COMMANDS: A Primer on Some of the Differences Between IOS and NX-OS

NX-OS is starting to be my favorite OS from Cisco.  However, dealing with IOS for so long I find myself typing the wrong commands in NX-OS and IOS.  So I thought of posting up the NX-OS v4.x commands with the IOS counterpart commands for all to see.

NX-OS Smart Call-Home	IOS Smart Call-Home	Command Description
show callhome	show call-home	Displays global Call-Home configuration
show callhome destination-profile	show call-home profile	Displays Call-Home profiles
show callhome transport-email	show call-home mail-server	Displays destination Call-Home mail server
show callhome user-def-cmds	N/A	Displays user defined "show" commands for output
NX-OS Cisco Discovery Protocol (CDP)	IOS Cisco Discovery Protocol (CDP)	Command Description
show cdp all	N/A	Displays all interfaces with CDP enabled
show cdp entry all	show cdp entry *	Displays the CDP database entries
show cdp global	show cdp	Displays Global Parameters (Enabled, Timers, etc…)
show cdp interface	show cdp interface	Displays interface specific information
show cdp neighbors	show cdp neighbors	Displays a summer list of neighbors
show cdp neighbors detail	show cdp neighbors detail	Displays detailed information per neighbor
show cdp neighbors interface	show cdp neighbors interface-type	Displays CDP neighbor for a specified interface
show cdp traffic interface	N/A - "show cdp traffic" is only global	Provides statistics on a per interface basis
NX-OS Command Scheduler	IOS Command Scheduler	Command Description
show scheduler config	N/A	Displays the scheduler configuration
show scheduler job	N/A	Displays the Jobs configured in the scheduler
show scheduler logfile	N/A	Displays the contents of the execution log file
show scheduler name	N/A	Displays the schedules configured
NX-OS Embedded Event Manager (EEM)	IOS Embedded Event Manager (EEM)	Command Description
show event manager environment	show event manager environment	Displays EEM environment variables
show event manager event-type	N/A	Displays registered event types
show event manager history	show event manager history	Displays information on history and past events
show event manager policy	N/A	Displays applets or script policies
show event manager policy-state	N/A	Displays the state of a policy
show event manager script	N/A	Displays information about a script
show event manager system-policy	show event manager policy	Displays information on system default entries
NX-OS Generic Online Diagnostics (GOLD)	IOS Generic Online Diagnostics (GOLD)	Command Description
show diagnostics bootup level	show diagnostics bootup level	Displays current bootup level
show diagnostics content module	show diagnostics content module	Displays test contents for a specified module
show diagnostics description module	show diagnostics description module	Displays description for a specified diagnostic test
show diagnostic results module	show diagnostic results module	Displays information and result of a diagnostic
show diagnostic status module	show diagnostic status	Displays test status for all tests on a module
NX-OS Netflow	IOS Netflow	Command Description
show flow exporter	show mls nde	Displays information about configured exporter maps
show flow interface	N/A	Displays interfaces configured for Netflow
show flow monitor	N/A	Displays information about monitor maps
show flow record	N/A	Displays information about record maps
show flow timeout	N/A	Displays the Netflow timeout value
show hardware flow aging	show mls netflow aging	Displays the Netflow table aging timeout value
show hardware flow entry	show mls netflow ip flow	Displays flow specific information
show hardware flow ip	show mls netflow ip	Displays the IP Netflow Table
show hardware flow sampler	show mls sampling	Displays the Netflow Sampling Configuration
show hardware flow utilization module	show mls netflow table summary	Displays Netflow table utilization per module
show sampler	show flow-sampler	Displays information about sampler maps
NX-OS Onboard Fault Logging (OBFL)	IOS Onboard Fault Logging (OBFL)	Command Description
show logging onboard module # boot-uptime	show logging onboard module # uptime	Displays OBFL boot and uptime information per module
show logging onboard module # counter-stats	N/A	Displays OBFL counter statistics per module
