Fabric Attach: (VSP8600 -> x440G2 -> client vs VSP8600 -> x620 -> x440G2 -> client)

[BRMS]

i have some issues using the fabric attach feature of the vsp and exos devices, if there are more then 2 switches involved in a connection to the core:

we are migrating our core-switches to vsp 8600 at the moment. therefore we created a spbm cluster with 4 vsp8600.

the edge switches consist of x440g2, which in most instances will be attached directly to the vsp and use the fabric attach feature.

via nac we want to assign vlans with nsi/isid to the client ports which should be propagated to the core.

if the x440G2 is connected directly to the vsp everything works as described.

the fa feature doesn't work if the x620 sits inbetween the edge and core switch:
client -> x440G2 -> x620 -> vsp8600

can you give me some hint if:

• i'm doing it wrong?! I'm not sure if the standalone proxy mode could help accomplish the above
• this should work but i have a configuration problem on one of the involved devices
• the above configuration isn't supported at all?

For configuration: i enabled fa on the gigabitethernet interfaces of the VSPs connected to the x440g2 and x620 switches and defined an nsi/isid on the exos devices. if the x620 is involved the fa assignment on the x440g2 never gets active, it just stays in status pending.

[GustavoD]

Hi BRMS

I am going to carry out a similar implementation, you could tell me in which part of the NAC I tell you to provide the VLAN and the I-SID, or the steps to follow with this implementation

[BRMS]

followup-question:

after configuring NAC to assign VLAN and ISID for a device that is connected to the edge-switch (x440-g2) we encountered, that despite the above information, dynamic-vlan-tagging on the chained exos switches does indeed work.

so when i connect a phone to the edge-switch (x440-g2) it gets a vlan and isid assigned and the uplink-port from the edge-switch to the x620 gets tagged. on the x620 the dynamic vlan also gets created and tagged on the uplink ports to the edge-switch and to the vsp. i don’t understand why this works and im not sure if i can trust these configuration.

[ØyvindN]

The x620 can't function as a FA Server, that's the reason why you can't get the FA Proxy on the x440G2 to work. You must either connect them directly to the VSP8600 or put in another VSP to replace the x620. I presume that cost and wiring is driving the use of the x620 - the other option would be to put in place a VSP7200/7400 instead.