Bundle two uplinks into an LACP EtherChannel trunk

Cisco IOSWorking

Tasks

Configure both members on ASW1 identically as a trunk and bundle them with LACP active.
Do the same on DSW1.
Set the load-balancing method to source and destination IP on both switches.
Verify the bundle, the LACP partner on each member and the forwarding VLANs.

Solution

1Members and port-channel on ASW1ASW1

ASW1 on Cisco IOS

interface range GigabitEthernet1/0/47 - 48
 description Uplink to DSW1
 switchport mode trunk
 switchport nonegotiate
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,30
 channel-group 1 mode active
!
interface Port-channel1
 description Uplink bundle to DSW1
 switchport mode trunk
 switchport nonegotiate
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,30

The first channel-group 1 creates Port-channel1. Configure the members identically before bundling, and make every later change on Port-channel1 only.

2Members and port-channel on DSW1DSW1

DSW1 on Cisco IOS

interface range GigabitEthernet1/0/1 - 2
 description Downlink to ASW1
 switchport mode trunk
 switchport nonegotiate
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,30
 channel-group 1 mode active
!
interface Port-channel1
 description Downlink bundle to ASW1
 switchport mode trunk
 switchport nonegotiate
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,30

Channel-group numbers are local and do not have to match across the link. Matching them just makes the network easier to read.

3Hash on IP addressesASW1
ASW1 on Cisco IOS
```
port-channel load-balance src-dst-ip
```
Global command, applied on DSW1 as well. Each switch hashes only the traffic it sends, so both ends need it.

Verify

ASW1 output

ASW1# show etherchannel summary | begin Group
Group  Port-channel  Protocol    Ports
------+-------------+-----------+-----------------------------------------------
1      Po1(SU)         LACP      Gi1/0/47(P)     Gi1/0/48(P)

Po1 is layer 2 and in use (SU), and both members are bundled (P).

ASW1 output

ASW1# show lacp 1 neighbor
Flags:  S - Device is requesting Slow LACPDUs
        F - Device is requesting Fast LACPDUs
        A - Device is in Active mode       P - Device is in Passive mode

Channel group 1 neighbors

                     LACP port                      Admin  Oper   Port    Port
Port          Flags  Priority  Dev ID          Age  key    Key    Number  State
Gi1/0/47      SA     32768     aabb.cc00.0100  14s  0x0    0x1    0x102   0x3D
Gi1/0/48      SA     32768     aabb.cc00.0100   3s  0x0    0x1    0x103   0x3D

Both members see the same partner, DSW1's system MAC, in active mode. Port numbers 0x102 and 0x103 are DSW1's Gi1/0/1 and Gi1/0/2. State 0x3D means in sync, collecting and distributing.

ASW1 output

ASW1# show etherchannel load-balance
EtherChannel Load-Balancing Configuration:
        src-dst-ip

EtherChannel Load-Balancing Addresses Used Per-Protocol:
Non-IP: Source XOR Destination MAC address
  IPv4: Source XOR Destination IP address
  IPv6: Source XOR Destination IP address

IP-based hashing is active. Non-IP traffic still hashes on MACs.

ASW1 output

ASW1# show interfaces trunk | begin Vlans allowed on
Port        Vlans allowed on trunk
Po1         10,20,30

Port        Vlans allowed and active in management domain
Po1         10,20,30

Port        Vlans in spanning tree forwarding state and not pruned
Po1         10,20,30

The trunk is the port-channel, not the physical members, and all three VLANs forward on it.

ASW1 output

ASW1# test etherchannel load-balance interface port-channel 1 ip 10.10.0.11 10.20.0.50
Would select Gi1/0/48 of Po1

Shows which member one flow uses. Try several address pairs to see both members chosen.

Mistakes people make

Configuring one member differently, for example an extra allowed VLAN. That member is suspended with %EC-5-CANNOT_BUNDLE2.
Passive on both ends. Neither side starts the negotiation and nothing bundles.
Mode on at one end and LACP at the other. The LACP side suspends its members while the on side thinks the bundle is up.
Expecting one large transfer to use both links. A flow always hashes to one member.
Cabling the second member to a different switch. LACP sees a different partner and refuses to bundle it.

On other platforms

The DSW1 side on NX-OS.

NX-OS

feature lacp
interface Ethernet1/1-2
  switchport mode trunk
  switchport trunk allowed vlan 10,20,30
  channel-group 1 mode active
interface port-channel1
  switchport mode trunk
  switchport trunk allowed vlan 10,20,30

An EX switch with ELS. VLANs v10, v20 and v30 must already be defined.

Junos

set chassis aggregated-devices ethernet device-count 1
set interfaces ge-0/0/46 ether-options 802.3ad ae0
set interfaces ge-0/0/47 ether-options 802.3ad ae0
set interfaces ae0 aggregated-ether-options lacp active
set interfaces ae0 unit 0 family ethernet-switching interface-mode trunk
set interfaces ae0 unit 0 family ethernet-switching vlan members [ v10 v20 v30 ]

Say it in the interview

"I configure both members identically, bundle them with LACP active on both ends, and from then on change only the port-channel. Spanning tree sees one logical port, so both links forward. I check that both members see the same partner in show lacp neighbor, set an IP-based hash on both switches, and remember that one flow still uses only one link."