cisco 端口汇聚.doc

SA与Cisco 端口聚合配置案例这些日子在一个用户那边部署的时候碰到Cisco交换机和SA端口汇聚，折腾了一番才找到了解决方法，拿出来跟大家一起分享，以免后续碰到类似的问题时别在浪费时间了。拓扑拓扑比较简单，如下图所示。Cisco交换机上配置interface Port-channel1switchport access vlan 10switchport mode access!interface GigabitEthernet1/0/1switchport access vlan 10switchport mode accesschannel-group 1 mode on!interface GigabitEthernet1/0/2switchport access vlan 10switchport mode accesschannel-group 1 mode on!interface Vlan10ip address !SA上面的配置interface aggregate1zonetrustip address manage pingmanage httpsexitinterface ethernet0/9aggregate aggregate1exitinterface ethernet0/10aggregate aggregate1exit测试结果:两边互相ping对方地址,任意一条线路断开都不会丢包Cisco交换机上的测试Switch#01:19:17: %SYS-5-CONFIG_I: Configured from console by consoleping Protocol ip: Target IP address: % Bad IP addressSwitch#ping Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to , timeout is 2 seconds:!Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 msSwitch#ping Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to , timeout is 2 seconds:!Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/9 msSwitch#01:19:36: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/2, changed state to down01:19:37: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/2, changed state to downping Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to , timeout is 2 seconds:!Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 msSwitch#ping Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to , timeout is 2 seconds:!Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 msSwitch#01:19:52: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/2, changed state to up01:19:53: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/2, changed state to up01:19:57: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/1, changed state to down01:19:58: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/1, changed state to downSwitch#ping Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to , timeout is 2 seconds:!Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/8 msSwitch#ping Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to , timeout is 2 seconds:!Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 msSwitch#ping Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to , timeout is 2 seconds:!Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 msSwitch#01:20:16: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/1, changed state to up01:20:17: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/1, changed state to upSwitch#ping Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to , timeout is 2 seconds:!Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 msSwitch#SA上的测试sa# ping Sending ICMP packets to Seq ttl time(ms) 1 255 0.492 2 255 0.471 3 255 0.477 4 255 0.465 5 255 0.478 6 255 0.476 7 255 0.467 8 255 0.488 9 255 0.475 10 255 0.488 11 255 0.475 12 255 0.498 13 255 0.493 14 255 0.471 15 255 1.22 16 255 0.478 17 255 0.468 18 255 0.466 19 255 0.486 20 255 1.62 21 255 0.488 22 255 0.481 23 255 0.465 24 255 0.472 25 255 0.462 26 255 0.463 27 255 0.486 28 255 0.491 29 255 0.485 statistics: 29 packets sent, 29 received, 0% packet loss, time 28000msrtt min/avg/max/mdev = 0.462/0.543/1.625/0.246 mssa# 2007-08-27 21:51:21, CRITNET: interface ethernet0/10 turn to physical down2007-08-27 21:51:31, CRITNET: interface ethernet0/10 turn to physical up2007-08-27 21:51:34, CRITNET: interface ethernet0/9 turn to physical down2007-08-27 21:51:42, CRITNET: interface ethernet0/9 turn to physical up原理分析1、Cisco交换机的端口汇聚功能支持三种协议pagp、lacp和端口强制（不带任何协议），其中pagp是Cisco专有协议，lacp和端口强制是802.3ad标准中的东东。2、咱们的SA上只支持802.3ad标准中的端口强制方式。3、当SA和Juniper、华为交换机、华三交换机、Fortinet端口汇聚互联时，对端的配置都需要配置成端口强制方式才能实现连通。BTW：由于SA采用的交换芯片功能限制的原因，我们的SA最多支持4个物理端口汇聚。其他信息在Cisco交换机上把另外一接口GigabitEthernet1/0/3加入到channel-group 1时。interface GigabitEthernet1/0/3switchport access vlan 10switchport mode accesschannel-protocol lacpSwitch(config-if)# channel-group 1 mode on Command rejected (Channel protocol mismatch for interface Gi1/0/3 in group 1): the interface can not be added to the channel groupSwitch(config-if)# channel-group 1 mode ?active Enable LACP unconditionally LACP的主动模式auto Enable PAgP only if a PAgP device is detected PAgP的自动模式desirableEnable PAgP unconditionally PAgP的强制模式on Enable Etherchannel only 无协议的强制模式（我们需要的）passive Enable LACP only if a LACP device is detected LACP的被动模式Switch(config-if)# channel-group 1 mode active Command rejected (Channel protocol mismatch for interface Gi1/0/3 in group 1): the interface can not be added to the channel groupSwitch(config-if)#no channel-protocollacpSwitch(config-if)#channel-group 1 mode onSwitch(config-if)#channel-protocol lacp Command rejected (the interface Gi1/0/3 is ): is already part of a channel with a different type of protocol enabled当GigabitEthernet1/0/1与GigabitEthernet1/0/2都配