Skip to content
Log in Sign up My account

Sim 01: EtherChannel LACP and Trunk Troubleshooting

Blueprint 3.1.a, 3.1.b · Difficulty: Medium · Time target: 15 minutes

A junior engineer started building a small campus block and left it half working. Users on ACC1 in VLAN 20 cannot reach the distribution switches, the distribution pair is not bundled, and one uplink is not trunking at all. Fix it.

Download the lab

CML lab file · EVE-NG lab file

4 nodes. The lab boots in its starting configuration. CML: Import a lab, then start it. EVE-NG: import the .unl from the lab list; if your image folder names differ, edit each node's image.

Topology

graph TB
  D1["DIST1<br/>VLAN 99: 192.168.100.11"]
  D2["DIST2<br/>VLAN 99: 192.168.100.12"]
  A1["ACC1<br/>VLAN 99: 192.168.100.21"]
  H1["Host1<br/>VLAN 10"]
  D1 -- "Gi0/0 to Gi0/0" --- D2
  D1 -- "Gi0/1 to Gi0/1" --- D2
  D1 -- "Gi0/2 to Gi0/2" --- A1
  D2 -- "Gi0/2 to Gi0/3" --- A1
  A1 -- "Gi1/0 access VLAN 10" --- H1
Node CML image
DIST1, DIST2, ACC1 IOSvL2
Host1 (optional) Alpine or Ubuntu
VLAN Name Purpose
10 USERS Data
20 VOICE Voice
99 MGMT Switch management SVIs, 192.168.100.0/24
999 NATIVE Unused native VLAN on all trunks

Pre-configured state

  • VLANs 10, 20, 99 and 999 exist on all three switches with the names above.
  • Management SVIs in VLAN 99 are configured and up on all three switches.
  • ACC1 Gi1/0 is an access port in VLAN 10.
  • DIST1 Gi0/0 and Gi0/1 are already in channel group 1. DIST2 Gi0/0 and Gi0/1 were configured by someone else.
  • The DIST1 to ACC1 link and the DIST2 to ACC1 link were configured by someone else.

Starting configuration

Paste these into the three switches before you start.

hostname DIST1
!
vlan 10
 name USERS
vlan 20
 name VOICE
vlan 99
 name MGMT
vlan 999
 name NATIVE
!
interface range GigabitEthernet0/0 - 1
 switchport trunk encapsulation dot1q
 switchport mode trunk
 channel-group 1 mode passive
!
interface GigabitEthernet0/2
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,99,999
 switchport mode trunk
!
interface Vlan99
 ip address 192.168.100.11 255.255.255.0
 no shutdown
end

hostname DIST2
!
vlan 10
 name USERS
vlan 20
 name VOICE
vlan 99
 name MGMT
vlan 999
 name NATIVE
!
interface GigabitEthernet0/0
 switchport trunk encapsulation dot1q
 switchport mode trunk
 channel-group 1 mode passive
!
interface GigabitEthernet0/1
 switchport trunk encapsulation dot1q
 switchport mode trunk
 channel-group 2 mode passive
!
interface GigabitEthernet0/2
 switchport mode dynamic auto
!
interface Vlan99
 ip address 192.168.100.12 255.255.255.0
 no shutdown
end

hostname ACC1
!
vlan 10
 name USERS
vlan 20
 name VOICE
vlan 99
 name MGMT
vlan 999
 name NATIVE
!
interface GigabitEthernet0/2
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 10,99,999
 switchport mode trunk
!
interface GigabitEthernet0/3
 switchport mode dynamic auto
!
interface GigabitEthernet1/0
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast
!
interface Vlan99
 ip address 192.168.100.21 255.255.255.0
 no shutdown
end

Tasks

  1. Configure DIST1 and DIST2 so that both links between them (Gi0/0 and Gi0/1) are bundled into Port-channel 1 using LACP. DIST1 must actively start LACP negotiation. DIST2 must only respond to LACP and never start it.
  2. Configure LACP so that DIST1 has the better LACP system priority, using the value 4096.
  3. Configure Port-channel 1 on both switches as an 802.1Q trunk with native VLAN 999 that carries only VLANs 10, 20, 99 and 999.
  4. Fix the DIST1 to ACC1 trunk so that VLANs 10 and 20 both cross it and there is no native VLAN mismatch.
  5. Configure the DIST2 to ACC1 link as an 802.1Q trunk with the same native and allowed VLANs as the other trunks.
  6. Make sure no trunk in the topology sends or responds to DTP.