show logging onboard module # device-version	N/A	Displays OBFL device version information per module
show logging onboard module # endtime	show logging onboard module # end	Displays OBFL logs till end time mm/dd/yy-HH:MM:SS per module
show logging onboard module # environmental-history	show logging onboard module # temperature	Displays OBFL environmental history per module
show logging onboard module # error-stats	N/A	Displays OBFL error statistics per module
show logging onboard module # exception-log	N/A	Displays OBFL exception log per module
show logging onboard module # interrupt-stats	show logging onboard module # interrupt	Displays OBFL interrupt statistics per module
show logging onboard module # kernel-trace	N/A	Displays OBFL Kernel Trace per module
show logging onboard module # module	N/A	Displays OBFL information for Module per module
show logging onboard module # obfl-history	N/A	Displays OBFL history information per module
show logging onboard module # stack-trace	N/A	Displays OBFL kernel stack trace per module
show logging onboard module # starttime	show logging onboard module # start	Displays OBFL logs from start time mm/dd/yy-HH:MM:SS per module
show logging onboard module # status	show logging onboard module # status	Displays OBFL status enable/disable per module
NX-OS RMON	IOS RMON	Command Description
show rmon alarms	show rmon alarms	Displays configured RMON alarms
show rmon events	show rmon events	Displays configured RMON Events
show rmon hcalarms	N/A	Displays information for 64 bit alarms
show rmon logs	show rmon history	Displays RMON log messages
NX-OS SNMP	IOS SNMP	Command Description
show snmp	show snmp	Displays SNMP Counters, Users, Community Strings, etc...
show snmp community	show snmp community	Displays the SNMP community strings
show snmp context	show snmp context	Displays the SNMP Context mapping
show snmp engineID	show snmp engineID	Displays Hex and Decimal SNMP Engine ID
show snmp group	show snmp group	Displays configured SNMP groups/roles
show snmp host	show snmp host	Displays Host specific information
show snmp sessions	show snmp sessions	Displays active SNMP sessions
show snmp trap	N/A	Displays what traps are enabled
show snmp user	show snmp user	Displays SNMP users and notification targets (v3)
NX-OS Switch Port Analyzer (SPAN)	IOS Switch Port Analyzer (SPAN)	Command Description
show monitor session #	show monitor session #	Displays a specific sSPAN session
show monitor session all	show monitor session all	Displays all SPAN sessions
show monitor range #-#	show monitor range #-#	Displays a range of specified SPAN sessions
NX-OS Logging (Syslog)	IOS Logging (Syslog)	Command Description
show logging	show logging	Displays how logging is configured with log
show logging info	N/A	Displays how logging is configured without log
show logging last #	N/A	Displays the last "#" of log messages
show logging level	N/A	Displays the Facility, Default Severity, and Configured Severity
show logging logfile	N/A	Displays all of the Syslog information
show logging module	N/A	Displays the module logging configuration
show logging monitor	N/A	Displays the monitor logging configuration
show logging nvram	N/A	Displays the Severity 0, 1, and 2 message stored in NVRAM
show logging server	N/A	Displays information for each configured syslog server
show logging timestamp	N/A	Displays the configured timestamp for log messages
NX-OS NTP	IOS NTP	Command Description
show ntp peers	show ntp associations	Displays what NTP peers are configured
show ntp peer-status	show ntp status (not on a peer basis)	Shows the status of each NTP peer
show ntp source	N/A	Displays the source IP address for the NTP service
show ntp statistics peer ipaddr x.x.x.x	N/A	Show statistics for each NTP peer
show ntp timestamp-status	N/A	Displays if the timestamp check is enabled
NX-OS XML	IOS XML	Command Description
show xml server logging	N/A	Displays XML Logging
show xml server status	N/A	Displays XML Server Status

You can also find the same kind of material on the following link
http://docwiki.cisco.com/wiki/Cisco_Nexus_7000_NX-OS/IOS_Comparison_Tech_Notes

Cisco NX VLAN to VLAN F5 Bypass

If you recall in my previous blog "Cisco IOS VLAN to VLAN F5 Bypass"  we dealt with a specific scenario between F5 and Cisco IOS.   In this new scenerio we are now dealing with Cisco NX operating system.

