Solved Nexus SVI and HSRP routing

---

Hello ITPro! Wondering if someone can comment on this experience regarding the routing of a host out of a VLAN using a pair of Nexus 3548 switches, SVIs with HSRP.

host contained within a VLAN and routed out by a pair of Nexus switches using SVI/HSRP.

NX1 SVI IP: 10.10.35.2/24
NX1 SVI IP: 10.10.35.3/24
HSRP VIP: 10.10.35.1

I was testing failover and monkeyed with the priority of the HSRP group, all seems to work no matter which Nexus switch is the active HSRP partner, works as expected.

If I shut down one of the SVIs to simulate a failure, all seems to work. Host inside VLAN is able to route out. I can even enable the SVI, then disable the SVI on the second Nexus switch and all is still well.

If I shut down both SVIs, traffic stops for the host inside the VLAN, totally expected. However, I can’t get things flowing again until both SVIs are enabled. If just enabling one, the host still fails to route.

Have any idea why that would be happening?

Here is a snip of the vPC config.

vcp domain 1
peer-switch
role priority (1|2)  <depending on what switch you are looking at in the pair
peer-keepalive destination x.x.x.x
peer-gateway
layer3 peer-router
auto-recovery

I tried to make this bite sized and not include the entirety of the config. Hopefully this description has the important parts, but if you need more info before you can comment, just let me know. Thanks again for your thoughts!

I just got off the phone with Cisco TAC regarding this issue. Good conversation. Basically the answer was, don't shut down SVIs. Lol.. It isn't a Cisco accepted failure simulation. With "peer-gateway" enabled on the vPC, the peer Nexus device is still going to try and forward a packet destined for the other Nexus device to the disabled SVI. It doesn't know it has been disabled and weirdness occurs.

They still recommend enabling peer-gateway as a best practice, it just doesn't work right if you admin shut down an SVI interface.

So.. My failure testing scenarios are going to have to include a different approach.

Regards,

Adam Tyler

Link to discussion on Cisco forums with more detail:
https://community.cisco.com/t5/switching/nexus-3548-svi-and-hsrp-routing/m-p/3988077/highlight/false#M477139

I just got off the phone with Cisco TAC regarding this issue. Good conversation. Basically the answer was, don't shut down SVIs. Lol.. It isn't a Cisco accepted failure simulation. With "peer-gateway" enabled on the vPC, the peer Nexus device is still going to try and forward a packet destined for the other Nexus device to the disabled SVI. It doesn't know it has been disabled and weirdness occurs.

They still recommend enabling peer-gateway as a best practice, it just doesn't work right if you admin shut down an SVI interface.

So.. My failure testing scenarios are going to have to include a different approach.

Regards,

Adam Tyler