NX-OS Overview

The cisco NX-OS , next generation operating system was built with modularity, resiliency and serviceability at its foundation. It is based on SAN-OS(Cisco Storage Area Network-Operating System).

Advantage of NX-OS:

1. Unified data center operating system: NX-OS can handle both LAN traffic and SAN traffic.

2. Robust and rich feature set with a variety of Cisco Innovations: Features like ISSU and             PSS(described later)

3. Flexibility and scalability :

4. Modularity : Virtual Device Contexts (VDC)

5. Virtualization :

6. Resiliency

7. IPv4 and IPv6 ip routing and multicast features

8.Comprehensive security , availability, serviceability and management features

Key Features and benefits of NX-OS

1.  Virtual Device Contexts: Available on Cisco Nexus 7000 switches only, these switches can be segmented into multiple virtual devices. These virtual devices function as independent switches and can run independent of each other. VDCs provide benefits like fault isolation, administration plane, seperation of data traffic and enhanced security.

2. Virtual Port Channels(VPCs) : This feature enables a server or switch to use an EtherChannel across two upstream switches without and STP blocked port to enable use of all available uplink bandwidth.

3. Continuous System Operation : Maintenance , upgrades and software certifications can be performed without service interruptions because of the modular nature of NX-OS and features such as In Service Software Upgrade and the ability for processes to restart dynamically.

4. Security : Cisco NX-OS provides outstanding data confidentiality and integrity, supporting standard IEEE 802.1AE link-layer cryptography with 128-bit Advanced Encryption Standard (AES) cryptography. In addition to CTS, there are many additional security features such as access control lists (ACLs) and port-security.

5. Overlay Transport Virtualization (OVT) : Enables layer 2 extension between distributed data centers over any transport layer 3 network.

6. NX-OS Persistant Storage Service :  The PSS is a lightweight database that maintains runtime information state. PSS provides reliable persistant storage to the software components to checkpoint their internal state and data structures enabling non-disruptive restart . If a fault occurs in a process such as OSPF the NX-OS high availability (HA) manager determines best recovery action.

• Restart a process
• Switch over to a redundant supervisor module

7. Fabric Path : This is similar to link state protocol which enables each device to build an overall view of the topology. Each device is identified by a swtich id. This eliminates spanning tree to maximize network bandwidth and flexibility.

For more datails on fabric path refer to : Fabric Path

Introduction to Fabric Path

What is Fabric Path ?

        Cisco Fabric Path is an innovation in Cisco NX-OS software that brings the stability and performance of Layer 3 routing to Layer 2 switched networks to build a highly resilient and scalable Layer 2 fabric. Cisco FabricPath is a foundation for building massively scalable and flexible data centers.. Thus it is a layer 2 routing protocol also sometimes called MAC in MAC Routing.

This is an alternative to running STP. Thus if there is a layer 2 failure due to link cut or layer 2 crash, the entire spanning tree does not need to re-converge which is a feature of STP thus increasing the availabilty of the system. In addition to that, there are no redundant paths as in STP which gives higher bandwidth between the switches by implementing equal cost paths among the links.

How does it work ?

        Cisco Fabric  Path introduces entirely new Layer 2 data plane by encapsulating the frames entering the fabric with a header that consists of routable source and destination addresses. These addresses are called Switch IDs. These addresses are the address of switch in which the frame was received and the address of the destination switch to which the frame is heading. From there the frame is routed until it reaches the remote switch where it is decapsulated and delivered in its original Ethernet format. The figure below shows this simple process.

Fabric Path Terminologies:

Classical Ethernet (CE): It is the regular ethernet with regular flooding and regular STP etc.

The classical ethernet domain has been marked with green border in the figure above.

Leaf Switches : These switches connect CE(Classical Ethernet) domain to FP(Fabric Path) domain.

The switches in the middle of the picture are the leaf switches which are implemented using nexus 5k devices, more precisely nexus 5500 and 7000 F1 and F2 line card modules as nexus 5000 does not support fabric path because fabric path is implemented in hardware.

Spine Swtiches: These switches FP backbone switch with all ports in the FP domain only. The switches on the top of the picture are the spine switches which are implemented using nexus 7k devices.

