7.4 EtherChannel Link Aggregation

7.4 EtherChannel Link Aggregation

Core Blueprint Focus: Cisco 350-401 ENCOR v1.2 topic 3.1.b (troubleshoot static and dynamic EtherChannels) covers Layer 2 link bundling and high availability. Candidates must master Port Aggregation Protocol (PAgP) and Link Aggregation Control Protocol (LACP 802.3ad/802.1AX), configure LACP priorities (System Priority, Port Priority), diagnose load-balancing hash algorithms to prevent polarization, and implement Multi-Chassis EtherChannel (MCEC) solutions including Cisco StackWise and StackWise Virtual (SVL) with Dual-Active Detection (DAD).

Connecting switches with multiple parallel physical links creates Layer 2 loops. Under standard Spanning Tree rules, STP blocks all redundant uplinks except one, leaving substantial bandwidth unutilized. EtherChannel bundles up to 8 active physical links into a single logical Port-Channel interface. Spanning Tree views the bundle as a single logical link, preventing STP port blocking while aggregating full bi-directional bandwidth and providing seamless sub-second link failover.

1. EtherChannel Prerequisites & Port Compatibility Matrix

For physical interfaces to bundle into an active EtherChannel, all member ports must share identical configuration parameters:

+-----------------------------------------------------------------------------------+
|                    ETHERCHANNEL PORT COMPATIBILITY REQUIREMENTS                   |
+-----------------------------------------------------------------------------------+
|  1. Speed & Duplex:       Must match exactly (e.g., 10 Gbps Full Duplex).         |
|  2. Switchport Mode:      Must match (all Access or all Trunk).                   |
|  3. Access VLAN:          If access, must belong to the exact same VLAN ID.       |
|  4. Trunk Parameters:     If trunk, Native VLAN and Allowed VLAN list must match.  |
|  5. STP Settings:         STP path cost, priority, and portfast settings match.  |
|  6. MTU & Storm Control:  Layer 2 MTU and broadcast storm thresholds must match.  |
+-----------------------------------------------------------------------------------+

[!CAUTION] If any member interface has a mismatched parameter (e.g., different speed, native VLAN, or allowed VLAN list), Cisco IOS-XE will suspend the inconsistent port, generating %EC-5-CANNOT_BUNDLE2 error messages.

2. Dynamic Negotiation Protocols: PAgP vs. LACP

EtherChannels can be established statically or negotiated dynamically using either Cisco proprietary PAgP or open standard LACP.

+-----------------------------------------------------------------------------------+
|                         PAgP & LACP NEGOTIATION MODES                             |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|  PAgP (Cisco Proprietary - Protocol ID 0x0104):                                   |
|  +----------------------+                           +----------------------+      |
|  |   DESIRABLE (Active) | <=======================> |   DESIRABLE (Active) | ===> OK  |
|  +----------------------+                           +----------------------+      |
|  |   DESIRABLE (Active) | <=======================> |     AUTO (Passive)   | ===> OK  |
|  +----------------------+                           +----------------------+      |
|  |     AUTO (Passive)   | < - - - - - - - - - - - > |     AUTO (Passive)   | ===> NO! |
|  +----------------------+                           +----------------------+      |
|                                                                                   |
|  LACP (IEEE 802.3ad / 802.1AX - EtherType 0x8809):                                |
|  +----------------------+                           +----------------------+      |
|  |    ACTIVE (Active)   | <=======================> |    ACTIVE (Active)   | ===> OK  |
|  +----------------------+                           +----------------------+      |
|  |    ACTIVE (Active)   | <=======================> |    PASSIVE (Passive) | ===> OK  |
|  +----------------------+                           +----------------------+      |
|  |   PASSIVE (Passive)  | < - - - - - - - - - - - > |    PASSIVE (Passive) | ===> NO! |
|  +----------------------+                           +----------------------+      |
|                                                                                   |
|  STATIC (Mode 'ON'):                                                              |
|  +----------------------+                           +----------------------+      |
|  |     MODE ON (Static) | ========================= |     MODE ON (Static) | ===> OK  |
|  +----------------------+                           +----------------------+      |
+-----------------------------------------------------------------------------------+

1. Port Aggregation Protocol (PAgP - Cisco Proprietary)

• Multicast MAC destination: 01:00:0C:CC:CC:CC.
• desirable: Actively transmits PAgP packets to initiate bundle negotiation.
• auto: Passively listens for PAgP packets; responds if requested but never initiates negotiation. Two switches configured with auto will never form an EtherChannel.
• auto silent vs. non-silent: By default, PAgP operates in silent mode, allowing ports to attach to non-PAgP endpoints (such as file servers). In non-silent mode, the interface requires continuous bidirectional PAgP packets to prevent unidirectional loops.

