Disappointed: ASA 8.4 Redundant using Port-channels

So I finally got all our ASAs upgrade to version 8.4 and was all sorts of excited to configure port-channels to our 6500 + SUP7203B switches. I was severally disappointed to discover that I cannot configure two port-channels and have them be members of a redundant interface pair. It would seem like a logical topology.
Port-channel1 = Gig0/0 & Gig0/1
Port-channel2 = Gig0/2 & Gig0/3
Redundant1 = Port-channel1 & Port-channel2
Port-channel1 would connect to the primary 6500
Port-channel2 would connect to the backup 6500
What would it take to make this work? Am I going to have to wait for 8.5? Will we finally get BGP then too? (Had to get that in there)
http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/interface_start.html#wp1329357
EtherChannel Guidelines
•You can configure up to 48 EtherChannels.
•Each channel group can have eight active interfaces. Note that you can assign up to 16 interfaces to a channel group. While only eight interfaces can be active, the remaining interfaces can act as standby links in case of interface failure.
•All interfaces in the channel group must be the same type and speed. The first interface added to the channel group determines the correct type and speed.
•The device to which you connect the ASA 5500 EtherChannel must also support 802.3ad EtherChannels; for example, you can connect to the Catalyst 6500 switch.
•All ASA configuration refers to the logical EtherChannel interface instead of the member physical interfaces.
•You cannot use a redundant interface as part of an EtherChannel, nor can you use an EtherChannel as part of a redundant interface. You cannot use the same physical interfaces in a redundant interface and an EtherChannel interface. You can, however, configure both types on the ASA if they do not use the same physical interfaces.

Hello Yaplej,
Agree with you but unfortunetly this is not supported yet,
We migh need to wait some time before this desing can be accomplish,
Regards,
If you do not have any other question please mark the question as answered

Similar Messages

SAN Switch 9148 UPG procedure when using Port Channel

Hi,
I am kind of new to the UPG procedure of Cisco Switch, and the customer i am working with is using Port Channel.
Do i have to shutdown the port channel before executing the switch UPG or if everything can stay up? Will i lose connection when the UPG will proceed ?
If anyone has some documentation that describe the process, it would be much appreciated.
Thank you
Christian

Hi,
I am kind of new to the UPG procedure of Cisco Switch, and the customer i am working with is using Port Channel.
Do i have to shutdown the port channel before executing the switch UPG or if everything can stay up? Will i lose connection when the UPG will proceed ?
If anyone has some documentation that describe the process, it would be much appreciated.
Thank you
Christian

Design help related to ACE to Switch connectivity using Port-Channel

Hi,
I have a Cisco ACE 4710 configured in One-Arm mode. This ACE is getting connected with 2 3750 switches. These 2 3750 switches connected in trunk mode.
ACE is connected to these 3750 switches using Port-channel.
ACE Config:
================================
interface gigabitEthernet 1/1
description One-arm mode port to DMZ Switch 1 port 20
channel-group 1
no shutdown
interface gigabitEthernet 1/2
description One-arm mode port to DMZ Switch 2 port 20
channel-group 1
no shutdown
interface port-channel 1
switchport access vlan 51
port-channel load-balance src-dst-ip
no shutdown
interface vlan 51
ip address 10.40.56.131 255.255.255.128
access-group input everyone
access-group output everyone
nat-pool 1 10.40.56.215 10.40.56.215 netmask 255.255.255.255 pat
service-policy input LB
service-policy input remote-access
no shutdown
===========================================================
The problem is that 3750 switches are not stacked.
Application is working fine. But i am getting a lot of MAC flapping messages..
kindly suggest whether this design is OK or something needs to be done to rectify it...
Attached a small diagram..

