As I become more familiar with NX-OS, I frequently find features that are meant to make life easier for us network Admins and Engineers. I’ve been informed that the days of CLI jockey’s are rapidly coming to an end, and rightly so, but even with my best DevOps attempts I still find myself having to manually edit configs frequently. One of my least favorite tasks is adding a new Vlan to our ESX cluster — there are just so many interfaces to touch. There must be a better way! Turns out, there is at least one better way (of many, I’m sure) — port profiles.
Port Profile Overview
Port profiles are interface configuration templates that can be assigned to ports that have the same configuration requirements. If you’ve ever found yourself copying and pasting interface configurations on a box, then port-profiles can help you.
The limit to the number of ports that can inherit a profile is platform dependent — my Nexus 7700’s show a limit of 16384, while my Nexus 9300’s show 512.
Creating a port profile
Let’s walk through a really simple example of a port-profile
First, we create the profile, and in so doing, define the type of interface to which the profile will be applied
NX9K(config)# port-profile type ? ethernet Ethernet type interface-vlan Interface-Vlan type port-channel Port-channel type
For this example we’ll create a ethernet type. Please also note that on the Nexus 7K’s we can also use types of loopback and tunnel.
Next we define the commands that will be applied to every interface
NX9K(config)# port-profile type ethernet MY-TEST-PROFILE NX9K(config-port-prof)# switchport NX9K(config-port-prof)# switchport mode trunk NX9K(config-port-prof)# switchport trunk allowed vlan 10,20,30,40,50,100 NX9K(config-port-prof)# spanning-tree port type edge trunk NX9K(config-port-prof)# no shutdown
Lastly we change the state of the profile to enabled.
NX9K(config-port-prof)# state enabled
That’s all you need to do to create a profile. We can review the configuration on our profile by using the show port-profile command:
NX9K# show port-profile SHOW PORT_PROFILE port-profile MY-TEST-PROFILE type: Ethernet description: status: enabled max-ports: 512 inherit: config attributes: switchport switchport mode trunk switchport trunk allowed vlan 10,20,30,40,50,100 spanning-tree port type edge trunk no shutdown evaluated config attributes: switchport switchport mode trunk switchport trunk allowed vlan 10,20,30,40,50,100 spanning-tree port type edge trunk no shutdown assigned interfaces:
This output gives us nearly all the info we need — the type of profile we created, the commands that it contains, commands that are actually being applied (evaluated), and any interfaces that are assigned to use this profile. At this point we haven’t assigned an interface so let’s do that now.
Assigning profiles to interfaces
To assign our newly created profile, we use the inherit port-profile interface sub-command
interface eth101/1/1 inherit port-profile MY-TEST-PROFILE
And that’s it! Very easy stuff here.
Now the best part comes days or months later when you need to modify the ports. You simply add the new command(s) to the profile, and all assigned interfaces automatically get the updated config.
Viewing interface and port profile configurations
The only thing to remember down the road is that now your interfaces won’t show the actual configuration. So your standard show interface only shows the inherit command:
interface Ethernet101/1/16 inherit port-profile MY-TEST-PROFILE
There are two ways you can see the commands as applied to each interface. First, you can display the full interface config using the command show port-profile expand-interface name PROFILE_NAME
NX9K# sh port-profile expand-interface name MY-TEST-PROFILE port-profile MY-TEST-PROFILE Ethernet101/1/16 switchport mode trunk switchport trunk allowed vlan 10,20,30,40,50,100 spanning-tree port type edge no shutdown
Or, you can use the command show run interface INTERFACE expand-port-profile
NX9K# sh run int eth101/1/16 expand-port-profile interface Ethernet101/1/16 switchport mode trunk switchport trunk allowed vlan 10,20,30,40,50,100 spanning-tree port type edge no shutdown
The difference here is that the show port-profile expand-interface command will show you all interfaces with that profile assigned, where the show run interface is only displaying the single interface.
Another great feature of port-profiles is that they are inheritable. This allows you to modularize your configurations and reference them by profile name within other profiles. I came across a good example of this in a presentation from Cisco about using profile inheritance on the Nexus 1000V. In their example, they were applying the same switchport mode and vlan access settings but wanted to apply varying QoS policies. So in their example they had the following profiles:
port-profile WEB switchport mode access switchport access vlan 100 no shut port-profile WEB-GOLD inherit port-profile WEB service-policy output GOLD port-profile WEB-SILVER inherit port-profile WEB service-policy ouput SILVER interface Eth1/1 inherit port-profile WEB-GOLD interface Eth1/2 inherit port-profile WEB-SILVER
The end result is that all assigned interfaces are configured as access ports in vlan 100, but the QoS policy differed. Only 4 levels of inheritance are supported, so don’t go too crazy here.
Things to remember
As you begin to work with profiles, there are some important things to remember as it relates to order of precedence in the commands that will take effect on the interface. Taken straight from the documentation:
The system applies the commands inherited by the interface or range of interfaces according to the following guidelines:
Commands that you enter under the interface mode take precedence over the port profile’s commands if there is a conflict. However, the port profile retains that command in the port profile.
The port profile’s commands take precedence over the default commands on the interface, unless the port-profile command is explicitly overridden by the default command.
When a range of interfaces inherits a second port profile, the commands of the initial port profile override the commands of the second port profile if there is a conflict.
After you inherit a port profile onto an interface or range of interfaces, you can override individual configuration values by entering the new value at the interface configuration level. If you remove the individual configuration values at the interface configuration level, the interface uses the values in the port profile again.
There are no default configurations associated with a port profile.
One other important detail from the documentation states that checkpoints are created anytime you enable, modify, or inherit a profile, this way the system can roll back to a good configuration in case of any errors. A profile will never be partially applied — if there are errors, the config is backed out.
So go out and make your life easier — try out port profiles today!