Questions? Call 1.800.716.8955

Chapter 17

EtherChannel

Exam topics covered

2.4 Configure and verify (Layer 2/Layer 3) EtherChannel (LACP)

Foundation. When one link between two switches is not enough, the obvious answer is to add more cables. Spanning tree, however, sees parallel links as a loop and blocks all but one of them. EtherChannel solves this by bundling up to eight physical Ethernet links into one logical interface, a port channel. STP treats the bundle as a single port, so every member link forwards traffic, and if one member fails the channel simply carries on with the others. This chapter explains the negotiation protocols (LACP and PAgP), the rules every member must follow, Layer 2 and Layer 3 EtherChannel configuration, how traffic is load-balanced, and how to verify and troubleshoot a channel.

17.1 Why Bundle Links

Consider an access switch with four 1 Gbps uplinks to the same distribution switch (Figure 17- 1). Without EtherChannel, STP elects one link as the root port and blocks the other three: you paid for 4 Gbps and can use 1. If the forwarding link fails, STP must reconverge before traffic flows again. With EtherChannel, all four links form Port-channel 1 (Po1). STP runs on Po1, not on the members, so nothing is blocked, the aggregate capacity is 4 Gbps, and losing a member only reduces capacity; no STP reconvergence is needed.

Figure 17-1 Parallel links without and with EtherChannel. STP sees the bundle as one logical port, so every member forwards.

EtherChannel is also called link aggregation, a LAG or a port channel. Cisco switches support up to eight active members, all connecting the same two devices.

17.2 LACP, PAgP and Static Channels

Both ends of a channel must agree on which links are bundled. If one switch bundles and the other does not, frames could loop or be dropped. There are three ways to form a channel: LACP (Link Aggregation Control Protocol), IEEE 802.3ad, now 802.1AX. The open standard and the one named in the CCNA blueprint. Modes: active (sends LACP packets to start negotiation) and passive (responds but does not initiate). LACP can have up to 16 members configured, 8 active and 8 in hot-standby.

PAgP (Port Aggregation Protocol), Cisco proprietary. Modes: desirable (initiates) and auto (responds only).

Static, mode on : the port is bundled unconditionally, with no negotiation packets at all. Both sides must be on .

Table 17-1 EtherChannel modes

  • Mode Protocol Sends negotiation packets? Forms a channel with
  • active LACP Yes active, passive
  • passive LACP No, only replies active
  • desirable PAgP Yes desirable, auto
  • auto PAgP No, only replies desirable
  • on None No on
  • Switch B mode

Switch A mode

Figure 17-2 EtherChannel mode compatibility matrix. A channel forms only where at least one side initiates with a matching protocol, or both sides are on.

The two combinations that most often appear as wrong answers are passive + passive and auto + auto: both sides wait for the other, so no channel forms. Also, on never negotiates, so on with active or desirable does not form a channel. LACP and PAgP never interoperate. Prefer LACP active on both ends: a static on channel that is miscabled can loop, which IOS's EtherChannel misconfiguration guard catches by err-disabling the ports.

17.3 Configuration Requirements

A port can join a channel only if it is configured consistently with the other members and with the port-channel interface. If a member differs, it is not bundled (or is suspended). Table 17-2 lists what must match.

Table 17-2 Settings that must match on all member ports

Setting Notes

Speed and duplex All members the same speed, full duplex

Switchport mode All access or all trunk (Layer 2), or all routed with no switchport (Layer 3) Access VLAN Same access VLAN on access-mode members

Trunk settings Same allowed VLAN list, same native VLAN, same encapsulation STP settings Same port cost and port priority per VLAN, if changed Both ends must also agree on trunking and the native VLAN. Configure the physical ports identically before bundling them, then make later changes on the port-channel interface, which IOS copies to the members.

17.4 Configuring a Layer 2 EtherChannel

A Layer 2 EtherChannel acts as one switchport, access or trunk. Figure 17-3 shows a two-link LACP trunk between SW1 and SW2.

