What are the Maximum Aggregate Interfaces (802.3ad) Supported on Palo Alto Networks Firewalls?
Environment
Palo Alto Firewalls.
PAN-OS 9.1 and below.
Aggregated interfaces.
Resolution
The following table lists the maximum aggregate interfaces supported by the Palo Alto Networks firewalls. All members of an aggregate interface must be of the same type and speed.
Note: The number of aggregated interface is increased on some platforms in PAN-OS 10.0 & higher. Refer Aggregate capacity group increase.
Maximum Aggregate Interfaces by Platform
Platform
Maximum Aggregate Interfaces
PA-7080 PA-7050
8
PA-5060 PA-5050 PA-5020
8
PA-3060 PA-3050 PA-3020
8
PA-850 PA-820
6
PA-500
4
PA-220
4
PA-200
Not Supported
VM-50 VM-100 VM-200 VM-300 VM-500 VM-700 VM-1000
Not Supported
Load Distribution Algorithm
The session ID is used to select the port and a simple IP modulo to load balance.
Even session IDs are sent to one port and Odds session IDs to another port, if the link aggregation group (LAG) has 2 ports.
The last 3 bits of session ID is used to distribute the flows into the outbound port. For example, with 3 bits 8 unique ports can be identified (max ports supported in an aggregate ethernet group).