FCoE VLAN 200 Not Enabled on Nexus 5672UP/FEX Path
A Nexus 5672UP pair runs FCoE for a blade chassis. VLAN 100 is mapped to VSAN 100 and works. A new CNA group is added on VLAN 200/VSAN 200. The VLAN is created and active on both switches, and the server-facing FEX ports are configured as trunk ports. The vPC peer link carries VLANs 10, 20, and 100, but not 200. The FEX fabric uplinks also do not allow VLAN 200. The new servers send FIP VLAN discovery but receive no FCF response; existing VLAN 100 servers are unaffected. show fcoe lists only VLAN 100. The CNAs are set for fabric-provided MAC addresses, and the MDS-facing NPIV ports are not part of this path. The team wants to keep FCoE traffic isolated from LAN VLANs and avoid spanning tree on the FCoE VLAN. The change window is 30 minutes.
1. Identify the missing configuration and explain the FIP/FLOGI symptom.
Read the worked answer
Creating VLAN 200 in the VLAN database does not make it an FCoE VLAN. The VLAN must be enabled for FCoE and mapped to VSAN 200, and it must be allowed on every Layer 2 path between the CNA and the FCF: the FEX host port, the FEX fabric uplink, and the vPC peer link.
Because VLAN 200 is not in the allowed list on the FEX uplinks or peer link, the FIP VLAN discovery request cannot reach the FCF in that VLAN. The CNA therefore gets no FCF response and never proceeds to FIP FLOGI/FDISC. show fcoe not listing VLAN 200 is consistent with the VLAN not being enabled as an FCoE VLAN, not merely with a server problem. VLAN 100 works because it is enabled, mapped, and allowed end to end.
Check show vlan brief, show interface trunk, show fcoe, show vlan fcoe, and the running configuration for the FEX uplinks and peer link before changing the CNA or FEX.
2. Provide the corrective steps and the verification commands you would use.
Read the worked answer
On both Nexus switches, ensure the FCoE feature is enabled, then enable VLAN 200 for FCoE and map it to VSAN 200. Add VLAN 200 to the allowed trunk list on the FEX fabric uplinks and on the vPC peer link. On the FEX host ports, add VLAN 200 to the allowed list as well. Keep the FCoE VLAN dedicated; do not put an IP interface on it or use it for ordinary LAN traffic.
Conceptually:
feature fcoevlan 200thenfcoe vsan 200- Add VLAN 200 to the trunk allowed lists on the FEX uplinks, peer link, and host-facing ports
- Confirm the VSAN 200 interface and any required virtual Fibre Channel interface binding
Verify with show fcoe, show vlan fcoe, show interface trunk, show interface vfc, show flogi database vsan 200, and FIP snooping/FCF information. Then confirm that a new CNA completes FIP VLAN discovery, FLOGI, and fabric login and appears in the name server for VSAN 200. Do not claim success from a link-up state alone.
3. Why should VLAN 200 not be routed or shared with LAN traffic, and how do you validate isolation and lossless behavior?
Read the worked answer
FCoE is a Layer 2 storage protocol and depends on a dedicated VLAN with controlled flooding, consistent MTU, and lossless Ethernet behavior. Routing the FCoE VLAN or sharing it with LAN hosts adds STP topology changes, broadcast/multicast traffic, and unrelated congestion that can break FIP or cause FCoE frame loss. Keeping it dedicated also makes VLAN-to-VSAN mapping unambiguous.
Validate isolation by checking that VLAN 200 has no SVI or routed participation, that only intended FCoE ports carry it, and that show vlan fcoe maps it only to VSAN 200. Validate lossless behavior with priority-flow-control and DCBX status on the CNA-facing and uplink interfaces, and confirm that the same VLAN is consistently allowed and untagged/tagged as designed across the vPC and FEX path. Finally, verify name-server and zone membership for the new pWWNs and confirm that VLAN 100 traffic is still unaffected.