topic Port Channel to Cisco Switch in General Topics

Port Channel to Cisco Switch

sjy2013 — Thu, 05 Sep 2013 09:33:46 GMT

Hi,

I have Palo Alto 3020/5020 firewalls and I would like to configure a port channel (ether channel) between these devices and a Cisco switch.

I have configured an aggregate link on the Palo and added the interfaces. I have created the Port Channel on my Cisco but I am not seeing the AE interface coming up.

Has anyone got a guide on how this can be done or if it can be.

Many thanks in advance

SImon

Re: Port Channel to Cisco Switch

kadak — Thu, 05 Sep 2013 13:23:20 GMT

Hello Simon,

PAN does not LACP aggregation with Cisco Switches. A static/manual port configuration is required for PAN - Cisco link aggregation.

Here is the document which might help you:

Cisco Link Aggregation Traffic Through a PAN Device

Regards,

Kunal Adak

Re: Port Channel to Cisco Switch

mikand — Thu, 05 Sep 2013 22:43:40 GMT

This might be helpful aswell: Re: Aggregation of ethernet on PA-4050 with Cisco switch

Re: Port Channel to Cisco Switch

mbutt — Thu, 05 Sep 2013 23:50:43 GMT

Palo Alto Networks firewalls currently support 802.3ad for link aggregation.

For load balancing:

Sessions originating from the firewall will be sent through the links using a round-robin method.
Device sending traffic to the firewall via the aggregated link also needs to be configured for load balancing.

LACP (Link Aggregation Control Protocol, 802.1ax) is not supported.

The above information can also be found at the following link

https://live.paloaltonetworks.com/docs/DOC-3594

If LACP is something that would be helpful in your environment. I would suggest request a feature with local Sales Engineer.

Hope this helps.
Thanks

Numan

Re: Port Channel to Cisco Switch

sjy2013 — Fri, 22 Nov 2013 13:22:07 GMT

Thanks for the info, managed to get this working now

Re: Port Channel to Cisco Switch

kdaehler — Tue, 08 Apr 2014 19:43:44 GMT

Hello sjy2013,

Can you please tell, which documents helped you managing this task? Or even better, could you post your palo-config?

Thank you for your reply.

Best regards, Karl