD 0 (vltI)P2P No
Note: The BGP ASNs and IP addresses defined in Section 6 are used here.
ECMP
Po 1 Po 1
Server 1 Server 2
IP Address 172.16.1.7/24 IP Address 10.60.1.7/24
Gateway 172.16.1.1 Gateway 10.60.1.1
Example 2: Layer 3 leaf-spine topology with Dell EMC leaf and Cisco Nexus spine switches
Note: All switch configuration files for the topology in Figure 15 are contained in the attachment named
Example2_config_files.pdf. The files may be edited as needed in a plain text editor and commands pasted
directly into switch consoles.
Dell EMC Networking switches start at their factory default settings per Appendix A.
Cisco Nexus switches in this example were reset to their factory default configurations by running write
erase followed by reload. After reload, "Power on Auto Provisioning" was not used, the admin password
was configured and the Nexus “basic configuration dialog” was not used. Refer to your Nexus system
documentation for more information.
First, set the hostname, enable LLDP and disable switchport as the default port type. Configure the
management interface and default management route.
Nexus5600-Spine1 Nexus5600-Spine2
enable enable
configure configure
Configure the four point-to-point interfaces connected to leaf switches. Assign IP addresses per Table 1
(replacing destination interfaces Fo 1/1/1-1/4/1 in Table 1 with Nexus interfaces Ethernet 2/1-2/4). Configure a
loopback interface to be used as the router ID. This is used with BGP or OSPF.
Finally, exit configuration mode and save the configuration with the end and copy running-config
startup-config commands.
Nexus5600-Spine1 Nexus5600-Spine2
interface ethernet 2/1 interface ethernet 2/1
description Leaf 1 fo1/49 description Leaf 1 fo1/50
ip address 192.168.1.0/31 ip address 192.168.2.0/31
no shutdown no shutdown
end end
copy running-config startup-config copy running-config startup-config
Note: After running the command feature bfd, the message Please disable the ICMP
redirects on all interfaces running BFD sessions using the command 'no ip
redirects' may be displayed. This is done in the subsequent commands.
Run the no ip redirects command on the interfaces that will run BFD.
BGP is enabled with the router bgp ASN command. The ASN is from Figure 11.
BGP neighbors are configured and BFD is enabled for each neighbor connection.
Finally, exit configuration mode and save the configuration with the end and copy running-config
startup-config commands.
Note: On Nexus 5600 series switches, BGP graceful-restart, fast-external-fallover and BFD interval
commands are configured by default.
Nexus5600-Spine1 Nexus5600-Spine2
enable enable
configure configure
end end
copy running-config startup-config copy running-config startup-config
Note: After running the feature bfd command, the following message may be displayed:
Please disable the ICMP redirects on all interfaces running BFD sessions using
the command 'no ip redirects'. This is done in the subsequent commands.
The maximum-paths 2 command enables ECMP and specifies the maximum number of parallel paths to a
destination to add to the routing table. In this topology, there are two equal cost best paths from a spine to a
host, one to each leaf that the host is connected.
Run the no ip redirects command on the interfaces that will run BFD. Add the interfaces connected to
the leaf switches to OSPF area 0. Enable BFD on the interfaces.
Finally, exit configuration mode and save the configuration with the end and copy running-config
startup-config commands.
Nexus5600-Spine1 Nexus5600-Spine2
enable enable
configure configure
end end
copy running-config startup-config copy running-config startup-config
Command and output examples are provided for one spine and one leaf. Command output on other switches
is similar.
Note: All neighbor states should be FULL. If a neighbor is stuck in EXSTART or EXCHANGE, there may be
an MTU setting mistmatch between the two connected interfaces.
Note: The first set of routes with a subnet mask of /32 are the IPs configured for router IDs.
S4048-Leaf1 has two paths to all other leafs and two paths to Server 2’s network, 10.60.1.0. There is one
path through each spine. If all paths do not appear, make sure the maximum-paths statement in the BGP
configuration is equal to or greater than the number of spines in the topology.
The first set of routes with a subnet mask of /32 are the IPs configured for router IDs.
S4048-Leaf1 has two paths to all other leafs and two paths to Server 2’s network, 10.60.1.0. There is one
path through each spine. If all paths do not appear, make sure the maximum-paths statement in the OSPF
configuration is equal to or greater than the number of spines in the topology.