FP Core Ports: Links the leaf up to spine or between spine switches. The ports in nexus switches are by default in classical ethernet mode ie access mode. Ports within the red border in above picture.To configure it for fabric path the following command should be used.

N7K-1#conf t

N7K-1(config)#int ethernet 1/1

N7K-1(config-if)#switchport mode fabricpath

CE Edge Ports: These ports link the leaf switches connecting to regular classical ethernet domain.

Ports within the green border in above picture.

Fabric Path Switch ID:

           This is analogous to OSPF router id or IS-IS NET id. This identifies the node in IS-IS SPT(Shortest path tree).  This id is automatically generated by default. It can also be assigned manually using the following command in global config mode.

N7K-1#conf t

N7K-1(config)#fabricpath switch-id

Fabric Path Control Plane:

FabricPath IS-IS replaces STP as the control-plane protocol within the FabricPath domain. In other words, FabricPath IS-IS determines the forwarding topology STP(Shortest path tree) instead of STP(Spanning Tree Protocol).    

IS-IS is an industry standard link-state routing protocol. The FabricPath IS-IS implementation is implemented as a single-level IS-IS domain and extended through the definition of FabricPath-specific Type-Length-Value (TLV) fields.

Several characteristics of IS-IS make it ideally suited for use as a Layer 2 forwarding protocol:

●   Has no IP dependency - IS-IS does not require IP reachability in order to form adjacency between devices. While the majority of modern networks do provide IP connectivity for network infrastructure, using IS-IS ensures that no strict requirement for in-band IP connectivity among switches exists.It does not use IP to carry routing information messages. IS-IS is neutral regarding the type of network addresses for which it can route.

●   Easily extensible - Using custom TLVs, IS-IS devices can exchange information about virtually anything. In the case of Layer 3 IS-IS, routers exchange IP prefix reachability. In the case of FabricPath, switches exchange Switch ID reachability.

●   Provides SPF routing - SPF routing protocols have been proven to be scalable, flexible, and fast to converge. In addition, IS-IS supports equal-cost multipath (ECMP) forwarding, allowing data-plane packets to follow any available parallel path rather than restricting forwarding to a single path.

While IS-IS forms the basis of FabricPath, enabling FabricPath in your network requires no specific knowledge of IS-IS - the configuration is plug-and-play. Much as a network operator simply “turns on” STP and interconnects switches, you can enable FabricPath on interfaces and begin forwarding through the FabricPath fabric with minimal configuration.    

Configuring Password on Cisco Router

There are mainly three types of passwords that can be set on cisco routers.
To see the lines available in a cisco router we can use the following command.

sandesh#show line
   Tty Line Typ     Tx/Rx    A Roty AccO AccI   Uses   Noise  Overruns   Int
*    0    0 CTY              -    -    -    -      0       0     0/0       -
     1    1 AUX   9600/9600  -    -    -    -      0       0     0/0       -
   322  322 VTY              -    -    -    -      0       0     0/0       -
   323  323 VTY              -    -    -    -      0       0     0/0       -
   324  324 VTY              -    -    -    -      0       0     0/0       -
   325  325 VTY              -    -    -    -      0       0     0/0       -
   326  326 VTY              -    -    -    -      0       0     0/0       -
   327  327 VTY              -    -    -    -      0       0     0/0       -
   328  328 VTY              -    -    -    -      0       0     0/0       -
   329  329 VTY              -    -    -    -      0       0     0/0       -
   330  330 VTY              -    -    -    -      0       0     0/0       -
   331  331 VTY              -    -    -    -      0       0     0/0       -
   332  332 VTY              -    -    -    -      0       0     0/0       -
   333  333 VTY              -    -    -    -      0       0     0/0       -
   334  334 VTY              -    -    -    -      0       0     0/0       -
   335  335 VTY              -    -    -    -      0       0     0/0       -
   336  336 VTY              -    -    -    -      0       0     0/0       -
   337  337 VTY              -    -    -    -      0       0     0/0       -

The router I am using has an auxiliary port, a console port and 16 vty lines. Following are the passwords that can be set for these lines.

