Configure and verify (Layer 2/Layer 3) EtherChannel (LACP)

The problem EtherChannel solves

Suppose SW1 and SW2 are connected by one 1 Gbps link and it is saturated. You add a second cable. Now spanning tree (section 2.5) sees a loop and blocks the second link, so you have paid for bandwidth you cannot use. And if you add a third and fourth, STP blocks those too.

EtherChannel (also called a port channel, link aggregation, or a LAG) bundles two to eight physical links into one logical link. Spanning tree sees a single interface, so nothing is blocked. Traffic is spread across the member links, and if one cable fails the others keep working with no STP reconvergence. The logical interface is called Port-channel N (Po1, Po2, and so on) and you configure things like trunking on the port channel, which then pushes the settings down to every member.

Think of it as merging four two-lane roads into one eight-lane highway with a single name. Cars (frames) are assigned to a lane by a rule, and losing a lane does not close the highway.

Negotiation protocols: PAgP, LACP, and static

Just as DTP negotiates trunks, two protocols negotiate EtherChannels. They make sure both ends agree before bundling, which prevents one side from bundling while the other side treats the cables as separate links (a loop).

Which combinations form a channel:

The pattern: one side must be the “talker” (desirable or active); both sides being the “listener” (auto or passive) never forms a channel. You cannot mix PAgP with LACP, and on only works with on. The recommended practice is LACP active on both sides.

LACP details worth knowing: a port channel can have up to 16 member links configured, of which up to 8 are active and the rest are hot standby. Each switch has an LACP system priority (default 32768) and each port an LACP port priority (default 32768); the switch with the lower system priority decides which ports are active when more than eight are configured. PAgP and static support a maximum of 8 links.

Requirements for member ports

Every physical port in a channel must have identical settings, or the switch refuses to bundle it (the port is suspended and shows an s flag). The settings must match within one switch’s bundle and, for the link to work, with the far side as well:

• Same speed and duplex.
• Same switchport mode (all access or all trunk).
• If access: same access VLAN. If trunk: same native VLAN and same allowed VLAN list.
• Same trunk encapsulation.
• Same Layer 2 or Layer 3 type (a channel cannot mix switchports and routed ports).
• No port can be a SPAN destination or have port security enabled.
• Same STP settings (port cost, PortFast, etc.) are strongly recommended.

The cleanest way to guarantee this is to reset the physical interfaces to defaults, add them to the channel, and then configure everything on the port-channel interface, which copies the settings to the members.

Layer 2 EtherChannel configuration

Topology: SW1 Gi0/1 and Gi0/2 connect to SW2 Gi0/1 and Gi0/2. We want an LACP trunk between them carrying VLANs 10, 20, and 99.

SW1(config)# interface range gigabitethernet0/1 - 2
SW1(config-if-range)# description ETHERCHANNEL-TO-SW2
! Create Port-channel 1 and add these ports using LACP active mode
SW1(config-if-range)# channel-group 1 mode active
Creating a port-channel interface Port-channel 1
SW1(config-if-range)# exit
! Configure trunking on the logical interface; members inherit it
SW1(config)# interface port-channel 1
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk native vlan 99
SW1(config-if)# switchport trunk allowed vlan 10,20,99
SW1(config-if)# end

SW2 gets the identical configuration (its side can be active or passive; active on both is best). Note the channel-group command creates the port-channel interface automatically; you do not need to create it first. The channel-group number is locally significant: SW1 could use group 1 while SW2 uses group 5, and the channel would still form. Matching numbers is simply a convention that makes troubleshooting easier.

For PAgP, replace mode active with mode desirable (or auto). For a static bundle, use mode on.

Layer 3 EtherChannel configuration

A Layer 3 EtherChannel is a bundle of routed ports with an IP address on the port channel. It is used between Layer 3 switches, or between a Layer 3 switch and a router, wherever you would otherwise use a single routed link. The physical interfaces and the port channel must all be no switchport.