2. Link Aggregation Control Protocol (LACP - IEEE 802.3ad / 802.1AX)

• Standardized open protocol. Multicast MAC destination: 01:80:C2:00:00:02 (Slow Protocols EtherType 0x8809).
• active: Actively transmits LACP packets to initiate bundle negotiation.
• passive: Passively listens for LACP packets; responds if requested. Two switches configured with passive will never form an EtherChannel.

LACP System Priority & Port Priority Mechanics

LACP supports bundling up to 16 physical links, where 8 links are actively forwarding and up to 8 links remain in hot-standby mode.

1. LACP System Priority (2 Bytes, 1 to 65535, Default: 32768):
   • Combined with the switch base MAC address to form the LACP System ID.
   • The switch with the lowest System Priority (or lowest MAC address if tied) is elected as the Actor (Master) switch. The Actor switch makes all authoritative decisions regarding which links are active and which are standby.
2. LACP Port Priority (2 Bytes, 1 to 65535, Default: 32768):
   • Configured per interface. The Actor switch evaluates Port Priority to choose active bundle members.
   • Ports with the lowest Port Priority integer (or lowest physical interface number if tied) are selected as active forwarding links. Remaining links are placed into hot-standby.
3. LACP Timers (Fast vs. Slow):
   • Fast Rate (lacp rate fast): Transmits LACP packets every 1 second (timeout = 3 seconds), enabling rapid link failure detection.
   • Slow Rate (lacp rate slow - Default): Transmits LACP packets every 30 seconds (timeout = 90 seconds).

3. Load-Balancing Mechanisms & Hash Polarization

EtherChannel does not use round-robin packet distribution because round-robin causes out-of-order packet delivery, breaking TCP windowing performance. Instead, EtherChannel employs a deterministic mathematical hash algorithm.

+-----------------------------------------------------------------------------------+
|                    ETHERCHANNEL HASH LOAD-BALANCING FLOW                          |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|  Frame Enters Switch                                                              |
|         |                                                                         |
|         v                                                                         |
|  [ Extract Header Fields ] ===> Source IP, Destination IP, L4 Ports, MAC          |
|         |                                                                         |
|         v                                                                         |
|  [ Compute XOR Hash ]     ===> Produces an n-bit hash index value                 |
|         |                                                                         |
|         v                                                                         |
|  [ Map Index to Port ]    ===> Index maps deterministically to Member Link (1-8)  |
|         |                                                                         |
|         v                                                                         |
|  Frame Transmitted across selected physical link (Frames in same flow stay in-order)|
+-----------------------------------------------------------------------------------+

Configurable Load-Balancing Algorithms

Cisco IOS-XE supports multiple load-balancing algorithms configured via port-channel load-balance <method>:

• src-mac / dst-mac / src-dst-mac: Hashing based on Layer 2 MAC addresses.
• src-ip / dst-ip / src-dst-ip: Hashing based on Layer 3 IPv4/IPv6 addresses.
• src-port / dst-port / src-dst-port: Hashing based on Layer 4 TCP/UDP port numbers.
• src-dst-mixed-ip-port: Enhanced 5-tuple hash (Source/Dest IP + Source/Dest Port) available on modern Catalyst 9000 switches.

The EtherChannel Polarization Effect

• Problem: In multi-tier hierarchical campus designs (e.g., Access $\to$ Distribution $\to$ Core), if all switches use the same load-balancing hash algorithm (e.g., src-dst-ip) and have the same number of active member links (e.g., 2 links per bundle), the hashing calculation produces identical results at each layer.
• Consequence: Traffic distributed onto Link 1 at the Access layer will produce the exact same hash at the Distribution layer, funneling all traffic onto Link 1 of the upstream Core EtherChannel while Link 2 remains completely idle (0% utilization).
• Mitigation:
  1. Use mixed Layer 3 / Layer 4 hashing (src-dst-mixed-ip-port) to maximize entropy.
  2. Configure different hashing algorithms at different switching tiers (e.g., src-ip at access, src-dst-port at distribution).
  3. Deploy modern Catalyst ASICs that incorporate unique internal pseudo-random hash offsets.

4. Multi-Chassis EtherChannel (MCEC) Technologies

Standard EtherChannel requires all aggregated physical links to terminate on the same physical switch chassis. If that chassis fails, all connectivity is lost. Multi-Chassis EtherChannel (MCEC) allows physical member links to terminate across two separate physical switches while presenting a single logical switch entity to downstream devices, completely eliminating Spanning Tree blocking.

1. Cisco StackWise-480 / StackWise-1T (Hardware Stacking)

• Architecture: Up to 8 or 9 switches (e.g., Catalyst 9300 series) interconnected using specialized hardware stacking cables in a bidirectional ring topology.
• Plane Operations: Single centralized management IP, single control plane (Active, Standby, and Member roles with SSO/NSF), and distributed wire-rate ASIC forwarding across a 480 Gbps or 1 Tbps backplane ring.
• Cross-Stack EtherChannel: Member links of an EtherChannel can connect to different physical switches in the stack. If one switch fails, the remaining physical links in the port-channel maintain continuous data forwarding.

