L2 with Aggregate

[apirachat]

Hi

  We would like to configure L2 with Aggregate between PANOS (4.1 - PA5050) with cisco switch

     -  After we do L2 Aggregate  , and assign IP Address on VLAN , we find that when we ping to this IP Address , there are many request-timeout.

     - If we configure L2 and set IP on VLAN only (without aggregate), there is no problem  (Ping smoothly)

     - On cisco switch , we use channel group mode on.

   Please advice, I'm a new for Palo FW.

Thank you

Kamol

[mikand]

Hopefully this thread will help you: https://live.paloaltonetworks.com/thread/1459?tstart=0

It seems that PAN currently doesnt support 802.3ad (LACP) but it supports PAgP (Etherchannel) if im not mistaken.

On the PAN you setup an aggregated ethernet group which you bond to each physical interface. Then in the configuration of the ae-group you setup the ip address (if needed).

One note is to verify which port-channel load-balance method you use.

I think srcmac+dstmac is default which makes that your extra interfaces in the ae-group will basically just idle. If you change this into src-dst-ip or src-dst-port you will get a better loaddistribution (given that your equipment supports such loadbalance method). My favorite choice is to use srcip+srcport+dstip+dstport as loadbalance method (again given that your equipment supports such setting).

For more information: http://www.cisco.com/en/US/tech/tk389/tk213/technologies_tech_note09186a0080094714.shtml