Cisco NX-OS vPC Configuration

Cisco NX-OSAdvanced

Virtual Port-Channel (vPC) domain configuration for Cisco Nexus switches: peer-link, keepalive, peer-gateway, and vPC member port-channels.

↓ example.txt

What is it?

vPC (Virtual Port-Channel) is a Cisco Nexus feature that allows a server or downstream switch to connect to TWO physical Nexus switches via a single LACP port-channel. From the server's perspective, it sees one logical switch. Both Nexus switches synchronize their MAC tables, ARP tables, and spanning tree state via the peer-link. The peer-keepalive link (usually the management network) provides a heartbeat to detect if the peer switch has failed completely. vPC eliminates the need for STP-blocking on uplinks while providing true Active-Active redundancy.

✓ When to use

·Dual-homed servers that need Active-Active redundancy — both links carry traffic simultaneously
·Downstream switches connected to two core/aggregation Nexus switches
·Any leaf pair in a data center access layer where servers need redundancy without STP
·Storage arrays (Cisco UCS, NetApp, EMC) that support LACP multi-pathing

✗ When NOT to use

·vPC spans only two Nexus switches — it cannot stretch across three or more switches. Use VXLAN EVPN VTEP for fabric-wide redundancy.
·Do NOT use vPC for the spine layer in VXLAN EVPN — spine switches should be independent. vPC is for leaf pairs only.
·vPC has software complexity — for small deployments, a simple active/passive LACP with STP may be simpler to manage

How it compares

vs Standard LACP port-channelStandard port-channel connects to ONE switch. If that switch reboots or fails, ALL connected devices lose connectivity. vPC connects to TWO switches — one can fail and traffic continues uninterrupted.

vs MLAG (Arista/Juniper)MLAG is the equivalent on Arista/Juniper switches. Same concept: dual-home servers across two switches. Arista uses MLAG, Juniper uses LAG/Aggregated Ethernet. Not interoperable — vPC is Cisco-proprietary.

vs VXLAN EVPN Active-ActiveVXLAN EVPN with ESI (Ethernet Segment Identifier) achieves similar active-active redundancy at fabric scale across more than 2 VTEPs. vPC is simpler to configure but limited to two switches.

Prerequisites

→'feature vpc' and 'feature lacp' must be enabled
→Both vPC peers need dedicated peer-keepalive connectivity — use the management VRF (mgmt0 interfaces connected via dedicated link)
→Peer-link should use the fastest available interfaces (40G/100G) and at least 2 physical members
→vPC domain ID must match on both peers — and be unique per vPC pair in the network
→Consistent VLAN configuration on both peers — vPC won't form if VLANs differ

Config Generator

Hostname *

vPC Domain ID *

vPC Priority (lower=primary)

Peer Keepalive Dest IP *

Local Keepalive Source IP *

Keepalive VRF

Peer-Link Port-Channel ID *

Peer-Link Member Interfaces

Allowed VLANs on peer-link

Enable peer-gateway?

Enable auto-recovery?

vPC Member Port-Channels

Verification commands

show vpc

Show vPC domain status, peer-keepalive state, and peer-link status

Expected: vPC domain status: peer adjacency formed. Peer-keepalive status: peer is alive. Peer-link: port-channel with vPC peer-link role.

show vpc consistency-parameters global

Show global parameters that must match between vPC peers

Expected: All parameters should show 'Success'. Any 'Failed' indicates a configuration mismatch that will prevent vPC from forming.

show vpc brief

Show all vPC port-channels and their status

Expected: All vPC port-channels should show 'up' on both peers

show port-channel summary

Verify peer-link port-channel and member interfaces are bundled

Expected: Peer-link port-channel shows 'SU' and all members show 'P' (bundled)

Debug commands

show vpc peer-keepalive

Show peer-keepalive status — critical for detecting split-brain

Common mistakes & fixes

⚡ vPC peer adjacency not forming

Cause: Peer-link not carrying all VLANs, or peer-keepalive not reachable

Fix: Verify peer-link allows all VLANs: 'switchport trunk allowed vlan 1-4094'. Test keepalive: 'ping <peer-keepalive-ip> vrf management'. Check 'feature vpc' is enabled on both.

⚡ vPC consistency check failing

Cause: Configuration mismatch between the two peers (STP mode, VLAN list, MTU, or port-channel config)

Fix: Run 'show vpc consistency-parameters global' to identify the mismatch. Fix the config on the affected peer. Mismatches suspend the vPC port-channel.

⚡ Split-brain: both switches become primary after reboot

Cause: Peer-keepalive was unreachable when primary came back up

Fix: Verify peer-keepalive path is always available (use dedicated link or out-of-band management). The secondary will suspend its vPC ports if it cannot reach the primary via keepalive.

⚡ Traffic not load-balancing across both vPC uplinks

Cause: LACP hash not distributing traffic evenly, or only one link is active

Fix: Verify both links are bundled: 'show port-channel summary'. Adjust LACP hash: 'port-channel load-balance src-dst-ip' for server traffic.