Note: The output for S4048-Leaf1 shown is for BGP configurations as indicated by a B in the Clients
column. On OSPF configurations, the output is identical except there is an O in the Clients column. Nexus
spine output is the same for either protocol.
Po 1 Po 2
Fo 1/51
Fo 1/53 Fo 1/51 Fo 1/53 Fo 1/51 Fo 1/53 Fo 1/51 Fo 1/53
VLAN 10, VLAN 20 Leaf 1-S4048 VLTi Leaf 2-S4048 Leaf 3-S4048 VLTi Leaf 4-S4048
All leafs
Fo 1/49-1/50 Te 1/48
Fo 1/49-1/50
Te 1/48 Rack 1 Te 1/48 Rack 2 Te 1/48
On both servers,
IP address : VLAN 10: IP address :
192.168.20.1 and Server 1 subnet 192.168.10.0/24 Server 2 192.168.20.2 and
192.168.10.1 VLAN 20: 192.168.10.2
subnet 192.168.20.0/24
Example 3: Layer 2 leaf-spine topology with Dell EMC leaf and spine switches
Note: All switch configuration files for the topology in Figure 16 are contained in the attachment named
Example3_config_files.pdf. The files may be edited as needed in a plain text editor and commands pasted
directly into switch consoles. Dell EMC Networking switches start at their factory default settings per
Appendix A.
Note: On S4048-ON switches, Telnet is enabled and SSH is disabled by default. Both services require the
creation of a non-root user account to login. If needed, it is a best practice to use SSH instead of Telnet for
security. SSH can optionally be enabled with the command: (conf)#ip ssh server enable.
A user account can be created to access the switch via SSH with the command
(conf)#username ssh_user sha256-password ssh_password
L2-Leaf1-S4048 L2-Leaf2-S4048
enable enable
configure configure
Set the hostname, configure the OOB management interface and default gateway. Enable LLDP. Enable
RSTP as a precaution.
Note: In this layer 2 topology, the RSTP root bridge is configured at the spine level.
L2-Leaf1-S4048 L2-Leaf2-S4048
hostname L2-Leaf1-S4048 hostname L2-Leaf2-S4048
Configure the VLT interconnect between Leaf1 and Leaf2. In this configuration, add interfaces fortyGigE 1/49-
50 to static port channel 127 for the VLT interconnect. The backup destination is the management IP address
of the VLT peer switch.
Note: Dell EMC recommends that the VLTi is configured as a static LAG (without LACP) per the commands
shown below.
L2-Leaf1-S4048 L2-Leaf2-S4048
interface Port-channel 127 interface Port-channel 127
description VLTi Port-Channel description VLTi Port-Channel
no ip address no ip address
channel-member fortyGigE 1/49,1/50 channel-member fortyGigE 1/49,1/50
no shutdown no shutdown
interface range fortyGigE 1/49 - 1/50 interface range fortyGigE 1/49 - 1/50
description VLTi description VLTi
no ip address no ip address
no shutdown no shutdown
Interface Te 1/48 connects downstream to Server 1 and is configured as an RSTP edge port. Interfaces Fo
1/51 and Fo 1/53 connect to the spines upstream and are configured in LACP port channel 1. The port
channel is configured for VLT.
L2-Leaf1-S4048 L2-Leaf2-S4048
interface TenGigabitEthernet 1/48 interface TenGigabitEthernet 1/48
description Server 1 description Server 1
no ip address no ip address
portmode hybrid portmode hybrid
switchport switchport
spanning-tree rstp edge-port spanning-tree rstp edge-port
no shutdown no shutdown
VLANs 10 and 20 are configured on each switch. Port-channel 1 is tagged in both VLANs.
Note: The shutdown/no shutdown commands on a VLAN have no effect unless the VLAN is assigned
an IP address (configured as an SVI).
L2-Leaf1-S4048 L2-Leaf2-S4048
interface Vlan 10 interface Vlan 10
no ip address no ip address
tagged TenGigabitEthernet 1/48 tagged TenGigabitEthernet 1/48
tagged Port-channel 1 tagged Port-channel 1
Configure UFD. This shuts the downstream interfaces if all uplinks fail. The hosts attached to the switch use
the remaining LACP port member to continue sending traffic across the fabric.