Both members: 1 Gbps full duplex, trunk, native VLAN 99, allowed VLANs 10,20,99 mode active mode passive

Figure 17-3 A Layer 2 EtherChannel trunk. SW1 uses LACP active and SW2 passive.

Configuration takes two steps: put the physical ports into a channel group with channel-group number mode mode (which automatically creates the interface port-channel number ), then configure the Layer 2 settings on the port-channel interface.

SW1(config)# interface range gigabitethernet1/0/1 - 2
SW1(config-if-range)# channel-group 1 mode active ! creates Port-channel1

Creating a port-channel interface Port-channel 1

SW1(config-if-range)# exit
SW1(config)# interface port-channel 1
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk native vlan 99
SW1(config-if)# switchport trunk allowed vlan 10,20,99
SW2(config)# interface range gigabitethernet1/0/1 - 2
SW2(config-if-range)# channel-group 1 mode passive
SW2(config-if-range)# exit
SW2(config)# interface port-channel 1
SW2(config-if)# switchport mode trunk
SW2(config-if)# switchport trunk native vlan 99
SW2(config-if)# switchport trunk allowed vlan 10,20,99

The channel-group number is only locally significant: SW1's Po1 could connect to SW2's Po5. Using the same number on both sides makes the network easier to document. Use channel-protocol lacp on the members if you want to lock the protocol explicitly; the mode keyword already implies it.

17.5 Configuring a Layer 3 EtherChannel

Between two multilayer switches, or between a switch and a router, you may want a routed bundle: a single Layer 3 interface with one IP address, carried over several links (Figure 17- 4). The members must be routed ports, so no switchport is applied to the physical interfaces before they join the channel group; the port channel is then created as a routed interface and gets the IP address.

Port-channel 12 (routed)

L3 L3

Dsw1 dsw2

  • Po12 10.0.12.1/30 Po12 10.0.12.2/30
  • Gi1/0/3
  • Gi1/0/4
  • Gi1/0/3
  • Gi1/0/4

Physical members: no switchport, no IP address; the IP lives on Port-channel12

Figure 17-4 A Layer 3 EtherChannel between two distribution switches. One /30 subnet covers the whole bundle.

DSW1(config)# interface range gigabitethernet1/0/3 - 4
DSW1(config-if-range)# no switchport ! members become routed ports first
DSW1(config-if-range)# channel-group 12 mode active
DSW1(config-if-range)# exit
DSW1(config)# interface port-channel 12
DSW1(config-if)# no switchport ! usually already set; harmless
DSW1(config-if)# ip address 10.0.12.1 255.255.255.252

DSW2 mirrors this with 10.0.12.2/30. The routing protocol (for example OSPF, Chapter 22) then forms one adjacency over Po12 rather than one per link, and the routing table shows a single next hop through Port-channel12. In show etherchannel summary , a Layer 3 channel carries the R flag instead of S. Never put IP addresses on the members; if you forget no switchport on them, they cannot join the routed channel.

17.6 Load Balancing

EtherChannel does not split individual frames across links, and it does not send packets round-robin, because frames of one conversation could arrive out of order. Instead, the switch computes a hash over selected header fields of each frame and uses the result to pick a member. All frames with the same field values, that is, the same flow, always use the same link (Figure 17-5).

Every frame of one flow hashes to the same member link, so frames stay in order.

Figure 17-5 Hash-based load balancing with src-dst-ip. Each flow is pinned to one member; different flows spread across members.

The fields used are set globally with port-channel load-balance method . Available methods depend on the platform; Table 17-3 lists the common ones. The default is typically src-mac on older access switches and src-dst-ip on newer Catalyst platforms.

