EtherChannel with LACP — bundling four links into one Port-channel

You’ve cabled two switches with four gigabit uplinks for redundancy. You look at STP and realize three of those four cables are blocking — sitting idle in case the fourth fails. Waste of copper.

That’s what EtherChannel fixes. It bundles multiple physical links into a single logical interface (a Port-channel). STP now sees one link, not four. All four cables forward simultaneously — quadrupling your uplink bandwidth from 1 Gbps to 4 Gbps.

It’s one of the highest-value features on the CCNA. Cheap to configure, dramatic effect, and it comes up in real production the day you graduate.

The mental model

Imagine two switches: A and B. You cable them together with links g0/1 through g0/4. Without EtherChannel, STP sees four separate links between the same two switches, decides there’s a loop, and blocks three of them. Traffic uses only one link.

With EtherChannel, you tell both switches: “these four physical interfaces are actually one logical Port-channel interface.” STP now sees one bundle, not four. No blocking. All four forward. Load-balanced based on a hash of source/destination.

If any single physical link fails, the Port-channel keeps forwarding on the remaining three. STP doesn’t reconverge. Traffic doesn’t hiccup. You just lose ~25% of the bandwidth for that bundle until the physical link is repaired.

LACP vs PAgP vs static

There are three ways to form the bundle:

• LACP (Link Aggregation Control Protocol, 802.3ad) — open IEEE standard. Works between Cisco and non-Cisco. Use this by default.
• PAgP (Port Aggregation Protocol) — Cisco-proprietary predecessor. Still works between two Cisco switches. Legacy.
• Static / “on” — no negotiation. Both sides just declare “we’re a bundle.” Fastest to bring up, but no protection: if one side accidentally goes back to single-link, the other side still thinks it’s bundled and traffic goes into a loop.

Modern default: LACP. Use PAgP only if a specific box needs it. Use static only in tightly-controlled labs where you know exactly what’s on both ends.

The mode combinations that actually form a bundle

This is CCNA gold. Each side of an EtherChannel is configured with a mode:

For LACP:

Mode	Behavior
active	Actively sends LACP packets to form a bundle
passive	Only responds if the other side is active

For PAgP:

Mode	Behavior
desirable	Actively sends PAgP packets to form a bundle
auto	Only responds if the other side is desirable

For static:

Mode	Behavior
on	Force bundle up. No negotiation.

Which combinations form a bundle?

• LACP: active/active ✓, active/passive ✓, passive/passive ✗ (both waiting).
• PAgP: desirable/desirable ✓, desirable/auto ✓, auto/auto ✗.
• Static: on/on ✓. Everything else with on breaks.

Mixing protocols is a hard no. on and active on opposite sides → nothing forms. active and desirable → nothing forms.

Exam question you will see: “Switch A is passive, Switch B is passive. Does the channel form?” — No. Both are waiting.

The config — LACP active on both sides

On both switches:

S1(config)# interface range g0/1 - 4
S1(config-if-range)# channel-group 1 mode active
S1(config-if-range)# switchport mode trunk
S1(config-if-range)# switchport trunk allowed vlan 10,20,30

That creates Port-channel1 on S1. Do the exact same thing on S2, and the bundle forms.

Every physical interface in the bundle must have identical config:

• Same speed (all 1 Gbps, or all 10 Gbps)
• Same duplex
• Same switchport mode (access or trunk)
• Same allowed VLAN list (if trunk)
• Same STP settings

If any of those differ, the bundle refuses to form. show etherchannel summary will report the ports as H (bundle-not-formed) or s (suspended).

Load balancing — hash-based, not round-robin

EtherChannel does not send packet-1 out link-1, packet-2 out link-2 (round robin). Instead, it hashes some fields of each frame and picks a link based on the hash.

Default hash is source MAC on lower-end switches, source-dest MAC or IP on higher-end. You can change it:

S1(config)# port-channel load-balance src-dst-ip

The choice of hash matters. If your traffic pattern is “one client talking to one server,” all packets hash to the same value and go over the same physical link. You get 1 Gbps of the 4 Gbps bundle. To load-balance well, use src-dst-ip when clients are talking to many servers, and src-dst-port when a client-server pair generates many different port combinations.