Finally, exit configuration mode and save the configuration with the end and write commands.
L2-Leaf1-S4048 L2-Leaf2-S4048
uplink-state-group 1 uplink-state-group 1
description Disable all edge ports in description Disable all edge ports in
event all spines uplinks fail event all spines uplinks fail
downstream TenGigabitEthernet 1/1-1/48 downstream TenGigabitEthernet 1/1-1/48
upstream Port-channel 1 upstream Port-channel 1
end end
write write
Note: On S6010-ON switches, Telnet is enabled and SSH is disabled by default. Both services require the
creation of a non-root user account to login. If needed, it is a best practice to use SSH instead of Telnet for
security. SSH can optionally be enabled with the command: (conf)#ip ssh server enable.
A user account can be created to access the switch via SSH with the command
(conf)#username ssh_user sha256-password ssh_password
First, configure the serial console enable password and disable Telnet.
L2-Spine1-S6010 L2-Spine2-S6010
enable enable
configure configure
Set the hostname, configure the OOB management interface and default gateway. Enable LLDP.
L2-Spine1-S6010 L2-Spine2-S6010
hostname L2-Spine1-S6010 hostname L2-Spine2-S6010
Configure the VLT interconnect between Spine1 and Spine2. In this configuration, add interfaces fortyGigE
1/31-32 to static port channel 127 for the VLT interconnect. The backup destination is the management IP
address of the VLT peer switch.
Note: Dell EMC recommends that the VLTi is configured as a static LAG (without LACP) per the commands
shown below.
L2-Spine1-S6010 L2-Spine2-S6010
interface Port-channel 127 interface Port-channel 127
description VLTi Port-Channel description VLTi Port-Channel
no ip address no ip address
channel-member fortyGigE 1/31,1/32 channel-member fortyGigE 1/31,1/32
no shutdown no shutdown
interface range fortyGigE 1/31 - 1/32 interface range fortyGigE 1/31 - 1/32
description VLTi description VLTi
no ip address no ip address
no shutdown no shutdown
L2-Spine1-S6010 L2-Spine2-S6010
interface fortyGigE 1/25 interface fortyGigE 1/25
description Leaf1-Port51 description Leaf1-Port53
no ip address no ip address
port-channel-protocol LACP port-channel-protocol LACP
port-channel 1 mode active port-channel 1 mode active
no shutdown no shutdown
Note: The shutdown/no shutdown commands on a VLAN have no effect unless the VLAN is assigned
an IP address (configured as an SVI).
Finally, exit configuration mode and save the configuration with the end and write commands.
L2-Spine1-S6010 L2-Spine2-S6010
interface Vlan 10 interface Vlan 10
no ip address no ip address
tagged Port-channel 1-2 tagged Port-channel 1-2
shutdown shutdown
end end
write write
Command and output examples are provided for one spine and one leaf. Command output on other switches
is similar.
S4048-Leaf1#show uplink-state-group
If an interface happens to be disabled by UFD, the show uplink-state-group command output will
appear as follows:
Note: When an interface has been disabled by UFD, the show interfaces interface command for
affected interfaces indicates it is error-disabled as follows:
S4048-Leaf-1#show interfaces te 1/48
TenGigabitEthernet 1/48 is up, line protocol is down(error-disabled[UFD])
-- Output truncated –-
Interface Designated
Name PortID Prio Cost Sts Cost Bridge ID PortID
---------- -------- ---- ------- ----------- ----- -------------------- --------
Po 1 128.2 128 188 FWD(vlt) 0 0 f48e.382b.0869 128.2
Po 2 128.3 128 188 FWD(vlt) 0 0 f48e.382b.0869 128.3
Interface
Name Role PortID Prio Cost Sts Cost Link-type Edge
---------- ------ -------- ---- ------- ----------- ------- --------- ----
Po 1 Desg 128.2 128 188 FWD 0 (vlt) P2P No
Po 2 Desg 128.3 128 188 FWD 0 (vlt) P2P No
Po 127 Desg 128.128 128 600 FWD 0 (vltI)P2P No
Interface Designated
Name PortID Prio Cost Sts Cost Bridge ID PortID
