Black Belt 35 min

Virtual Port-Channels (vPC) on Cisco Nexus

vPC allows a downstream device (server, switch) to bond links to two different Nexus switches as if they were a single device. This eliminates Spanning Tree blocking and maximizes redundancy and bandwidth. NX-OS only; this feature does not exist on Catalyst or ASA.

Why vPC?

Without vPC, if a server has two links to two different Nexus switches:

  • The server bonds them with LACP (802.3ad).
  • The two Nexus switches see the links as separate port-channels.
  • Spanning Tree blocks one link to prevent loops.
  • Only one link carries traffic; the other is idle.

With vPC:

  • The two Nexus switches exchange vPC control traffic over a special peer-link.
  • They agree to present themselves as one virtual device to the server.
  • The server's LACP bundle sees both links as active members of the same port-channel.
  • Both links carry traffic; Spanning Tree does not block either.
  • If one Nexus fails, the other continues seamlessly.

Three Components of vPC

1. vPC Domain: A logical grouping on each peer switch with a domain ID, role priority, and config consistency checks.

2. Peer-Link: A dedicated, redundant link (usually port-channel) between the two peers. Carries vPC control messages and data frames if one peer fails.

3. Peer-Keepalive: A separate management link (out-of-band recommended) that heartbeats between peers. If it fails and peer-link fails, one peer disables to prevent a loop.

vPC Configuration on Nexus

Here is the complete configuration for two Nexus switches (Nexus-1 and Nexus-2) with vPC:

Prerequisite: Enable vPC feature

feature lacp
feature vpc

Nexus-1 Configuration

vpc domain 10
  role priority 100
  peer-keepalive destination 192.0.2.2 source 192.0.2.1 vrf management

interface port-channel 1
  description vPC peer-link
  switchport mode trunk
  vpc peer-link

interface Ethernet 1/49
  switchport mode trunk
  channel-group 1 mode active

interface Ethernet 1/50
  switchport mode trunk
  channel-group 1 mode active

interface port-channel 20
  description vPC member (to Server1)
  switchport mode trunk
  switchport trunk allowed vlan 10,20
  vpc 20

interface Ethernet 1/1
  switchport mode trunk
  switchport trunk allowed vlan 10,20
  channel-group 20 mode active

Nexus-2 Configuration

vpc domain 10
  role priority 200
  peer-keepalive destination 192.0.2.1 source 192.0.2.2 vrf management

interface port-channel 1
  description vPC peer-link
  switchport mode trunk
  vpc peer-link

interface Ethernet 1/49
  switchport mode trunk
  channel-group 1 mode active

interface Ethernet 1/50
  switchport mode trunk
  channel-group 1 mode active

interface port-channel 20
  description vPC member (to Server1)
  switchport mode trunk
  switchport trunk allowed vlan 10,20
  vpc 20

interface Ethernet 1/1
  switchport mode trunk
  switchport trunk allowed vlan 10,20
  channel-group 20 mode active

Key points:

  • vpc domain 10 — creates a vPC domain with ID 10 (must match on both peers).
  • role priority 100 — Nexus-1 is the primary (lower priority value = higher priority); Nexus-2 is secondary (200).
  • peer-keepalive destination 192.0.2.2 source 192.0.2.1 — heartbeat link uses management IPs. This must be out-of-band (separate network) for reliability.
  • vpc peer-link — designates port-channel 1 as the peer-link. This carries both vPC control frames and data.
  • vpc 20 — on port-channel 20, this makes it a vPC member. Both peers must use the same ID (20) for the downstream device.

Why Both Peers Have the Same vPC ID

When you configure vpc 20 on both switches' port-channel 20, the switches tell downstream devices (the server) that they are a single virtual device with vPC ID 20.

The server's LACP bond sees one port-channel (vPC 20) with two members (one link to Nexus-1, one to Nexus-2). Both are active because vPC negotiated them to be so.

Peer-Link: The Hidden Traffic Highway

The peer-link (port-channel 1 in our example) is special:

  • It carries vPC control messages between peers.
  • It carries data frames if one peer becomes isolated (failover).
  • It should be redundant (usually 2–4 physical links bundled).
  • Never send regular traffic through the peer-link intentionally. It is for vPC management and emergencies only.

In our example, port-channel 1 uses Ethernet 1/49 and 1/50 (typically the last ports on a switch, reserved for inter-switch links).

Peer-Keepalive: Out-of-Band Heartbeat

The peer-keepalive is a separate management link using IP addresses in the management VRF.

