Cisco Nexus Port Channel: Configuring LACP

Created by Amar Singh in Articles 6 Jan 2024

Task

1. Erase the previous configuration on switches NXOS01, NXOS02, NXOS03 and NXOS04 using command “write erase” and reload both switches, assign hostname the same hostname to both switches. Use provisioning documents if required

2. Configure port channels between NXOS01, NXOS02, NXOS03, and NXOS04 as follows:

● The links between NXOS03 and NXOS01 should be grouped together in Port-Channel 1. Do not use a negotiation protocol for this channel.

● The links between NXOS01 and NXOS02 should be grouped into Port-Channels 2. Both switches should initiate LACP negotiation and use LACP fast timers.

● The links between NXOS04 and NXOS02 should grouped together into Port-Channel 4. NXOS02 should initiate LACP negotiation and NXOS04 should respond.

● Disable all other interconnections between the switches.

3. Configure all of these port channels as 802.1Q trunk links. Create VLAN 10 on all switches.

4. Configure NXOS02 with an LACP priority of 16384 so that it is the preferred device for managing negotiation of its port channels.

5. Configure all switches to use source and destination TCP/UDP ports for load balancing flows across the port channel members.

6. Configure NXOS03’s link to Win Server and NXOS04’s link to SW in VLAN 10.

7. Win Server should use the IP address 10.0.0.1/24 and SW should use the IP address 10.0.0.2/24. When complete, Win Server and SW should have IP reachability to each other.

8. Keep saving your configuration using command “copy run start”

Configuration

feature lacp
!
vlan 10
!
port-channel load-balance src-dst l4port
!
Interface Ethernet1/1-32
shutdown
!
interface Ethernet1/3-4
switchport
switchport mode trunk
channel-group 1
no shutdown
!
interface port-channel1
switchport mode trunk
no shutdown
!
interface Ethernet1/7
switchport
switchport access vlan 10
no shutdown
!

NXOS04:

feature lacp

vlan 10
!
port-channel load-balance src-dst l4port
!
Interface Ethernet1/1-32
shutdown
!
interface Ethernet1/3-4
switchport
switchport mode trunk
channel-group 4 mode passive
no shutdown
!
interface port-channel4
switchport mode trunk
no shutdown
!
interface Ethernet1/8
switchport
switchport access vlan 10
no shutdown
!

NXOS01:

feature lacp

!
vlan 10
!
port-channel load-balance src-dst l4port
!
Interface Ethernet1/1-32
shutdown
!
interface Ethernet1/3-4
switchport
switchport mode trunk
channel-group 1
no shutdown
!
interface port-channel1
switchport mode trunk
!
interface Ethernet1/1-2
lacp rate fast
switchport
switchport mode trunk
channel-group 2 mode active
no shutdown
!
interface port-channel2
switchport mode trunk
!

NXOS02:

feature lacp
!
vlan 10
!
lacp system-priority 16384
!
port-channel load-balance src-dst l4port
!
Interface Ethernet1/1-32
shutdown
interface Ethernet1/3-4
switchport mode trunk
channel-group 1 mode active
no shutdown
!
interface port-channel1
switchport
switchport mode trunk
!
interface Ethernet1/1-2
lacp rate fast
switchport
switchport mode trunk
channel-group 2 mode active
no shutdown
!
interface port-channel2
switchport
switchport mode trunk
!

SW:

hostname SW
!
Interface Eth0/1
no switchport
ip address 10.0.0.2 255.255.255.0
no shutdown
!

Verification

Port channels in NX-OS, just like in Catalyst IOS and other platforms, require that the member interfaces first have compatible parameters for the channel to form. In NX-OS, these parameters can be verified with the command show port-channel compatibility-parameters. Some of these parameters can be seen below:

NXOS01# show port-channel compatibility-parameters | include \*

* port mode
* speed
* MTU
* MEDIUM
* Span mode
* load interval
* port Voice VLAN

Note: – In the topologies (not related to our topology), both M series and F series modules are present, because these modules have different port level capabilities, they are not compatible to channel together. In case you try to form a port channels on these incompatible modules, the NX-OS parser will detect this and return an error message if you attempt to channel together incompatible port types, as shown below:

%ETH_PORT_CHANNEL-3-COMPAT_CHECK_FAILURE: rate mode is not compatible

command failed: port not compatible [rate mode]

After the channels are successfully formed, the show port-channel summary output should indicate that the member links are “Up in the port-channel” with flag (P). This output also shows whether LACP negotiation was used or not.

