Cisco EtherChannel: PAgP vs LACP Configuration

EtherChannel bundles up to eight physical links into one logical port-channel, multiplying bandwidth between switches while STP treats the bundle as a single port. Cisco gives you three ways to build it: PAgP (Cisco-proprietary negotiation), LACP (IEEE 802.3ad, multi-vendor) and static mode on. This guide configures each on a Catalyst switch, explains the mode combinations that actually work, and reads the show output that confirms a healthy bundle.

Why Bundle Links at All

A single 1G uplink between two access switches saturates long before the traffic profile says it should. The obvious fix — plug in a second cable — does not work on its own, because Spanning Tree Protocol (STP) sees the second link as a redundant path and blocks it. You get a hot standby, not extra bandwidth. EtherChannel solves both problems at once: the member links are presented to STP as a single logical interface, so all of them stay in the forwarding state, and the switch hashes each frame across the members based on a configurable algorithm.

Three properties make a port-channel worth the configuration effort:

• Aggregated bandwidth — four 1G links become a 4G logical pipe for traffic that hashes across them.
• Link resilience — if one member fails, the bundle stays up, the MAC address table is not flushed, and STP does not reconverge. Failover is typically sub-second, far faster than STP.
• Simpler topology — one logical link to manage, monitor and describe in documentation than four parallel cables.

The important caveat: aggregation increases aggregate capacity, not the speed of any single flow. A single TCP session hashes to exactly one member link, so it still travels at 1G. If your workload is one elephant flow, EtherChannel will disappoint you; if it is many flows, it will not.

Choosing the Protocol

• PAgP — Cisco-only. Modes: desirable (actively negotiates) and auto (waits passively).
• LACP — open standard. Modes: active (sends PDUs) and passive (responds only). Use it when the far end is not Cisco.
• Mode on — no negotiation at all; both ends must be configured on manually.

Compatibility rules: active↔active, active↔passive and desirable↔auto/desirable work; passive↔passive and auto↔auto never bundle. Before bundling, make the member ports identical — duplex, speed, native/access VLAN, allowed VLANs and switchport mode.

PAgP Modes and Compatibility

Port Aggregation Protocol is Cisco's original aggregation protocol. It sends its own PDUs over the member links and will only bundle a port if the far end speaks PAgP too. Two modes exist:

• desirable — the port actively sends PAgP packets and asks the neighbor to form a bundle. Both sides may be desirable.
• auto — the port listens for PAgP packets but never initiates. It is passive, not disabled: it will bundle when a desirable neighbor asks.

The matrix is small and unforgiving. Desirable + desirable works. Desirable + auto works. Auto + auto never works — both ends sit waiting for the other to start. And a PAgP mode paired with a static on port does not work either, because one side negotiates and the other refuses to.

LACP Modes and Compatibility

IEEE 802.3ad Link Aggregation Control Protocol does the same job with a standards-based PDU and an additional capability: it distinguishes active members from standby members. Up to eight ports can be configured in an LACP channel, but only eight can be active; the rest become hot-standby. If an active link fails, a standby member is promoted into the bundle rather than the traffic being hashed across fewer links.

• active — sends LACP PDUs. Two active ports come up fastest.
• passive — responds to PDUs only. Useful when you want the switch to be the non-initiating side, for example toward a server that prefers to drive negotiation.

Active + active and active + passive both form a bundle. Passive + passive does not. LACP is also the only one of the two protocols that gives you per-port administrative control through lacp port-priority, which decides which links become active when more than eight are configured.

Static Mode on: When It Makes Sense

Setting channel-group 1 mode on skips negotiation entirely. The ports are forced into the bundle on both ends. This is the mode you use when the neighbor does not implement LACP or PAgP at all — some older servers, some blade chassis, and some third-party appliances fall into this bucket.

Understand the trade-off before you reach for it. Negotiation exists to catch exactly the mistakes that manual bundling hides: a cable plugged into the wrong switch, a port in the wrong channel-group, one side misconfigured. With on, those mistakes produce a loop or a black-holed path instead of a paused port. Cisco's own documentation warns about this, and the recommendation is to use LACP wherever the far end supports it. Static mode is a compatibility fallback, not a performance choice.

Prerequisites Before You Bundle

A port must be fully compatible with the other ports in its channel-group before it can be bundled. Check these on every member before you apply channel-group:

• Speed and duplex — mismatched members are refused. Disable autonegotiation drift by hard-setting speed and duplex on both ends where the platform allows it.
• Switchport mode — access vs trunk must match.
• Native VLAN — a native VLAN mismatch across members is a classic silent failure.
• Allowed VLAN list — allowed VLANs must be identical on every member.
• STP configuration — same STP mode and PortFast state; never enable PortFast on a port that will be a bundle member toward another switch.
• MTU and QoS policy — on many platforms a member with a different MTU will not join.

Configure the surviving shared parameters on the Port-channel interface, not on the members. Cisco IOS will propagate a small set of parameters from the port-channel to the members, but the reverse is not reliably true, and mixing the two is the source of a lot of "it half-works" bundles.

Configuring LACP EtherChannel

SW1(config)# interface range GigabitEthernet0/1-2
SW1(config-if-range)# channel-group 1 mode active
SW1(config-if-range)# exit
SW1(config)# interface port-channel 1
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk allowed vlan 10,20

The channel-group command creates Port-channel1 automatically; the logical interface then carries the VLAN configuration. PAgP uses mode desirable and static uses mode on — everything else is identical.