Why separate? If the peer-link fails (e.g., multiple cable cuts), the vPC peers must detect this via the keepalive. If both peer-link and keepalive fail, the primary peer (lower priority) survives and the secondary disables its vPC port-channels to prevent a loop.

In the lab, you can configure keepalive on the same management subnet. In production, run it on a separate out-of-band network for resilience.

Verifying vPC

show vpc

Shows the overall vPC status: domain ID, peer status (keep-alive is up), role, and summary.

show vpc brief

Quick view of all vPC members and their status.

show vpc consistency-parameters global

Checks if both peers have matching configuration (spanning-tree, allowed VLANs, etc.). Mismatches are flagged.

show vpc peer-keepalive

Verifies the peer-keepalive link status (should be "alive").

show port-channel summary

Lists all port-channels including the peer-link (port-channel 1, should show P for all members) and vPC members (port-channel 20).

Downstream Device Configuration

A server or switch connecting to the vPC sees it as a single LACP port-channel.

Example: Server with Linux bond (802.3ad / LACP):

auto bond0
iface bond0 inet static
  address 10.10.1.100
  netmask 255.255.255.0
  gateway 10.10.1.1
  slaves eth0 eth1
  bond-mode 802.3ad
  bond-miimon 100
  bond-lacp-rate fast

The kernel sees the vPC as one port-channel and balances traffic across eth0 and eth1.

Example: Switch connecting to vPC (as a regular LACP port-channel):

interface port-channel 10
 switchport mode trunk
 switchport trunk allowed vlan 10,20

interface range GigabitEthernet1/0/1 - 2
 switchport mode trunk
 switchport trunk allowed vlan 10,20
 channel-group 10 mode active

From the switch's perspective, this is a standard LACP port-channel to the vPC. It doesn't know or care that it's connecting to two peers.

Common Mistakes and Troubleshooting

1. Forgetting feature vpc: vPC commands won't work without it. Always enable the feature first.
2. Mismatched domain IDs: Both peers must have the same vpc domain ID. If they differ, they won't form a peer relationship.
3. Swapped keepalive IPs: Nexus-1's keepalive destination must be Nexus-2's keepalive source, and vice versa. Swapping them breaks the heartbeat.
4. Forgetting vpc peer-link: Without this command on port-channel 1, the peers don't form a vPC and the link is just a regular trunk.
5. Missing vPC ID on downstream port-channel: If you create port-channel 20 on the peers but forget vpc 20, the downstream device's LACP will see each link separately, and one will be blocked by Spanning Tree.
6. Inconsistent VLAN configuration: If one peer allows VLAN 20 on a vPC member but the other doesn't, traffic fails. Always verify with show vpc consistency-parameters.

vPC vs. Standard Port-Channel

Aspect Standard Port-Channel vPC
Connects Two devices (switch-to-switch, switch-to-server) Downstream device to two Nexus peers simultaneously
Redundancy If one switch fails, the link is down If one Nexus fails, the other continues seamlessly
Spanning Tree Can block one direction of traffic Never blocks; both peers are active
Platforms Catalyst, Nexus, ASA, routers NX-OS (Nexus) only
Control plane LACP only LACP + vPC domain negotiation

Real-World Scenario

Data center with:

  • Two Nexus 9300 switches (vPC peers).
  • Servers with dual NICs bonded to vPC via LACP.
  • Peer-link on ports 49–50 (port-channel 1).
  • Peer-keepalive on the management network (192.0.2.0/30).
  • vPC members on ports 1–8 (port-channel 20–27).

Each server uses LACP to bond eth0 to Nexus-1 port 1 and eth1 to Nexus-2 port 1. Both links are active, and traffic load-balances across them. If Nexus-1 fails, eth0 drops but eth1 stays active, and the server keeps running.

Summary

  • vPC is NX-OS (Nexus) only. It does not exist on Catalyst, ASA, or routers.
  • Enable feature lacp and feature vpc first.
  • Configure vpc domain ID with a role priority (lower = primary) on both peers.
  • Set up peer-keepalive on a separate management network (out-of-band is best).
  • Create a redundant peer-link (usually port-channel 1) and mark it with vpc peer-link.
  • Add vpc ID to downstream port-channels so peers present as one virtual device.
  • Verify with show vpc, show vpc brief, and show vpc consistency-parameters global.
  • Downstream devices use standard LACP; they don't need to know about vPC.