NXOS01# show port-channel summary

Flags: D – Down P – Up in port-channel (members)
I – Individual H – Hot-standby (LACP only)
s – Suspended r – Module-removed
b – BFD Session Wait
S – Switched R – Routed
U – Up (port-channel)
p – Up in delay-lacp mode (member)
M – Not in use. Min-links not met
——————————————————————————–
Group Port- Type Protocol Member Ports
Channel
——————————————————————————–
1 Po1(SU) Eth NONE Eth1/3(P) Eth1/4(P)
2 Po2(SU) Eth LACP Eth1/1(P) Eth1/2(P)

NXOS02# show port-channel summary

Flags: D – Down P – Up in port-channel (members)
I – Individual H – Hot-standby (LACP only)
s – Suspended r – Module-removed
b – BFD Session Wait
S – Switched R – Routed
U – Up (port-channel)
p – Up in delay-lacp mode (member)
M – Not in use. Min-links not met
——————————————————————————–
Group Port- Type Protocol Member Ports
Channel
——————————————————————————–
1 Po1(SU) Eth LACP Eth1/3(P) Eth1/4(P)
2 Po2(SU) Eth LACP Eth1/1(P) Eth1/2(P)

NXOS03# show port-channel summary

NXOS04# show port-channel summary

Spanning-Tree Protocol should see the port channels as one logical link, as shown below. Separate channels that point the same direction in the spanning-tree, such as Port-Channels 1 and 2 below, are still subject to the normal forwarding and blocking rules.

NXOS01# show spanning-tree vlan 10

VLAN0010
Spanning tree enabled protocol rstp
Root ID Priority 32778
Address 5000.0001.0007
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 32778 (priority 32768 sys-id-ext 10)
Address 5000.0001.0007
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Interface Role Sts Cost Prio.Nbr Type
—————- —- — ——— ——– ——————————–
Po1 Desg FWD 3 128.4096 P2p
Po2 Desg FWD 3 128.4097 P2p

LACP neighbors of NXOS01 and NXOS02 should see that its System Priority (the first portion of the System ID) has been reduced to a more preferred value of 16384. The output below also shows whether the neighbor is running LACP in active or passive mode, and whether slow or fast LACP hellos are being used.

NXOS01# show lacp neighbor interface Po2

Flags: S – Device is sending Slow LACPDUs F – Device is sending Fast LACPDUs
A – Device is in Active mode P – Device is in Passive mode
port-channel2 neighbors
Partner’s information
Partner Partner Partner
Port System ID Port Number Age Flags
Eth1/1 16384, 50-0-0-2-0-7 0x101 811 FA
LACP Partner Partner Partner
Port Priority Oper Key Port State
32768 0x1 0x3f
Partner’s information
Partner Partner Partner
Port System ID Port Number Age Flags
Eth1/2 16384,50-0-0-2-0-7 0x102 812 FA
LACP Partner Partner Partner
Port Priority Oper Key Port State
32768 0x1 0x3f

To verify the configured load balancing method of the switches, use the show port-channel load-balance command, as seen below.

Note that on the Nexus the load balancing method can only be changed in the default VDC, as this change is chassis-wide between all VDCs.

NXOS03# show port-channel load-balance

System config:
Non-IP: src-dst mac
IP: src-dst l4port rotate 0
Port Channel Load-Balancing Configuration for all modules:
Module 1:
Non-IP: src-dst mac
IP: src-dst l4port rotate 0

NXOS01# show port-channel load-balance

System config:
Non-IP: src-dst mac
IP: src-dst l4port rotate 0
Port Channel Load-Balancing Configuration for all modules:
Module 1:
Non-IP: src-dst mac
IP: src-dst l4port rot

Configure the IP address on Win Server. Win Server and SW should have IP reachability to each other

banner image

Amar Singh

Amar Singh is a senior network security engineer and a certified trainer. He is currently working with a reputed organization based out of India. His accomplishments include CCNA, CCNP Security, CEH, Vmware, Checkpoint and Palo Alto Certifications. He is holding more than 12 years of experience in Network security domain. In his career he has ...

More... | Author`s Bog | Book a Meeting