Table 17-3 Common load-balancing methods

Method Hash input Typical use

src-mac / dst-macSource or destination MAC Simple Layer 2 networks src-dst-mac Both MAC addresses Many hosts talking to many hosts in one

Vlan

src-ip / dst-ip Source or destination IP Traffic toward or from one server src-dst-ip Both IP addresses Most common general-purpose choice src-dst-port TCP/UDP source and destination

  • ports
  • Few hosts with many sessions (where
  • supported)
SW1(config)# port-channel load-balance src-dst-ip
SW1# show etherchannel load-balance

Choose a method whose inputs vary in your traffic. If all traffic from an access switch goes to one default gateway MAC, dst-mac hashes everything onto one link; src-dst-ip spreads it far better. Because the hash works per flow, one large flow can never exceed the speed of a single member link.

Exam alert

Load balancing is per flow, not per packet, and the method is configured globally, not per channel. The command is port-channel load-balance , and show etherchannel load-balance verifies it.

17.7 Verifying EtherChannel

The most useful command is show etherchannel summary (Figure 17-6). Read the port-channel flags and each member's flag; Table 17-4 explains the ones you need. Output in this chapter is illustrative of Cisco IOS XE.

SW1# show etherchannel summary
  • Flags: D - down P - bundled in port-channel
  • I - stand-alone s - suspended
  • H - Hot-standby (LACP only)
  • R - Layer3 S - Layer2
  • U - in use f - failed to allocate aggregator
  • M - not in use, minimum links not met
  • u - unsuitable for bundling
  • w - waiting to be aggregated
  • d - default port
  • Number of channel-groups in use: 1
  • Number of aggregators: 1
  • Group Port-channel Protocol Ports

------+-------------+-----------+----------------------------------------------- 1 Po1(SU) LACP Gi1/0/1(P) Gi1/0/2(P)

Figure 17-6 A healthy Layer 2 LACP channel: Po1 is S (Layer 2) and U (in use); both members are P (bundled).

Table 17-4 Key show etherchannel summary flags

Flag Meaning Healthy?

show etherchannel port-channel (Figure 17-7) adds per-channel detail: the protocol, the number of ports, the port state Ag-Inuse , and the load-share bitmask of each member. show interfaces port-channel 1 (Figure 17-8) shows the logical interface's status and its aggregate bandwidth (2 Gbps for two members). Other commands treat Po1 like any interface: it appears in show interfaces trunk , and show spanning-tree lists Po1 instead of the members, with a lower cost (3 for 2 × 1 Gbps with short costs).

SW1# show etherchannel port-channel

...group listing header omitted...

  • Port-channel: Po1 (Primary Aggregator)
  • ------------
  • Age of the Port-channel = 0d:00h:12m:31s
  • Logical slot/port = 9/1 Number of ports = 2
  • Port state = Port-channel Ag-Inuse
  • Protocol = LACP
  • Port security = Disabled
  • Ports in the Port-channel:
  • Index Load Port EC state No of bits
  • ------+------+------+------------------+-----------
  • 0 55 Gi1/0/1 Active 4
  • 1 AA Gi1/0/2 Active 4

Figure 17-7 Per-channel details: two LACP members, aggregator in use.

SW1 — console

SW1# show interfaces port-channel 1

Port-channel1 is up, line protocol is up (connected)

Hardware is EtherChannel, address is 5254.00b1.0101 (bia 5254.00b1.0101)

  • MTU 1500 bytes, BW 2000000 Kbit/sec, DLY 10 usec,
  • reliability 255/255, txload 1/255, rxload 1/255
  • Encapsulation ARPA, loopback not set
  • Full-duplex, 1000Mb/s, link type is auto, media type is N/A
  • Members in this channel: Gi1/0/1 Gi1/0/2

...output omitted...

SW1# show spanning-tree vlan 10 | include Po1

Po1 Desg FWD 3 128.2049 P2p

Figure 17-8 Po1 is up with 2 Gbps of bandwidth; STP uses Po1 as a single port with cost 3.

show lacp neighbor lists the LACP partner's system ID and ports.

