topic Re: general question to aggregate group in General Topics

general question to aggregate group

MPI-AE — Thu, 08 Nov 2018 15:12:13 GMT

Hi all!
When I create an aggregate group, there is the possibility to enable LACP.

But when I don't enable LACP, which ethernet standard is enabled then?

Does the firewall utilize bandwith over all links as in LACP?

Thank you

Re: general question to aggregate group

gwesson — Thu, 08 Nov 2018 17:56:40 GMT

Link Aggregation without LACP uses a session hash to load balance over the member interfaces for that group. It uses the full bandwidth available in the group.

The risk of this is that if you don't use LACP and one of the member interfaces goes down, sessions will continue to be forwarded to that interface (based on the hash), blackholing traffic.

So you can do it, but I wouldn't recommend it 🙂

Re: general question to aggregate group

AlexSieber — Fri, 09 Nov 2018 08:43:09 GMT

gwesson is right, the pan uses a hash algorithm, you can find details here:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClV5CAK

But I do not agree with link loss. When the firewall detects a link is down, it will not be used any more.

Anyway it is better to use LACP. As this actively exchanges information over the links this can help when a link is up but does not really forward traffic. If this is the case it gets removed from the LACP group.