Neat Cisco Nexus Features You Might Have Missed

Peter Welcher
Architect, Operations Technical Advisor

Since Cisco produces a lot of nifty new features, the title might suggest this is going to be a LONG blog. Far from it! As I write, it’s Summer, and I suspect most readers have better things to do than read long blogs. Brevity for the win!

My goal here is to briefly cover one nifty feature that most people I’ve talked to are not aware of, and another that I’d somehow missed hearing about. I’ll let you guess which one of the following is which.


Intelligent Traffic Director (ITD) provides multi-terabit L4 load balancing and traffic steering via Nexus switches. Clustering and symmetric flows are supported. VPC is also supported. ITD reportedly has much less TCAM use than WCCP.

ITD is not a L7 SLB with URL rewrite rules, cookie visibility, SSL offload, etc. However, I’ve seen most sites using their NetScaler, F5, or A10 SLB in only basic VIP ways, so that may fit your needs, or not. In addition, if you need terabit SLB behavior, streamlining how your webpages are accessed to leverage existing Nexus switches might be extremely attractive compared to a pile of top end F5’s or other SLB’s. Not taking a position here, just trying to explain how and where ITD might or might not be useful.

ITD is supported on the Nexus 5000, 6000, 7000 series, and 9000 (broadly speaking), with the right code and license level (see the At A Glance link below for details and double-check pre-requisites and device support for the specific Nexus model you have in mind).

Apparently ITD auto-configures PBR to enforce symmetry of flows (where relevant), presumably with failure triggering re-allocation (hopefully just failed flows, but I’m not seeing that detail in the documentation).

Summary of Modes of Use:

  • Direct Server Return (DSR) mode: the SLB (ITD) forwards to server (usually at L2 by MAC, ITD is configured with IP of interface), VIP is configured on loopback on servers in pool
  • Flow Symmetry preserving One-Arm mode
  • Flow Symmetry preserving Nexus / ITD “sandwich” mode


Dynamic FCoE

J. Metz explained this capability quite well back in 2014 (love the diagrams!), so I’ll refer you to his blog for details and the diagrams.

The basic idea is automatic FCoE over a FabricPath fabric, unifying the LAN and SAN infrastructures. No extra licensing costs.

The cool part is that the automation kicks in when FCoE is configured on the leaf switch. The word “dynamic” refers to:

  • NX-OS automatically creates a full mesh of virtual links between leaf switches
  • NX-OS automatically creates the virtual Fibre Channel (vFC) ports
  • NX-OS automatically creates the VE_Port type and the ISL

I should probably note, this is “new” technology (as of 3-4 years ago) and might really disturb your SAN group if you propose using it. In that case, be prepared for words like “unproven”, “risky”, etc. Don’t most SAN people generally think Networking people are wild and crazy risk takers?

My only question: When can we have this for VXLAN? Yeah, ok, the Nexus 9K’s need full FCF functionality too, and that probably comes first.



I haven’t used ITD in the field yet, nor Dynamic FCoE, so if you have, and have something you’d care to pass along (good, bad, ugly), please do so via a Comment!

Comments are welcome, both in agreement or constructive disagreement about the above. I enjoy hearing from readers and carrying on deeper discussion via comments. Thanks in advance!


Hashtags: #CiscoChampion #CiscoNexus

Twitter: @pjwelcher

Disclosure Statement
Cisco Certified 20 Years

NetCraftsmen Services

Did you know that NetCraftsmen does network /datacenter / security / collaboration design / design review? Or that we have deep UC&C experts on staff, including @ucguerilla? For more information, contact us at

Leave a Reply


Nick Kelly

Cybersecurity Engineer, Cisco

Nick has over 20 years of experience in Security Operations and Security Sales. He is an avid student of cybersecurity and regularly engages with the Infosec community at events like BSides, RVASec, Derbycon and more. The son of an FBI forensics director, Nick holds a B.S. in Criminal Justice and is one of Cisco’s Fire Jumper Elite members. When he’s not working, he writes cyberpunk and punches aliens on his Playstation.


Virgilio “BONG” dela Cruz Jr.

CCDP, CCNA V, CCNP, Cisco IPS Express Security for AM/EE
Field Solutions Architect, Tech Data

Virgilio “Bong” has sixteen years of professional experience in IT industry from academe, technical and customer support, pre-sales, post sales, project management, training and enablement. He has worked in Cisco Technical Assistance Center (TAC) as a member of the WAN and LAN Switching team. Bong now works for Tech Data as the Field Solutions Architect with a focus on Cisco Security and holds a few Cisco certifications including Fire Jumper Elite.


John Cavanaugh

CCIE #1066, CCDE #20070002, CCAr
Chief Technology Officer, Practice Lead Security Services, NetCraftsmen

John is our CTO and the practice lead for a talented team of consultants focused on designing and delivering scalable and secure infrastructure solutions to customers across multiple industry verticals and technologies. Previously he has held several positions including Executive Director/Chief Architect for Global Network Services at JPMorgan Chase. In that capacity, he led a team managing network architecture and services.  Prior to his role at JPMorgan Chase, John was a Distinguished Engineer at Cisco working across a number of verticals including Higher Education, Finance, Retail, Government, and Health Care.

He is an expert in working with groups to identify business needs, and align technology strategies to enable business strategies, building in agility and scalability to allow for future changes. John is experienced in the architecture and design of highly available, secure, network infrastructure and data centers, and has worked on projects worldwide. He has worked in both the business and regulatory environments for the design and deployment of complex IT infrastructures.