---------- -------- ---- ------- ----------- ----- -------------------- --------
Po 1 128.2 128 188 FWD(vlt) 788 32768 f48e.3820.c529 128.2
Po 127 128.128 128 600 FWD(vltI) 788 32768 6400.6ae6.cc14 128.128
Te 1/48 128.249 128 2000 FWD 788 32768 f48e.3820.c529 128.249
Interface
Name Role PortID Prio Cost Sts Cost Link-type Edge
---------- ------ -------- ---- ------- ----------- ------- --------- ----
Po 1 Root 128.2 128 188 FWD 788 (vlt) P2P No
Po 127 Root 128.128 128 600 FWD 788 (vltI)P2P No
Te 1/48 Desg 128.249 128 2000 FWD 788 P2P Yes
Po 1 Po 2
On both servers,
VLAN 10:
IP address : subnet 192.168.10.0/24 IP address :
192.168.20.21 and Server 1 VLAN 20: Server 2 192.168.20.20 and
192.168.10.11 subnet 192.168.20.0/24 192.168.10.10
Example 4: Layer 2 leaf-spine topology with Dell EMC leaf and Cisco Nexus spine switches
Note: All switch configuration files for the topology in Figure 17 are contained in the attachment named
Example4_config_files.pdf. The files may be edited as needed in a plain text editor and commands pasted
directly into switch consoles.
Dell EMC Networking switches start at their factory default settings per Appendix A.
Cisco Nexus switches in this example were reset to their factory default configurations by running write
erase followed by reload. After reload, "Power on Auto Provisioning" was not used, the admin password
was configured and the Nexus “basic configuration dialog” was not used. Refer to your Nexus system
documentation for more information.
Note: On Z9100-ON switches, Telnet is enabled and SSH is disabled by default. Both services require the
creation of a non-root user account to login. If needed, it is a best practice to use SSH instead of Telnet for
security. SSH can optionally be enabled with the command: (conf)#ip ssh server enable.
A user account can be created to access the switch via SSH with the command
(conf)#username ssh_user sha256-password ssh_password
First, configure the serial console enable password and disable Telnet.
L2-Leaf1-Z9100 L2-Leaf2-Z9100
enable enable
configure configure
Set the hostname, configure the OOB management interface and default gateway. Enable LLDP. Enable
RSTP as a precaution.
Note: In this layer 2 topology, the RSTP root bridge is configured at the spine level.
L2-Leaf1-Z9100 L2-Leaf2-Z9100
hostname L2-Leaf1-Z9100 hostname L2-Leaf2-Z9100
L2-Leaf1-Z9100 L2-Leaf2-Z9100
stack-unit 1 port 1 portmode single stack-unit 1 port 1 portmode single
speed 40G no-confirm speed 40G no-confirm
stack-unit 1 port 3 portmode single stack-unit 1 port 3 portmode single
speed 40G no-confirm speed 40G no-confirm
Configure the VLT interconnect between Leaf1 and Leaf2. In this configuration, add interfaces hundredGigE
1/31 – 1/32 to static port channel 127 for the VLT interconnect. The backup destination is the management IP
address of the VLT peer switch.
L2-Leaf1-Z9100 L2-Leaf2-Z9100
interface Port-channel 127 interface Port-channel 127
description VLTi Port-Channel description VLTi Port-Channel
no ip address no ip address
channel-member hundredGigE 1/31,1/32 channel-member hundredGigE 1/31,1/32
no shutdown no shutdown
Interface Te 1/33 connects downstream to Server 1 and is configured as an RSTP edge port. Interfaces Fo
1/1/1 and Fo 1/3/1 connect to the spines upstream and are configured in LACP port channel 1. The port
channel is configured for VLT.
L2-Leaf1-Z9100 L2-Leaf2-Z9100
interface TenGigabitEthernet 1/33 interface TenGigabitEthernet 1/33
description Server-1 description Server-1
no ip address no ip address
portmode hybrid portmode hybrid
switchport switchport
spanning-tree rstp edge-port spanning-tree rstp edge-port
no shutdown no shutdown
VLANs 10 and 20 are configured on each switch. Port-channel 1 is tagged in both VLANs.
Note: The shutdown/no shutdown commands on a VLAN have no effect unless the VLAN is assigned
an IP address (configured as an SVI).