2. Cisco Virtual Switching System (VSS - Legacy Catalyst 6500/6800/4500X)

• Combines two modular chassis into a single virtual switch using Virtual Switch Links (VSL) carrying specialized VSS header-encapsulated control and data traffic.

3. Cisco StackWise Virtual (SVL - Catalyst 9000 Series)

• Architecture: Combines two modular or fixed switches (such as Catalyst 9500, 9600) into a single logical entity using standard 10G, 25G, 40G, or 100G Ethernet fiber interfaces configured as StackWise Virtual Links (SVL).
• Control Plane: Operates with Stateful Switchover (SSO) and Nonstop Forwarding (NSF). Switch 1 acts as Active; Switch 2 acts as Standby.
• Dual-Active Detection (DAD) & Split-Brain Prevention:
  • If all SVL interconnect links fail simultaneously, both switches assume the other has died. Both would attempt to act as the Active switch, resulting in a catastrophic split-brain condition with duplicate IP addresses, duplicate MAC addresses, and routing loops.
  • DAD Mechanisms:
    1. Fast Hello DAD: A dedicated, direct Layer 2 point-to-point link configured between the two switches specifically for heartbeat exchange.
    2. Enhanced PAgP (ePAgP): Transmits dual-active TLV heartbeat messages within PAgP packets across downstream dual-homed access switches.
  • Recovery Action: When DAD detects a split-brain condition, the Standby switch immediately enters Recovery Mode, shutting down all of its front-panel data interfaces (except the SVL links), preventing duplicate traffic until the SVL is restored.

5. Cisco IOS-XE EtherChannel Configuration & Verification

1. Configure LACP Port-Channel with Priority Control

! Step 1: Set LACP System Priority on authoritative Core Switch
Core-Switch-A(config)# lacp system-priority 4096

! Step 2: Configure member interfaces for LACP Active mode and Port Priority
Core-Switch-A(config)# interface range HundredGigE 1/0/1 - 2
Core-Switch-A(config-if-range)# description LACP-UPLINK-TO-CORE-B
Core-Switch-A(config-if-range)# switchport mode trunk
Core-Switch-A(config-if-range)# switchport trunk allowed vlan 10,20,30,100
Core-Switch-A(config-if-range)# channel-group 10 mode active
Core-Switch-A(config-if-range)# lacp port-priority 8192
Core-Switch-A(config-if-range)# lacp rate fast
Core-Switch-A(config-if-range)# exit

! Step 3: Set Enhanced 5-Tuple Load Balancing globally
Core-Switch-A(config)# port-channel load-balance src-dst-mixed-ip-port

2. Configure Cisco StackWise Virtual Link (SVL) and DAD

! Configure StackWise Virtual Link on Catalyst 9500 (Node 1)
Switch-1(config)# stackwise-virtual
Switch-1(config-stackwise-virtual)# domain 10
Switch-1(config-stackwise-virtual)# exit

! Assign 40G/100G interfaces to StackWise Virtual Link
Switch-1(config)# interface range FortyGigabitEthernet 1/0/49 - 50
Switch-1(config-if-range)# stackwise-virtual link 1
Switch-1(config-if-range)# exit

! Configure dedicated Fast Hello Dual-Active Detection interface
Switch-1(config)# interface GigabitEthernet 1/0/1
Switch-1(config-if)# stackwise-virtual dual-active-detection
Switch-1(config-if)# exit

3. Verification & Troubleshooting Commands

! Verify EtherChannel summary and member port status
Core-Switch-A# show etherchannel summary
Flags:  D - down        P - bundled in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        R - Layer3      S - Layer2
        U - in use      N - not in use, no aggregation

Group  Port-channel  Protocol    Ports
------+-------------+-----------+-----------------------------------------------
10     Po10(SU)         LACP      Hu1/0/1(P)  Hu1/0/2(P)

! Verify LACP neighbor negotiation details
Core-Switch-A# show lacp neighbor 10
Channel group 10 neighbors

Partner's information:

                  LACP port                        Admin  Oper   Port    Port
Port      Flags   Priority  Dev ID          Age    key    Key    Number  State
Hu1/0/1   SA      32768     5006.0420.0002  12s    0x1    0x1    0x1     0x3D
Hu1/0/2   SA      32768     5006.0420.0002   8s    0x1    0x1    0x2     0x3D

! Verify StackWise Virtual and DAD link operational status
Core-Switch-A# show stackwise-virtual dual-active-detection
Dual-Active-Detection Configuration:
-------------------------------------
Switch  Stackwise Virtual Link  Dual-Active-Detection Link
------- ----------------------- --------------------------
1       FortyGigabitEthernet1/0/49 GigabitEthernet1/0/1
        FortyGigabitEthernet1/0/50
2       FortyGigabitEthernet2/0/49 GigabitEthernet2/0/1
        FortyGigabitEthernet2/0/50

Status: PASSED (Operational)