Hello acharyr123,
I don't think this design is ok, and it would cause mac flapping since the two indepedendent 3750 switches will learn the ace mac addresses off of two different interfaces. The 3750s would have to be stacked so that they would act as one switch then this should work correctly.
Thanks
Joel Lamousnery
TAC CSE

Dlsw using port channel

I have 2 dlsw router at head quater office, named dlswA and dlswB.
From branches router, dlswA is a primary peer and dlswB is a backup peer.
Both dlswA and B have 2 fast ethernet interfaces.
The current configuration of dlswA and dlswB are 1 port as IP port and other port as sna/bridge port.
With this configuration the problem is when SNA port at dlswA problem, then dlsw circuit will have the problem, because dlsw peer from branches still connected to dlswA.
if I configure 2 fast ethernet port become a port channel. And configure IP and bridge group at port channel interface (IP and SNA at the same interfaces), so when the port channel is down, then branches will connect to dlswB as a backup peer
Are the port channel configuration will solve the problem ? How about the stability of this configuration?

Thank Matthias for your reply.
Both of head end routers are on the same vlan and the host is using same mac address.
As far as i know if from branch have 2 active peer with cost setup, there will loops posibility because both head end routers are using ethernet with same vlan and same host mac address.
I test the port channel within my LAB using netbios, seem works as expected. when single port at port channel down, branch circuit still remain at dlswA router, when all port channel member down, the branch peering move to dlswB.
Here are the config:
hostname dlswA
dlsw local-peer peer-id 192.168.255.1 promiscuous
dlsw bridge-group 1
interface Port-channel10
ip address 192.168.255.1 255.255.255.248
bridge-group 1
interface FastEthernet0/0
no ip address
duplex auto
speed auto
channel-group 10
interface FastEthernet0/1
no ip address
duplex auto
speed auto
channel-group 10
end
hostname dlswB
dlsw local-peer peer-id 192.168.255.10 promiscuous
dlsw bridge-group 1
interface Port-channel11
ip address 192.168.255.10 255.255.255.248
bridge-group 1
interface FastEthernet0/0
no ip address
duplex auto
speed auto
channel-group 11
interface FastEthernet0/1
no ip address
duplex auto
speed auto
channel-group 11
end
Hostname Branch
dlsw local-peer peer-id 172.16.0.1
dlsw remote-peer 0 tcp 192.168.255.1
dlsw remote-peer 0 tcp 192.168.255.10 backup-peer 192.168.255.1 linger 0
dlsw bridge-group 1
interface Loopback0
ip address 172.16.0.1 255.255.255.255
interface FastEthernet0/1
no ip address
duplex auto
speed auto
bridge-group 1
But I'm not sure this scenario will work for sna application like ATM machine, and SNA SAA gateway.
Please kindly advised, Is there any alternatif ?

Wlc 5508 get error when use port-channel

We have two wlc in the system 5508 and 4402.
we config HA for 2 wlc, both wlc enable LAG
When I connect 2 interface of 5508 to 2 interface (in a port channel mode on, trunk, dot1q) of a
couple of VSS switch, I cant management 5508 through web any more, and I still can do with 4402.
If I shutdown 1 port int the port-channel, it work well.
Do you know what happen ?
Thanks
Duyen

hi Scott,
We have VSS ( 2 x 6509) trunk with (2 switch 4506). one port of wlc4402 connect to one port of one swith 4506.
2 ports of wlc 5508 conect to 6509, each port connect to one switch 6509.
the config in VSS switch like this:
interface gig1/1/1
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 500 mode on
interface gig2/1/1
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 500 mode on
etherchannel load-balancer src-dst-ip
( I dont see this command in running config)

ASA port-channel command on IOS v. 9.0(4)