Constraints

  • Do not use PAgP or channel-group ... mode on.
  • Do not change any VLAN ID, VLAN name or access port.
  • Do not leave any unused port-channel interface in the configuration.
  • Do not shut down any inter-switch link to complete the tasks (shutting a port briefly while you change it is fine, but it must be up at the end).
Solution

What was wrong: both sides of the DIST link were LACP passive, so neither started negotiation. DIST2 Gi0/1 was in the wrong channel group. ACC1 Gi0/2 used native VLAN 1 against DIST1's 999 and did not allow VLAN 20. The DIST2 to ACC1 link had both ends in dynamic auto, so neither side asked to trunk and it came up as an access link.

lacp system-priority 4096
!
interface range GigabitEthernet0/0 - 1
 channel-group 1 mode active
!
interface Port-channel1
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,99,999
 switchport mode trunk
 switchport nonegotiate
!
interface GigabitEthernet0/2
 switchport nonegotiate
end

interface GigabitEthernet0/1
 no channel-group 2
 channel-group 1 mode passive
!
no interface Port-channel2
!
interface Port-channel1
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,99,999
 switchport mode trunk
 switchport nonegotiate
!
interface GigabitEthernet0/2
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,99,999
 switchport mode trunk
 switchport nonegotiate
end

interface GigabitEthernet0/2
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,99,999
 switchport nonegotiate
!
interface GigabitEthernet0/3
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,99,999
 switchport mode trunk
 switchport nonegotiate
end

Settings on interface Port-channel1 are copied to the member ports. If a member port has trunk settings that differ from the port-channel, it can be suspended from the bundle, so configure the logical interface and check that the members agree.

switchport nonegotiate is only accepted on a port that is already in switchport mode trunk (or access). That is why the mode is set before it.

Exam trap

LACP passive on both ends never forms a bundle, and neither does dynamic auto on both ends of a DTP link. In each pair, at least one side must be the one that asks (active for LACP, desirable or a static trunk for DTP).

Verification 

DIST1# show etherchannel summary

Group  Port-channel  Protocol    Ports
------+-------------+-----------+-----------------------------------------------
1      Po1(SU)         LACP      Gi0/0(P)    Gi0/1(P)
SU means a Layer 2 port-channel that is in use. Each member must show (P) (bundled). (I) means stand-alone (no LACP partner), (s) means suspended, usually because of a config mismatch.

DIST1# show lacp sys-id
DIST2# show lacp neighbor
DIST1 reports system priority 4096. On DIST2, the neighbor entries for Gi0/0 and Gi0/1 show DIST1 as the partner, and the port flags show DIST1 is active (FA or SA depending on LACP rate) while DIST2 is passive.

ACC1# show interfaces trunk

Port        Mode             Encapsulation  Status        Native vlan
Gi0/2       on               802.1q         trunking      999
Gi0/3       on               802.1q         trunking      999

Port        Vlans allowed on trunk
Gi0/2       10,20,99,999
Gi0/3       10,20,99,999
Mode on means a static trunk. With switchport nonegotiate, show interfaces Gi0/3 switchport reports Negotiation of Trunking: Off.

DIST2# show interfaces trunk
DIST2# show spanning-tree vlan 20
ACC1# ping 192.168.100.11
ACC1# ping 192.168.100.12
DIST2 lists Po1 and Gi0/2 as trunking with native VLAN 999. VLAN 20 has a spanning-tree instance with ports on Po1 and both ACC1 uplinks, and no port shows a *PVID_Inc (native VLAN mismatch) or *TYPE_Inc inconsistency. Both pings succeed. No %CDP-4-NATIVE_VLAN_MISMATCH messages appear in the log.