Configuring PAgP EtherChannel

SW2(config)# interface range GigabitEthernet0/1-2
SW2(config-if-range)# channel-group 1 mode desirable
SW2(config-if-range)# switchport trunk encapsulation dot1q
SW2(config-if-range)# switchport mode trunk
SW2(config-if-range)# exit
SW2(config)# interface port-channel 1
SW2(config-if)# switchport trunk allowed vlan 10,20,30
SW2(config-if)# spanning-tree link-type point-to-point

The far switch in this example would be configured mode auto or mode desirable. Anything else and the channel never comes up. Note the PAgP timers: a desirable port retries continuously, but a neighbor that has been quiet still takes a few seconds to be declared gone.

Configuring Static EtherChannel

SW1(config)# interface range GigabitEthernet0/3-4
SW1(config-if-range)# channel-group 2 mode on
SW1(config-if-range)# exit
SW1(config)# interface port-channel 2
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 100
SW1# show etherchannel 2 summary | include on

Static mode is the one case where a member link that is physically up but logically wrong still forwards traffic. There is no PDU exchange to catch the error, so verify with show etherchannel summary immediately after configuring both ends, not hours later.

Verifying the EtherChannel

SW1# show etherchannel summary
SW1# show etherchannel 1 port-channel
SW1# show interfaces GigabitEthernet0/1 etherchannel
SW1# show lacp neighbor
SW1# show pagp neighbor

Read the flags in show etherchannel summary: P means bundled in the port-channel, I stand-alone, s suspended, H hot-standby (LACP only). Healthy output shows Po1(SU) with both members (P); the per-interface command confirms the negotiated mode, e.g. Protocol = LACP.

Load Balancing

The hashing algorithm decides how frames spread across members — choose it to match your traffic profile. L3-heavy traffic wants IP hashing; L2 forwarding environments may prefer MAC-based:

SW1(config)# port-channel load-balance src-dst-ip
SW1# show etherchannel load-balance

Options include src-ip, dst-mac, src-dst-mixed-ip-port (default on many platforms) and VLAN-aware variants. Same-vendor bundles can also use PAgP's pagp port-priority to influence member selection; LACP equivalents exist under lacp port-priority.

LACP System Priority, Port Priority and Hot Standby

SW1(config)# lacp system-priority 100
SW1(config)# interface GigabitEthernet0/1
SW1(config-if)# lacp port-priority 100
SW1# show lacp sys-id

LACP elects an aggregation actor by comparing system priority (lower wins), then the system MAC. The elected switch's port priorities decide which member ports become active when more than eight are configured. Lower port priority means more likely to be active. This gives you a deterministic way to keep specific links as standby and to make the bundle behave predictably across a reload — worth setting explicitly on production bundles rather than leaving to MAC-address luck.

The same knobs exist on Cisco's data-centre platforms, where the aggregation technologies differ in name but not in principle — see Cisco NX-OS vPC configuration for the Nexus equivalent built on the port-channel concept.

Troubleshooting: Why a Bundle Fails to Form

Almost every broken EtherChannel falls into one of a handful of buckets. Work through them in order:

1. Mode mismatch. Run show etherchannel summary on both ends. I (stand-alone) on one side and P on the other is the signature of incompatible modes.
2. Member parameter mismatch. show interfaces GigabitEthernet0/1 etherchannel prints the compatibility table for speed, duplex, VLANs, port mode and MTU. The first line that says "not compatible" is your answer.
3. Channel-group mismatch. Two ports bundled into different groups produce two half-bundles instead of one. Check show running-config interface range.
4. PDU blocked. A filter, ACL or a mid-path converter that drops multicast frames at 01:80:C2:00:00:02 (LACP) or 01:00:0C:CC:CC:CC (PAgP/CDP) will break negotiation. This shows up in packet captures but never in the config.
5. Unidirectional link. One fibre strand down leaves the link physically "up" while one direction is dead — a classic case where UDLD aggressive mode belongs on the bundle members to err-disable the port instead of black-holing traffic.
6. Hardware/SPAN limitation. Some low-end platforms cap the number of ports in a bundle or refuse to bundle ports that are members of an assigned SPAN session.

If members are up but not bundling, capture the negotiation in both directions before changing anything. Changing configuration randomly is how a single-link problem becomes a three-switch outage.

Common Mistakes

• Members with different speeds/duplex or VLAN config — the bundle refuses to form.
• Mode mismatch — one side active, the other on never negotiates.
• Putting member ports in different channel-groups.
• Configuring VLANs on the members instead of the port-channel, then wondering why a reload changes the behaviour.
• Enabling PortFast on bundle members facing another switch, which risks a transient loop during convergence.
• Assuming a bundle gives one flow more than one member's bandwidth.

FAQ

Can I mix LACP and PAgP on the same port-channel? No. One protocol per channel-group, and the far end must speak it.

How many links can I bundle? Eight active members per channel on most Catalyst platforms. LACP lets you configure more than eight with the surplus in hot-standby; PAgP and static mode cap at eight outright.

Do the members have to be contiguous ports? No, but contiguous ports on the same ASIC reduce the chance of an internal fabric bottleneck and make the cabling documentation sane. Cross-stack EtherChannel on a StackWise stack is supported and useful, though it moves traffic over the stack ring.

What happens if I change the load-balance algorithm live? The switch rehashes, which usually causes a brief burst of out-of-order delivery. Change it in a maintenance window.

Is a port-channel faster to converge than STP? Yes — member failure is handled entirely inside the bundle, with no STP topology change and no MAC table flush.

EtherChannel on Cisco mirrors what other vendors call link aggregation — compare with Arista EOS port-channels and Dell OS10 VLT when you operate multi-vendor fabrics. Linux hosts use the same 802.3ad standard, and Linux bonding modes explains how the host side of that negotiation works.

原文链接：https://networklessons.com/switching/etherchannel-cisco-ios-catalyst-switch