I have configured 2 of ASA 5550 on a port channel as follows:
=======================================
router# show version
Cisco Adaptive Security Appliance Software Version 8.4(2)
router# show module
0 ASA 5550 Adaptive Security Appliance         ASA5550            JMX1226L1S9
1 SSM-4GE Included with ASA 5550 System        SSM-4GE-INC        JAF1224ATNS
router# show interface Port-channel48
Interface Port-channel48 "", is up, line protocol is up
Hardware is EtherChannel/ON, BW 2000 Mbps, DLY 10 usec
    Auto-Duplex(Full-duplex), Auto-Speed(1000 Mbps)
    Input flow control is unsupported, output flow control is off
    Media-type configured as RJ45 connector
    Available but not configured via nameif
    MAC address 001f.ca97.44e2, MTU not set
    IP address unassigned
Members in this channel:
      Active:   Gi1/2 Gi1/3
router# show startup-config
interface GigabitEthernet1/2
channel-group 48 mode on
no nameif
no security-level
no ip address
interface GigabitEthernet1/3
channel-group 48 mode on
no nameif
no security-level
no ip address
interface Port-channel48
no nameif
no security-level
no ip address
interface Port-channel48.4
vlan 4
interface Port-channel48.5
vlan 5
After migrating to version 9.0(4) I could not configure channel group on int g 1/2.
=======================================
router# show version
Cisco Adaptive Security Appliance Software Version 9.0(4)
router# show module
0 ASA 5550 Adaptive Security Appliance         ASA5550            JMX1421L333
1 SSM-4GE Included with ASA 5550 System        SSM-4GE-INC        JAF1419ALAK
router# configure terminal
router(config)# interface GigabitEthernet1/2
router(config-if)# channel-group 48 mode on
                      ^
ERROR: % Invalid input detected at '^' marker.
router(config-if)# ?
So I have the following questions about verion 9:
1. Can I still use port-channels on a sigle ASA?
2. Should I replace port-channel by lacp command on a sigle ASA?
3. Does lacp command can be used only on clusters ?
Att.,
Rosa

The following is documented in the config guide for both 8.4 and 9.0:
•You cannot use interfaces on the 4GE SSM, including the integrated 4GE SSM in slot 1 on the ASA 5550, as part of an EtherChannel.
So, even with 8.4 it was probably never meant to work.

Port-channel issue with FI-N7k using rate-mode share

Hi Dears,
I'm trying to using port-channel between Fabric Interconnect (FI) and N7K. in N7K use rate-mode share and LACP but the port-channel in N7K was suspended.
I was trying :
1. I using non dedicated port in Nexus 7010.
      - rate-mode share
      - channel-group 1 mode active
      - switchport mode trunk
when i using this option, the port-channel in Nexus 7010 was suspended
2. I using non dedicated port in Nexus 7010
     - rate-mode share
     - channel group 1 mode on
     - switchport mode trunk
when i using this option, the port-channel in Nexus 7010 was came up, but in Fabric interconnect was failed.
3. I using dedicated port in Nexus 7010
     - rate-mode share
     - channel group 1 mode active
     - switchport mode trunk
when i using this option, the port-channel in Nexus 7010 was suspended
4. I using dedicated port in Nexus 7010
     - rate-mode dedicated
     - channel group 1 mode active
     - switchport mode trunk
when i using this option, the port-channel in Nexus 7010 was came up and running well.
is any other way to configure port-channel in N7K with rate-mode share and LACP ?
or it's some of limitation in port-channel when using rate-mode share at N7K ?
nb: fabric interconnect only support LACP and cannot be configurable.
regards,
Berwin H

HI Mark,
1. Can you please check your ethernet card ...where this port channel connected..on the server.
    may be there are 2 different card.
2. from cisco websites:
Error Message
Explanation
This port has different port attributes than other ports within the port channel.
Recommended Action
Match the port attributes to that of the port channel.
Regards
Please rate if it helps.
Match the port attributes to that of the port channel.This port has different port attributes than other ports within the port channel.
EC-5-CANNOT_BUNDLE_LACP: [char] is not compatible with aggregators in
channel [dec] and cannot attach to them ([char])

How to troubleshooting port channel in N7K

i find N5K
http://www.cisco.com/c/en/us/support/docs/switches/nexus-5000-series-switches/116199-technote-stp-00.html
i notice distribution switch has root guard block log
does it mean that looping has occured yesterday?
i use command below do not have yesterday record
show spanning-tree internal event-history tree 1 brief | in "2015:03:15 10"
first core is root switch
now port channel shutdown in first core and use port channel in second core. How can i see which problem has occurred in port channel ?
how to know which port has problem ?
how to know which vlan caused the problem ?
we notice one of access switch has lost config, will it affect the distribution layer switch?
i remember that yesterday i just get log with filezilla after configure notebook same vlan and same network with the testing access switch