L2-Leaf1-Z9100 L2-Leaf2-Z9100
interface Vlan 10 interface Vlan 10
no ip address no ip address
tagged TenGigabitEthernet 1/33 tagged TenGigabitEthernet 1/33
tagged Port-channel 1 tagged Port-channel 1
shutdown shutdown
Configure UFD. This shuts the downstream interfaces if all uplinks fail. The hosts attached to the switch use
the remaining LACP port member to continue sending traffic across the fabric.
Finally, exit configuration mode and save the configuration with the end and write commands.
L2-Leaf1-Z9100 L2-Leaf2-Z9100
uplink-state-group 1 uplink-state-group 1
description Disable edge port in event description Disable edge port in event
all spine uplinks fail all spine uplinks fail
downstream TenGigabitEthernet 1/33 downstream TenGigabitEthernet 1/33
upstream Port-channel 1 upstream Port-channel 1
end end
write write
First, enable the LACP and virtual port channel (vPC) features. Configure the hostname, management IP
address and default management route.
Note: Cisco enables Rapid Per VLAN Spanning Tree Plus (RPVST+), its implementation of RSTP, on
Nexus 7000 series switches by default.
L2-Spine1-Nexus7K L2-Spine2-Nexus7K
enable enable
configure configure
Create VLAN 10 and 20. All VLANs are added to RPVST+ as a precaution against loops. L2-Spine1-Nexus7K
is configured as the primary spanning tree root bridge using the spanning tree vlan vlan_numbers
priority 0 command. L2-Spine1-Nexus7K is configured as the secondary spanning tree root bridge using
the spanning tree vlan vlan_numbela priority 4096 command.
L2-Spine1-Nexus7K L2-Spine2-Nexus7K
vlan 10 vlan 10
vlan 20 vlan 20
Specify the management IP address of the vPC peer as the vPC peer-keepalive destination. In this example,
interfaces Ethernet 3/5 and 3/6 are used to create the vPC peer link. Interfaces are configured as trunk ports
and allow applicable VLANs.
L2-Spine1-Nexus7K L2-Spine2-Nexus7K
vpc domain 1 vpc domain 1
role priority 1 role priority 65535
peer-keepalive destination peer-keepalive destination
100.67.184.28 source 100.67.184.21 100.67.184.21 source 100.67.184.28
auto-recovery auto-recovery
Finally, exit configuration mode and save the configuration with the end and copy running-config
startup-config commands.
L2-Spine1-Nexus7K L2-Spine2-Nexus7K
interface port-channel1 interface port-channel1
switchport switchport
switchport mode trunk switchport mode trunk
vpc 1 vpc 1
end end
copy running-config startup-config copy running-config startup-config
vPC domain id : 1
Peer status : peer adjacency formed ok
vPC keep-alive status : peer is alive
Configuration consistency status : success
Per-vlan consistency status : success
Type-2 inconsistency reason : Consistency Check Not Performed
vPC role : primary
Number of vPCs configured : 2
Peer Gateway : Disabled
Dual-active excluded VLANs : -
Graceful Consistency Check : Enabled
Auto-recovery status : Enabled (timeout = 240 seconds)
vPC status
----------------------------------------------------------------------
id Port Status Consistency Reason Active vlans
-- ---- ------ ----------- ------ ------------
1 Po1 up success success 1,10,20
2 Po2 up success success 1,10,20
Legend:
Type 1 : vPC will be suspended in case of mismatch
VLAN0001
Spanning tree enabled protocol rstp
Root ID Priority 1
Address 8478.ac11.e341
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
VLAN0010
Spanning tree enabled protocol rstp
Root ID Priority 10
Address 8478.ac11.e341
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
VLAN0020
Spanning tree enabled protocol rstp
Root ID Priority 20
Factory settings are restored and the switch reloads. After reload, enter A at the [A/C/L/S] prompt as shown
below to exit Bare Metal Provisioning mode.
Dell>
Cisco Nexus 7000 series (validated with Nexus 7004) NX-OS 6.2(16)
Cisco Nexus 5600 series (validated with Nexus 5672UP) NX-OS 7.3(2)N1(1)
We encourage readers to provide feedback on the quality and usefulness of this publication by sending an
email to [email protected].