topic Re: How to use Aggregate interfaces LACP? in General Topics

How to use Aggregate interfaces LACP?

jeremylo — Thu, 02 Aug 2018 06:27:26 GMT

Testing a PA-220. Create an Aggregate group with 2 interfaces.

Both interfaces connect to an unmanaged D-Link switch. And it connected to the company network.

The aggregate interface can up when LACP is not enable.

After enable LACP. It down and hover the mouse on it show below info:

ethernet1/2: not active (negotiation failed)

ethernet1/1: not active (peer not detected)

Is there any prerequisite to use LACP?

Re: How to use Aggregate interfaces LACP?

JoeAndreini — Thu, 02 Aug 2018 11:44:16 GMT

Your switch must support it and be configured as such.

An unmanaged switch would not have that capability.

Re: How to use Aggregate interfaces LACP?

BPry — Thu, 02 Aug 2018 13:30:45 GMT

@jeremylo,

As @JoeAndreini already stated any unmanaged switch isn't going to work with LACP.

LACP (Link Aggregation Control Protocol) only has a few real advantages, but they are actually pretty important in most enviroments over a standard LAG configuration.

- The failover will always occur automatically: When a link fails, even if a MC is between the devices, the peer will remove a link from the aggregate group because it fails to negotiate with the LACP peer. Major advantage depending on how your network is setup.

- Since this is a control protocol that negotiates the connection, the device can confirm that the other end can handle link aggregation before bringing up the interfaces. This helps prevent miscabling causing a loop or similar issues.

Re: How to use Aggregate interfaces LACP?

jeremylo — Fri, 03 Aug 2018 01:36:48 GMT

Thanks BPry and JoeAndreini.

In my production environment. The PA device will place between 2 x Juniper SSG140 (formed in HA) and 1 x Cisco 2960 switch like below:

internal <--> 2960 <--> PA <--> 2xSSG140(HA) <--> internet

My plan is

1. Aggregate interfaces connect to 2 ports in 2960.

2. Aggregate interfaces with eth1/1 connect to 1st SSG140. eth1/2 connect to 2nd SSG140.

Do you think LACP is going to work with those network device?

Re: How to use Aggregate interfaces LACP?

JoeAndreini — Fri, 03 Aug 2018 11:07:44 GMT

your "external" aggregate interface will not work as you expect, it will need to be two separate interfaces, one to each SSG. Or there will need to eb a switch between the NGFW and the SSG(s)

Re: How to use Aggregate interfaces LACP?

RobinClayton — Fri, 03 Aug 2018 11:51:14 GMT

The 2960 though will be fine with Etherchannel for LACP.

You could use the 2960 on both sides of the PA with seperate VLANS for internal and external traffic (but it's not ideal).

Rob