Cisco Link Aggregation Traffic Through a PaloAlto Firewall
Resolution
In Virtual Wire mode, the Palo Alto Networks device can pass Cisco Link Aggregation Control Protocol traffic in vwire only when the links are not aggregated on the PAN-fw. In V-wire if the Links are aggregated then the firewall could forward the packets to the other ports in AE , that will cause the LACP to not come between peers.
Topology example
| Switch 1 Configuration | Switch 2 Configuration |
|---|---|
|
port-channel load-balance dst-ip interface Port-channel5 switchport access vlan 10 switchport mode access
interface GigabitEthernet0/1 switchport access vlan 10 switchport mode access channel-group 5 mode active ! interface GigabitEthernet0/2 switchport access vlan 10 switchport mode access channel-group 5 mode active ! interface GigabitEthernet0/3 switchport access vlan 10 switchport mode access ! |
port-channel load-balance dst-ip interface Port-channel10 switchport access vlan 10 switchport mode access !
interface GigabitEthernet0/13 switchport access vlan 10 switchport mode access channel-group 10 mode active ! interface GigabitEthernet0/14 switchport access vlan 10 switchport mode access channel-group 10 mode active ! interface GigabitEthernet0/15 switchport access vlan 10 switchport mode access ! |
Firewall configuration
This is the expected behavior in 7.1.x and 8.0.x
More information on 802.3ad link aggregation can be found on wikipedia's Link aggregation page.
owner: mchandrase