 

“I have a pair of F5 ADC in an Internet DMZ, where nodes behind the load balancer need to access NAS system(s) on a VLAN located on a separate VLAN that is not behind the load balancer. The problem is that in my current design I have to route through the F5 Load balancer to access the NAS system(s).  Unfortunately the amount of bandwidth it takes supersedes the F5 ADC’s total throughput.  I would like to bypass this without adding extra network cards or recreating a new VLAN and would like preserve the IP addresses as much as possible.  Also the F5 ADC is sitting on a network design that participates in vPC within Cisco Nexus Data center gear"

Based on this description above you extrapolate a high-level logical network design as shown in Figure 1 ( I have removed vPC design for now as you read on you will see it introduced into the article

Figure 1

 

In the figure 1, we VIP VLAN which is a routable VLAN. Node VLAN is a non-routable VLAN, which is strictly Layer 2.  Since the VLAN is non-routable no external devices except the F5 can access the Nodes directly.  Finally we have Server VLAN Z which is where the NAS system is connected to.  In order to have communication between Server VLAN Z and Node VLAN, the traffic must route through the F5 via VIP VLAN. This is done by a static route pointing to .11 on VIP VLAN which is the F5 floating address on VIP VLAN to reach node VLAN address block. In figure 1 you also have all servers in Node VLAN pointing to .1 as their default gateway which is the floating address of the F5. The F5’s default gateway is .1 on VIP VLAN. Now that we have described the current behavior of Figure 1, we can start looking at making some changes.
So how do we change the network to accommodate the result that is being looked for? It is actually much easier then you might think.
The first item you want to remove is the static route on the switch pointing to point to .11 on VIP VLAN to access NODE VLAN. You will not need this since the end result is to allow SERVER VLAN and NODE VLAN to communicate directly via the Cisco Nexus Switch router.


Next you will need to change NODE VLAN from a non-routable network to a routable network. Thus, NODE VLAN will have a gateway of .1 on the switch router. The F5 will then change its own floating address to say .11 and subsequently change the self-addresses to .12 and .13.  All the servers in NODE VLAN will continue to use .1  as the default gateway.

Figure 2

 

At this point, you are thinking how is the traffic going to return to F5 load balancer when it’s traffic via VIP. The easy way is to apply SNAT Automap. Which works, but then you run into another problem where you lose the client IP address. Normally this might be work, but will make tracking clients more difficult especially around traffic that is not HTTP based.
The short answer to this is utilizing a Cisco’s Policy Based Route. How does that work?
On a Cisco switch router, you can do the following configuration (NX OS Syntax)

ip access-list from_node_vlan_deny

 10 permit ip y.y.y.0/24 z.z.z.0/24

ip access-list from_node_vlan_allow

 10 permit ip y.y.y.0/24 any

route map to_node_vlan deny 10

  match ip address from_node_vlan_deny

route map to_node_vlan permit 10

 match ip address from_node_vlan_allow

 set ip next-hop y.y.y.11

interface VIP_VLAN

 ip policy route-map to_node_vlan

NOTE: You must have feature pbr enabled.