17.8 Troubleshooting EtherChannel

Most EtherChannel problems are one of three kinds:

  • 1. Incompatible modes: passive/passive, auto/auto, LACP on one side and PAgP on the other, or on facing a negotiating mode. The channel shows SD and members show I (stand-alone) or D . Fix the mode on one side.
  • 2. Mismatched member settings: one member has a different allowed VLAN list, native VLAN, speed or duplex, or access VLAN. That member is suspended ( s ) and a %EC-5- CANNOT_BUNDLE2 message names the reason.
  • 3. Mismatched neighbor settings: the two ends disagree on trunking or native VLAN. The channel may come up, but you will see native VLAN mismatch messages from CDP or traffic will not pass in some VLANs.

Figure 17-9 shows case 2. Someone changed the allowed VLAN list directly on Gi1/0/2 instead

of on Po1, so Gi1/0/2 is suspended while Gi1/0/1 keeps the channel up. Making the member match the port channel brings it back. If a member still refuses, remove it with no channel-group , reset it with default interface , and add it back. SW1 — console

SW1#

*Oct 4 11:20:05.114: %EC-5-CANNOT_BUNDLE2: Gi1/0/2 is not compatible with Gi1/0/1 and will be suspended (vlan mask is different)

SW1# show etherchannel summary | begin Group

Group Port-channel Protocol Ports

------+-------------+-----------+----------------------------------------------- 1 Po1(SU) LACP Gi1/0/1(P) Gi1/0/2(s)

SW1# show running-config interface gi1/0/2 | include allowed
switchport trunk allowed vlan 10,20
SW1# show running-config interface port-channel 1 | include allowed
switchport trunk allowed vlan 10,20,99
SW1(config)# interface gigabitethernet1/0/2
SW1(config-if)# switchport trunk allowed vlan 10,20,99

*Oct 4 11:22:41.502: %LINK-3-UPDOWN: Interface Port-channel1, changed state to up

Figure 17-9 A suspended member caused by a different allowed VLAN list, and the fix.

LAB Layer 2 and Layer 3 EtherChannels with LACP

Goal: In Figure 17-10, build a Layer 2 LACP trunk (Po1) between ASW1 and DSW1 and a Layer 3 LACP channel (Po12) between DSW1 and DSW2, then verify both and set the load-balancing method.

  • Po12: Layer 3, LACP, 10.0.12.0/30
  • Po1: Layer 2 trunk, LACP
  • L3 L3

Dsw1 dsw2

Asw1

Figure 17-10 Lab topology.

  • 1. On ASW1 (Gi1/0/49-50) and DSW1 (Gi1/0/1-2): channel-group 1 mode active , then on interface port-channel 1 : switchport mode trunk and switchport trunk allowed vlan 10,20,99 .
  • 2. On DSW1 and DSW2:
DSW1(config)# interface range gigabitethernet1/0/3 - 4
DSW1(config-if-range)# no switchport
DSW1(config-if-range)# channel-group 12 mode active
DSW1(config)# interface port-channel 12
DSW1(config-if)# ip address 10.0.12.1 255.255.255.252
DSW1(config)# port-channel load-balance src-dst-ip

Repeat on DSW2 with 10.0.12.2 and mode passive .

  • 3. Break it on purpose: set DSW2's members to passive as well as DSW1's, observe Po12(RD) , then restore active on DSW1.

Verify:

DSW1 — console

DSW1# show etherchannel summary | begin Group

Group Port-channel Protocol Ports

------+-------------+-----------+----------------------------------------------- 1 Po1(SU) LACP Gi1/0/1(P) Gi1/0/2(P)

12 Po12(RU) LACP Gi1/0/3(P) Gi1/0/4(P)

DSW1# show ip interface brief | include Port

Port-channel1 unassigned YES unset up up

Port-channel12 10.0.12.1 YES manual up up

DSW1# ping 10.0.12.2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.0.12.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/2 ms

DSW1# show etherchannel load-balance

EtherChannel Load-Balancing Configuration:

src-dst-ip

Figure 17-11 Both channels in use: Po1 is Layer 2 (SU) and Po12 is Layer 3 (RU) with a working IP path.