Load-balancing does not mean each link gets exactly 25% of traffic. It means: over many flows, the aggregate distributes across links. A single elephant flow does not get split.

Physical requirements

• 2 to 8 ports per bundle. More than 8 is unusual and requires specific hardware.
• Same speed and duplex. You cannot mix 1G and 10G in the same bundle.
• Same media type where possible. Copper and fiber can technically coexist but not recommended.

The show commands

S1# show etherchannel summary
Flags:  D - down        P - bundled in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        R - Layer3      S - Layer2
        U - in use      f - failed to allocate aggregator
        M - not in use, minimum links not met
        u - unsuitable for bundling
        w - waiting to be aggregated
        d - default port
        A - formed by Auto LAG

Number of channel-groups in use: 1
Number of aggregators:           1

Group  Port-channel  Protocol    Ports
------+-------------+-----------+-----------------------------------------------
1      Po1(SU)       LACP        Gi0/1(P) Gi0/2(P) Gi0/3(P) Gi0/4(P)

The critical characters:

• Po1(SU) — Port-channel 1 is Switching (S) and Up-in-use (U). Good.
• Gi0/1(P) — this physical port is Bundled in the Port-channel. Good.
• Gi0/1(H) — Hot-standby (LACP), waiting to activate.
• Gi0/1(s) — suspended. Mismatch somewhere.
• Gi0/1(I) — stand-alone. Wasn’t able to negotiate.

If any port is s or I, run show interfaces g0/1 etherchannel — the debug output tells you exactly which parameter mismatched.

Layer 2 vs Layer 3 EtherChannel

Everything above is Layer 2. On routers or L3-switches, you can also make a Layer 3 EtherChannel — a Port-channel with an IP address instead of a switchport.

Router(config)# interface port-channel 1
Router(config-if)# no switchport
Router(config-if)# ip address 10.0.0.1 255.255.255.252
Router(config)# interface range g0/1 - 2
Router(config-if-range)# no switchport
Router(config-if-range)# channel-group 1 mode active

Use case: two routers with 2 × 10 Gbps between them, want 20 Gbps of routed capacity.

Common mistakes

1. Wrong mode combination. passive/passive or auto/auto never forms. Draw a table if you’re unsure.

2. Mismatched physical config. Different allowed-VLAN lists, different STP config, different speeds — bundle refuses. show etherchannel summary will show a suspended port.

3. Mixing protocols. active on one side, desirable on the other. Not compatible. Pick one and use it on both sides.

4. Expecting round-robin load balancing. A single elephant flow rides one link.

5. Not configuring the physical interfaces first. If you set up trunk allowed-VLAN differently on the physical interfaces after bundling, the physical config gets overridden by the Port-channel config. Configure Po1’s trunk settings, and physical members inherit them.

6. Using on in production. Static mode gives you no protection if one side loses its config. Loops. Use LACP.

Cheat strip

Concept	One-line meaning
EtherChannel	Bundle 2–8 links into one logical Port-channel
LACP	802.3ad — open standard. Default choice
PAgP	Cisco-only legacy — still works between Cisco switches
on	Static bundle, no negotiation. Dangerous
Modes (LACP)	active initiates, passive responds
Modes (PAgP)	desirable initiates, auto responds
Passive/passive	Never forms
Auto/auto	Never forms
Load balance	Per-flow hash, NOT round-robin. One flow = one link
Bundle max	8 physical ports per Po
Physical requirements	Same speed, duplex, mode, VLAN list on every member
show etherchannel summary	(SU) = Port-channel up; (P) = physical port bundled
L3 EtherChannel	no switchport + IP address on Po interface

Try it once and it clicks

Two switches. Four cables between them. Configure channel-group 1 mode active on all eight ports (both switches). Watch show etherchannel summary on both — bundle should form in ~3 seconds. Verify all four are (P). Ping across. Yank one cable. Ping doesn’t drop (or drops for a fraction of a second). Plug it back. Bundle recovers.

That five-minute exercise gives you an intuition that would take hours to build from reading. Do the lab. EtherChannel is one of those features where the second time you configure it, you feel like a network engineer for real.