SW1(config)# interface port-channel 2
! Make the logical interface a routed interface first
SW1(config-if)# no switchport
SW1(config-if)# ip address 10.1.1.1 255.255.255.252
SW1(config-if)# exit
SW1(config)# interface range gigabitethernet0/3 - 4
SW1(config-if-range)# no switchport
SW1(config-if-range)# no ip address
SW1(config-if-range)# channel-group 2 mode active
SW1(config-if-range)# no shutdown
SW1(config-if-range)# end

The far side uses 10.1.1.2/30. Routing protocols (OSPF, static routes) then treat Port-channel2 as one interface. If one member link fails the route stays up; only the bandwidth drops.

Load balancing

EtherChannel does not split one flow across links. Each frame is assigned to exactly one member link by hashing chosen header fields, so that all frames of one conversation take the same link (this preserves ordering). Which fields are hashed is set globally per switch:

SW1(config)# port-channel load-balance src-dst-ip
SW1# show etherchannel load-balance
EtherChannel Load-Balancing Configuration:
        src-dst-ip

EtherChannel Load-Balancing Addresses Used Per-Protocol:
Non-IP: Source XOR Destination MAC address
  IPv4: Source XOR Destination IP address
  IPv6: Source XOR Destination IP address

Options include src-mac, dst-mac, src-dst-mac, src-ip, dst-ip, src-dst-ip, and on many platforms src-port, dst-port, and src-dst-port (Layer 4 ports). The default varies by platform (src-mac on many older Catalyst switches, src-dst-ip on others). The important concept: if a switch load-balances on src-mac and all traffic comes from one router MAC toward many servers, everything lands on one link. Choosing fields with more variety (src-dst-ip or src-dst-port) spreads traffic better. A single large flow (one file copy) can never exceed the speed of one member link.

Verification: show etherchannel summary

SW1# show etherchannel summary
Flags:  D - down        P - bundled in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        R - Layer3      S - Layer2
        U - in use      f - failed to allocate aggregator

        M - not in use, minimum links not met
        u - unsuitable for bundling
        w - waiting to be aggregated
        d - default port

        A - formed by Auto LAG

Number of channel-groups in use: 2
Number of aggregators:           2

Group  Port-channel  Protocol    Ports
------+-------------+-----------+-----------------------------------------------
1      Po1(SU)         LACP      Gi0/1(P)    Gi0/2(P)
2      Po2(RU)         LACP      Gi0/3(P)    Gi0/4(P)

How to read the flags:

• Po1(SU) = Layer 2 (S) and in use (U). A healthy Layer 2 channel.
• Po2(RU) = Layer 3 (R) and in use (U). A healthy Layer 3 channel.
• Po1(SD) = Layer 2 and down. Nothing bundled; check the members.
• Gi0/1(P) = bundled and working.
• Gi0/1(I) = stand-alone: the port is up but is not part of the channel, usually because the far side is not running the same protocol or is set to on. The port behaves as an independent link, and STP may block it.
• Gi0/1(s) = suspended: the port’s configuration does not match the other members (different VLAN, speed, etc.) or LACP detected a mismatch.
• Gi0/1(D) = down: cable unplugged or port shut down.
• Gi0/1(H) = LACP hot standby: more than 8 links configured; this one waits.
• Gi0/1(w) = waiting to be aggregated (transient during negotiation).
• Protocol shows LACP, PAgP, or - (a static on channel).

Other verification commands:

SW1# show etherchannel port-channel
SW1# show etherchannel 1 detail
SW1# show interfaces port-channel 1
SW1# show lacp neighbor
SW1# show lacp 1 counters
SW1# show pagp neighbor
SW1# show spanning-tree | include Po

show interfaces port-channel 1 reports the aggregate bandwidth (for example BW 2000000 Kbit for two gigabit links) and the Members in this channel line. show spanning-tree lists Po1 as one port, which proves the loop concern is gone.