Not sure if youre after the portchannel bandwidth or port-channel speed... If you really want to get an insight on the bandwidth usage, get SNMP on both sides, actively monitor the port channel and interfaces (real time by frequent polling)
And you could get two endpoints @ 10 gb nics that are bundled, then 'thrash' the link, end to end. I use iperf, you could use big ftp transfers to test and see what performance is. You'll get the rate / speed in which the links are operating 'end to end'
It may mean that the ports are @10gb full duplex, but the overall bandwidth is 20gb
Sent from Cisco Technical Support iPhone App

Port-channel Problem between Fabric Interconnect and N7K vPC

Dear all,
I have a problem with Port-channel Uplink between Fabric Interconnect with N7K using vPC
This is my network topology for UCS Deployment
In N7K I has configured vPC for red link and green link, at Fabric Interconnect A I has configured Port-Channel with member is Port 1 and Port 2, uplink is red link. At Fabric Interconnect B, I has configured Port-Channel with member is Port 1 and Port 2, uplink is green link.
The show interface port-channel on N7K is good, every port-channel is up and have all member. But At Fabric Interconnnect, when I see on UCS Manager, the status of Port-Channel on Fabic A and Fabric B is fault with Additional Info: No operational member. Although all link is link up and I has status of Port-Channel is enable on UCS Manager. When I see the Properties of Port 1, Port 2 on Port-channel, I see the membership status is : individual. This mean port-channel is not up and no membership in this configuration. I want to using port-channel for load balance and plus more bandwidth for uplink to 20Gig. I don't understand why ?
Please help me resolve this problem, I has send the capture screen of UCS Manager when I show status of Port-channel and Port-member in port-channel in attach items.
Anyone can help me to resolve this, thanks you very much. Please reference attach items for more detail about fault.
Thanks,
Trung.

Thanks Matthew very much,
I has resolved this problem. The reason of problem is miss match protocol of port-channel between N7K and Fabric Interconnect. The Fabric Interconnect always use LACP protocol, but N7K using Port-channel mode on, that why the port-channel failed. I has configured LACP for port-channel in N7K, it has resolved the problems.
Thanks,
Trung.

FEX-2232 FCoE Port channel limitation

Hi all,
i havea single FEX 2232 single homed to nexus 5020 via port-channel. at the FEX 2232, i connected a server which have 2 X CNA and running two vlans: vlan 200 for ethernet and vlan 300 for FCoE.
i connected the server to the single fex via port-channel and allowed vlan 200 & 300. at the N5K i bounded single vfc interface to this port-channel.
when i am issuing the show flogi database i see only single PWWN.
as i understand, a single vfc interface can only see single PWWN, is this correct ?
if it does, how can i have my setup running in a way that ethernet traffic will used port-channel and for fcoe traffic i will see two PWWN ?
please advise,
Avi.

It is not necessary to create another FCoE Vlan if the logins are coming on the same n5k. If there is a requirement for multiple fcoe logins on the same n5k, then it will need to be single link port channels instead of multiple links in the port channel. That way we acquire the ability to bind each physical port via port-channel into a separate vfc. In your case ideally you can have two n5ks with two n2232s single homed to each n5k and the server dual homed with 1 port each connected to two separate 2232s in active-active teaming. That way you can bind the physical interfaces into single virtual port channel on the respective n5ks. at that point, you can separate the san traffic into different vsan/vlan and make sure you dont trunk the fcoe vlan over the vpc peer link.
Hope this helps, Vinayak.