1. Auxiliary Password:
      This password is set for the auxiliary port of router which is located at the back of the router. The purpose of an auxiliary port is to connect an external modem to the router. This modem can be used to connect to the router for troubleshooting purposes should regular connectivity fail. Similary to console port, auxiliary port is also an asynchronous serial port with an RJ-45 interface. A rollover cable is used for connections.

CLI Commands for configuration:

Router(config)#line aux 0
Router(config-line)#password auxiliary
Router(config-line)#login

2. Console Password: 
        Router console ports are meant to allow root access to the router via a dumb terminal interface, regardless of the state of the router (unless it is completely dead). By connecting to the console port you can get remote access to the root level of a router without using the network that the router is connected to. This creates a secondary path to the router outside the bandwidth of the network which needs to be secured without relying on the primary network. A rollover cable is used for connections.

More info about physical connection here : https://www.youtube.com/watch?v=_xA94N__uzk

CLI Commands for configuration:

Router(config)#line aux 0
Router(config-line)#password console
Router(config-line)#login

3. VTY Password:
        This is used in vty lines. Whenever, there is a request to connect to these vty lines, the router ass for a password. A number of protocols can be used to connect to these vty lines. For eg: telnet and ssh. The protocols allowed depends on the cisco router series.

CLI Commands for configuration:

The simplese command include the following.

Router(config)#line vty 0 4
Router(config-line)#password remote
Router(config-line)#login

These commands set password for telnet access. When we try to telnet to the management ip of the router, the router asks for the password.
Eg: C:> telnet 8.8.8.8
       Password:
Configuration to ask for username in telnet access:
Now, if we want the router to ask for the username as well, we need to use the following commands.

Router(config)#username cisco password cisco
Router(config)#line vty 0 4
Router(config-line)#login local

The command login local forces the router to ask for username.

SSH Protocol configuration for VTY lines:

We can also configure to use ssh protocol for remote connections as telnet is not secure. Telnet uses plain-text to transport data to and from the router.

Step 1: Configure the domain name:

Router(config)#ip domain-name sandeshshrestha,net

Step 2: Generate RSA key

Router(config)#crypto key generate rsa
% Please define a hostname other than Router.
Router(config)#hostname sandesh
sandesh(config)#crypto key generate rsa
The name for the keys will be: sandesh.sandeshshrestha.net
Choose the size of the key modulus in the range of 360 to 2048 for your
  General Purpose Keys. Choosing a key modulus greater than 512 may take
  a few minutes.

How many bits in the modulus [512]: 510
% Generating 510 bit RSA keys, keys will be non-exportable...[OK]
sandesh(config)#
*Mar 1 2:53:22.782:  RSA key size needs to be at least 768 bits for ssh version 2
*Mar 1 2:53:22.782:  %SSH-5-ENABLED: SSH 1.5 has been enabled

Two interesting thing to note here:

1. It asks for a hostname other than Router.
2. The ssh verion enabled is 1.5 but there is not 1.5 version for ssh. This basically means that version 2 is not being used here. Instead its version 1. To configure version 2 of ssh, use the following command. Also, note that the rsa key should be at least 768 bits for version 2.

sandesh(config)#ip ssh version 2
Please create RSA keys (of at least 768 bits size) to enable SSH v2.

For reason mentioned above, it gives the error.

Step 3: Configure vty line

Router(config)#line vty 0 4
Router(config-line)#transport input ssh telnet  (allows both ssh and telnet)
Router(config-line)#password ssh
Router(config-line)#login local

Step4: Connect
To connect to vty line in router using ssh we do the following:

C:>ssh cisco@8.8.8.8
Password:

How to clear switch for new configuration

1. Connect to the console port and enter priviliged EXEC mode.

From your computer terminal connect to the console port of the switch using a console cable. You should see the console prompt that includes the switch's hostname followed by > or #.

If the prompt ends in > you are in user mode. To enter priviliged EXEC mode, type enable.

2. Delete the VLAN database file.

Switch#delete flash:vlan.dat
Delete flash vlan.dat ? [confirm]
Switch#

3. Erase the start-up config from nvram


The startup configuration of switches can be removed using the erase-start up config command.

Switch# erase startup-config
Erasing the nvram filesystem will remove all configuration files! Continue?
[confirm]
[OK]
Erase of nvram: complete
Switch#
Switch# reload