Expected results: Po1 shows SU and Po12 RU , all members (P) ; the ping across Po12 succeeds; shutting one member of Po12 leaves the ping working and show interfaces port-channel 12 reports half the bandwidth.

  • Key terms
  • EtherChannel
  • port channel
  • link aggregation (LAG)

Lacp

  • 1. Why does EtherChannel increase usable bandwidth between two switches compared with separate parallel links?
  • A. It disables STP on the switch
  • B. STP treats the bundle as one port, so no member is blocked
  • C. It compresses frames across links
  • D. It sends each frame over all links at once
  • 2. Which two mode combinations form an LACP EtherChannel? (Choose two.)
  • A. active / passive
  • B. passive / passive
  • C. active / active
  • D. active / on
  • E. desirable / active
  • 3. Which mode combination forms a channel without any negotiation protocol?
  • A. auto / auto
  • B. on / on
  • C. desirable / auto
  • D. on / active
  • 4. Which EtherChannel protocol is an IEEE standard?
  • A. PAgP
  • B. LACP
  • C. DTP
  • D. VTP
  • 5. Which two settings must match on all members of a Layer 2 trunk EtherChannel? (Choose two.)
  • A. Interface description
  • B. Allowed VLAN list
  • C. Native VLAN
  • D. CDP setting
  • E. Port number
  • 6. What must be configured on the physical members of a Layer 3 EtherChannel before they join the channel group?
  • A. switchport mode trunk
  • B. no switchport
  • C. An IP address on each member
  • D. spanning-tree portfast
  • 7. In show etherchannel summary , a port channel shows Po2(RU) . What does this mean?
  • A. Layer 2 channel, unused
  • B. Layer 3 channel, in use
  • C. Routed channel, down
  • D. Channel with ports in hot-standby
  • 8. A member port shows the flag (s) . What is the most likely cause?
  • A. The port is in hot-standby
  • B. The port's configuration differs from the other members
  • C. The port is bundled normally
  • D. The neighbor uses mode on
  • 9. How does EtherChannel distribute traffic across member links?
  • A. Round-robin per packet
  • B. By a hash of header fields, per flow
  • C. All traffic on the first link until it is full
  • D. Randomly per frame
  • 10. Which command changes the load-balancing method?
  • A. etherchannel load-balance src-dst-ip on the port channel
  • B. port-channel load-balance src-dst-ip in global configuration
  • C. channel-group 1 load-balance
  • D. lacp load-balance
  • 11. Switch A uses channel-group 1 mode passive and switch B uses channel-group 1 mode passive . What happens?
  • A. An LACP channel forms
  • B. A static channel forms
  • C. No channel forms; neither side initiates
  • D. A PAgP channel forms
  • 12. Which two commands show which physical ports belong to Port-channel 1? (Choose two.)
  • A. show etherchannel summary
  • B. show interfaces port-channel 1
  • C. show ip route
  • D. show vlan brief
  • E. show cdp

Answers

  • 1. B. STP runs on the logical port channel, so all members forward.
  • 2. A, C. At least one side must be active. Passive/passive never starts; on and PAgP modes do not talk to LACP.
  • 3. B. Mode on only bundles with on.
  • 4. B. LACP is IEEE 802.3ad (802.1AX); PAgP is Cisco proprietary.
  • 5. B, C. Trunk parameters such as allowed VLANs and native VLAN must match; descriptions and port numbers need not.
  • 6. B. Members must be routed ports; the IP address goes on the port-channel interface.
  • 7. B. R = Layer 3, U = in use.
  • 8. B. s = suspended because of a mismatch; H would be hot-standby.
  • 9. B. A hash keeps each flow on one link to preserve ordering.
  • 10. B. The method is global: port-channel load-balance .
  • 11. C. Passive only responds, so two passive ends never negotiate.
  • 12. A, B. The summary lists members, and show interfaces port-channel shows "Members in this channel".
Use ← → to move between sections