Nexus - port-channel load balancing

Port-channel load balancing is a global command or interface command in Nexus switch?
Thanks,
Manu

Hi,
It's a global command; port-channel load-balance ethernet.
You can find details in the Configuring Load Balancing Using Port Channels section of the Nexus 5500 Series NX-OS Interfaces Configuration Guide.
Regards

UCS: Migrating network to port channels

Hello all,
I've searched around for the answer, so forgive me if this question is has already been answered and I just missed it.
The short and skinny is that because of the need to have a disjointed L2 network, without changing from EHM to Switch mode and on top of security polices (the two L2 networks are Corporate and DMZ), it was recommended that we switch to using port channels.
Right now, I have two UCS 6120s in a cluster. Each 6120 has two uplinks to a pair of Cisco 4948s, configured as standard trunk uplinks.
I guess the actual question(s) is
A) Can this be done without bringing down the entire network for the UCS?
B) If it can, what is the best way to do it without interruption?
I've searched for around and the only thing I've seen is the steps to make the changes in the UCS Manager, but from what I can tell it assumes it’s a new install of UCS and not something that's already in production.
I already had the networking guys set up the port channels on two unused ports on the 4948s, so all I need to do is move the cables and setup the port channel in the UCSM.
My plan of action is as follows:
- disable the network uplinks on one of the 6120s, this should force all traffic to the other side (is that correct?)
- move the network cables coming from the 6120 to the 4948 switche to the new ports set up as a port channel
- create the port channel in the UCS manager
- Enable uplink ports and enable port channel
- Re-do the above steps for the other 6120.
Is the above possible without causing an interruption? Also during the transition, will there be a problem where one side is using a port channel and the other side is still using the regular trunk uplinks?
Thanks for any suggestions or help.
(This was neither short nor skinny)

If you need setup UCS for disjointed L2 and you only have 2 LAN uplinks you are not going to be able to place those 2 into a port-channel and also be able to configure disjointed L2.
Are you adding 2 additional uplinks to the ones you already have?
If you aren't planning on adding 2 additional uplinks then you will need to use them as single links; 1 with corporate VLANs mapped and the other with DMZ VLANs mapped. You will do this for both Fabric Interconnect A and B so that each Fabric interconnect as 1 uplink for corporate and 1 for DMZ.
This configuration requires UCS firmware 2.x
Like you are planning you will do this on 1 fabric at a time.
On Fabric A disable the 2 LAN uplinks so that all traffic is forced to go out Fabric B
Use the UCS VLAN Manager to map the DMZ VLANs to the DMZ uplink and the corporate VLANs to the corporate uplink. You can SSH into UCS, type "connect nxos a" and type "show interface trunk" to verify the VLANs are mapped properly
Make sure the 4948 switch is configured to trunk the correct VLANs over the correct links
Enable the ports on Fabric A
Do the same for Fabric B

Port-channel L2 problem with Fabric Interconnect and Nexus 7010

Hi,
i using port-channel from both fabric interconnect to N7k with 3 cables per Fabric Interconnect.
but, my problem is when i creating port-channel, Fabric Interconnect don't support mode ON dan rate-mode share in Interface 10G Nexus 7010.
I was trying :
1. I using non dedicated port in Nexus 7010.
      - rate-mode share
      - channel-group 1 mode active
      - switchport mode trunk
when i using this option, the port-channel in Nexus 7010 was suspended
2. I using non dedicated port in Nexus 7010
     - rate-mode share
     - channel group 1 mode on
     - switchport mode trunk
when i using this option, the port-channel in Nexus 7010 was came up, but in Fabric interconnect was failed.
3. I using dedicated port in Nexus 7010
     - rate-mode share
     - channel group 1 mode active
     - switchport mode trunk
when i using this option, the port-channel in Nexus 7010 was suspended
4. I using dedicated port in Nexus 7010
     - rate-mode dedicated
     - channel group 1 mode active
     - switchport mode trunk
when i using this option, the port-channel in Nexus 7010 was came up and running well.
but, the problem is my costumer do not want using a dedicated rate-mode. if i using dedicated mode the only available port is 8 interfaces instead of 32 ports. i want to using rate-mode share in nexus 7010.
is there any way to configuring port-channel using mode on in fabric interconnect ? i was trying using CLI to create port-channel in Fabric interconect but i cannot configure the channel group protocol.
i attach the topology of N7K with Fabric interconnect.
regards,
Berwin H

