topic LACP Nego-fail issue between firewall and CPE router - Expected Behaviour? in General Topics

LACP Nego-fail issue between firewall and CPE router - Expected Behaviour?

SirchRettop — Thu, 29 Oct 2020 12:52:36 GMT

Hi Live,

I'm experiencing an issue with a setup of aggregated ethernet interfaces configured with LACP simply for redundancy connections between our HA Active/Passive firewalls and Cisco ISR 4451 routers.

I'm wondering what steps to take as regards packet captures on firewall interfaces to figure out why negotiation will fail.

Or is this expected behaviour?

ethernet1/1 and ethernet1/2 = AE1

Virtual IP (public/ default gateway) presented to firewalls from CPE Cisco routers.

So far we have tried all modes of LACP and transmission rates w/ active, passive, fast, slow but there has been still no change as regards ethernet1/2 and lacp negotiation failure with the router interface of GE0/0/2

I have reviewed >less mp-log l2ctrld.log but no indicators there either.

As far as I'm aware, physical layer 1 hasn't been checked.

Interface and AE/LACP settings

>show lacp aggregate-ethernet ae1

Re: LACP Nego-fail issue between firewall and CPE router - Expected Behaviour?

SutareMayur — Thu, 29 Oct 2020 14:12:57 GMT

@SirchRettop,

How your routers are configured? Make sure both these routers are virtually into one cluster.

Regards,

Mayur Sutare

Re: LACP Nego-fail issue between firewall and CPE router - Expected Behaviour?

SirchRettop — Thu, 29 Oct 2020 14:25:15 GMT

Thanks Mayur,

Yes the Cisco routers are configured virtually into one cluster where we use the virtual ip as the default gateway

Re: LACP Nego-fail issue between firewall and CPE router - Expected Behaviour?

SutareMayur — Mon, 02 Nov 2020 07:17:52 GMT

@SirchRettop,

I would recommend you to verify configuration on switch side first. Also verify the transmission rate and the mode that you're using. You can also try to configure AE group to SLOW MODE.

You can even check more related logs in the file l2ctrld.log under mp-log.