Cisco NCS MLAG with Active / Active Uplinks

[Aden24]

Hello,

We are currently running two Synergy Frames as a logical enclosure, with VC SE 100GB F32's uplinked to an MLAG pair of NCS 5500. We are experiencing a couple of challenges related to firmware and virtual firewalls running on VMware.

The primary issues are as follows:

1. Virtual Firewalls: We are encountering Proxy-ARP issues, which require us to use "port-active" mode to force all incoming and outgoing traffic through one port on the MLAG switches.

2. Firmware Upgrades on Synergy: During firmware upgrades, when the interconnects undergo their round of reboots, we briefly lose connectivity to the Ethernet and VMware hypervisor layer management. This is believed to be due to the active/passive state of the uplinks to the MLAG, with only one port in use.

I would love to hear from anyone who has encountered similar issues and found a resolution.

[michael298]

Hello,

For the Proxy-ARP issue, consider consulting the firewall documentation for alternative configurations that may resolve the need for “port-active” mode. For the firmware upgrade connectivity loss, review the MLAG and Synergy configuration to ensure redundancy and failover are correctly set up to handle reboots without losing connectivity.

Best Regards

[support_s]

Hello,

Let us know if you were able to resolve the issue.

If you have no further query, and you are satisfied with the answer then kindly mark the topic as Solved so that it is helpful for all community members.

Please click on "Thumbs Up/Kudo" icon to give a "Kudo".

Thank you for being a HPE valuable community member.

[Aden24]

Hi,

Unfortunately, no, we have not resolved it yet. We have reviewed the firewall best practices and don’t seem to have any concerns there. We have this setup with a traditional stacked switch and don't currently experience the same issue.

Thanks

[Suvamay]

Hello 
Please check the DVswitch configuration in the OS. You should use two uplink.

LACP on the uplinks is fine, but that does not help, when the OS is in A/B side config, as each server uplink has a physical path to one specific VC module.
Thanks

[Suvamay]

Let me know if you have any further query