Hi Manish,
the issue was solved, i was fix it last week.
the solution is:
i enable the license grace-priode (since my license is Enterprise so cannot create VDC) then i create a VDC (ex: VDC 2) so i allocate the interface on all module
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
mso-para-margin-top:0cm;
mso-para-margin-right:0cm;
mso-para-margin-bottom:10.0pt;
mso-para-margin-left:0cm;
line-height:115%;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;
mso-bidi-font-family:"Times New Roman";
mso-bidi-theme-font:minor-bidi;}
N7K-M132XP-12 to VDC 2. after that i delete VDC 2 then all interface back to VDC 1 (default vdc). then i enable the rate-mode share in dedicated port and bundle into port-channel and its working.
i dont know why it must move to VDC first then it will working, maybe cisco can explain the reasons.
So here the result of my port-channel :
SVRN7KFARM-HO-01# show port-channel summary
Flags: D - Down        P - Up in port-channel (members)
        I - Individual H - Hot-standby (LACP only)
        s - Suspended   r - Module-removed
        S - Switched    R - Routed
        U - Up (port-channel)
Group Port-       Type     Protocol Member Ports
      Channel
1     Po1(SU)     Eth      LACP      Eth1/1(P)    Eth1/2(P)    Eth1/3(P)
                                     Eth1/4(P)    Eth1/25(P)
2     Po2(SU)     Eth      LACP      Eth1/9(P)    Eth1/10(P)   Eth1/11(P)
                                     Eth1/12(P)   Eth1/26(P)
3     Po3(SU)     Eth      LACP      Eth1/17(P)   Eth1/18(P)
4     Po4(SU)     Eth      NONE      Eth10/32(P) Eth10/34(P) Eth10/35(P)
                                     Eth10/36(P)
Thanks.
Berwin H

Port-channel configuration 3560X and 2960S

Hello,
I am trying to connect a 2960 swith to 3560X using port channel. I have configred the switches with the following configratuion and connected them with straight ethernet cable, the link came up and then it went int err-disable state. I re-enabled the links and connected them using one cross over cable it connected and remained connected for a whole day in my lab. When I shut down both switches and took them the server room and connected both ports using cross over cable it came up and then went into err-disable state. Bellow is my configuration, can you please point out to me what I am missing: (no VTP domain configured on any of the switches)
------------------2960 configuration----------------------
interface Port-channel1
switchport trunk native vlan 999
switchport mode trunk
interface GigabitEthernet1/0/51
switchport trunk native vlan 999
switchport mode trunk
channel-group 1 mode on
interface GigabitEthernet1/0/52
switchport trunk native vlan 999
switchport mode trunk
channel-group 1 mode on
------------------3560X configuration-------------------------------
interface Port-channel1
switchport trunk encapsulation dot1q
switchport trunk native vlan 999
switchport mode trunk
interface GigabitEthernet0/23
switchport trunk encapsulation dot1q
switchport trunk native vlan 999
switchport mode trunk
channel-group 1 mode
interface GigabitEthernet0/24
switchport trunk encapsulation dot1q
switchport trunk native vlan 999
switchport mode trunk
channel-group 1 mode on
Thank you.

Hi,
Your condig looks good and straightthrough cable should work just fine. Can you do the following:
take the interfaces out of the portchannel
shut the portchannel
shut the interfaces
add the interfaces to the portchannel
"no sh" the PO and test again?
This should bring up the interface and the portchannel
HTH

About MDS 9222i config port-channel

dear everyone~
in project ,i need config MDS 9222i use 4 FCIP interface connect to 7606S 4 GE port for port-channel feature,but in MDS9222i i use port-channel commad ,cannot run。
how can i config it？
thinks~

Hi Sun,
Ethernet PortChannels are not supported on MSM-18/4 modules and 9222i IPS modules.
You can place the fcip interfaces in a fibre channel port-channel instead.
Regards,
David

Disappointed: ASA 8.4 Redundant using Port-channels

Similar Messages

Maybe you are looking for