If you are a student of Cisco IOS you might notice that IP access-list does not contain deny statements.  This is because PBR statements in the Nexus OS was designed to ignore the deny statements within IP access-lists.  I haven’t received an official reason of why this happened, but the best case was that they wanted  to make the ultimate PERMIT/DENY decision at the route map level.   The good news is that this new behavior only exists when applied to the pBR. Meaning Deny statements within an IP access-list will not be ignored when applying as a standard ACL for security access.   Also you can use the same access-list for security access and route-maps so just keep in mind that that DENY statements will be ignored by the route-maps ONLY.
Looking at the configuration above, the behavior is that if the NODE VLAN traffic is destined to the SERVER VLAN, skip the route-map statement and use the internal routing table of the switch. This allows NODE VLAN to communicate directly to SERVER VLAN and vice versa. Subsequently, if traffic from NODE VLAN is attempting to reach to the internet then it will match the IP access-list “from_node_vlan_allow” within route map “to_node_vlan permit 10”.  Once that is done it will process the next command, which is sending the traffic to the next hop of y.y.y.11 (Floating address of the F5) within NODE VLAN.

If we left everything alone, this story would be complete.   Unfortunately, the network example I used is also using vPC, which adds another layer of complexity, which needs to be accounted for in our Cisco configuration.   Figure 3 shows us what a vPC topology would look like with an F5 attached.

Figure 3

 

You see F5 along with other vendors decided to optimize the packets by ignoring the arp reply given by the HSRP primary and instead forwards Ethernet frames to whichever MAC address it receives frames from the result is a faster response time.   Unfortunately, this is a nonstandard behavior.   If you are well versed enough on the F5 you would immediately think to turn off the auto Last hop feature would counteract this behavior.  Unfortunately, this does not work in Cisco Nexus OS world.  Cisco recognized that many vendors had this same issue so they introduced the command “peer-gateway” command. This command in affect disabled the optimization.


Therefore, you would introduce the command in the following configuration example, in our diagram it would be on Nexus 7010 MDF A and MDF B

vpc domain 1

  role priority 10

  peer-keepalive destination 10.1.1.2 source 10.1.1.1 vrf VPC-KeepAlive

  peer-gateway

Of course, this is still not end of the story because peer-gateway has a caveat as stated in the Nexus OS Layer 2 guide

Packets arriving at the peer-gateway vPC device will have their TTL decremented, so packets carrying TTL = 1 may be dropped in transit due to TTL expire. This needs to be taken into account when the peer-gateway feature is enabled and particular network protocols sourcing packets with TTL = 1 operate on a vPC VLAN.

This means that the traffic will be treated like a layer 3 hop which means we need to make small adjustment in our access list

From

ip access-list from_node_vlan_deny

 10 permit ip y.y.y.0/24 z.z.z.0/24

ip access-list from_node_vlan_allow

 10 permit ip y.y.y.0/24 any

route map to_node_vlan deny 10

  match ip address from_node_vlan_deny

route map to_node_vlan permit 10

 match ip address from_node_vlan_allow

 set ip next-hop y.y.y.11

interface VIP_VLAN

 ip policy route-map to_node_vlan

to

ip access-list from_node_vlan_deny

5 permit ip y.y.y.0/24 y.y.y.0/24

10 permit ip y.y.y.0/24 z.z.z.0/24

ip access-list from_node_vlan_allow

 10 permit ip y.y.y.0/24 any

route map to_node_vlan deny 10

  match ip address from_node_vlan_deny

route map to_node_vlan permit 10

 match ip address from_node_vlan_allow

 set ip next-hop y.y.y.11

interface VIP_VLAN

 ip policy route-map to_node_vlan

If you have been following closely on the difference you might be wondering, why should you have a permit for traffic between NODE VLAN to NODE VLAN?  After all the access-list looks at Layer 3, not Layer 2 traffic.   As I mentioned above “Packets arriving at the peer-gateway vPC device will have their TTL decremented…”  Which means that Layer 2 traffic under vPC Peer Gateway will treat any traffic within that VLAN as a layer 3 hop and it will be processed within the access-list.


Conclusion
If you are running a F5 ADC which routes through F5 Nexus devices, then you don’t need peer-gateway , but you will if you are directly attached to a Nexus Device that is configured to use vPC.


I have yet to face any issues with this configuration so it might be a good idea to add Peer-gateway into your vPC configuration as a default.