ExamFinch.com My Study

Study guide

7.4 EtherChannel Link Aggregation

Practice this exam

CCNP Enterprise ENCOR 350-401

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Enterprise Architecture & Hierarchical Design

1.1 Enterprise Network Design Models & Hierarchical Campus Architecture 1.2 On-Premises, Cloud & Hybrid Infrastructure Deployment Models 1.3 Hardware Switching Architecture & Packet Forwarding

2 Chapter 2: Enterprise Quality of Service (QoS)

2.1 QoS Components: Classification, Marking & Trust Boundaries 2.2 QoS Policy: Queuing, Shaping, Policing & Interpreting MQC Output

3 Chapter 3: Software-Defined WAN (Catalyst SD-WAN)

3.1 Cisco Catalyst SD-WAN Architecture & Orchestration 3.2 SD-WAN Policies, Traffic Engineering & Application-Aware Routing

4 Chapter 4: Software-Defined Access (Catalyst SD-Access)

4.1 Catalyst SD-Access Fabric Architecture & Plane Separation 4.2 Cisco TrustSec, Security Group Tags (SGT), SXP & MACsec

5 Chapter 5: Device & Data Path Virtualization

5.1 Server & Network Device Virtualization 5.2 VRF-Lite & Virtual Routing Multi-Tenancy 5.3 GRE & IPsec Tunnel Virtualization Mechanics

6 Chapter 6: Network Virtualization & Overlay Technologies

6.1 LISP Architecture & EID-to-RLOC Mapping Mechanics 6.2 VXLAN & EVPN Overlay Architecture

7 Chapter 7: Layer 2 Infrastructure & Switching

7.1 VLANs, 802.1Q Trunking & VTPv3 7.2 Spanning Tree Protocol Mechanics 7.3 Advanced STP Protection Mechanisms 7.4 EtherChannel Link Aggregation

8 Chapter 8: Layer 3 Routing Foundations & EIGRP

8.1 IP Routing Foundations & Administrative Distance 8.2 Enhanced Interior Gateway Routing Protocol (EIGRP)

9 Chapter 9: OSPFv2 & OSPFv3 Operations

9.1 OSPFv2 Architecture & Neighbor State Machine 9.2 OSPF LSA Types & Multi-Area Design 9.3 OSPFv3 for IPv4 and IPv6 Address Families

10 Chapter 10: Border Gateway Protocol (BGP)

10.1 BGP Architecture, Neighbor States & Peering 10.2 BGP Path Attributes & Best Path Selection Algorithm

11 Chapter 11: Policy-Based Routing & Route Redistribution

11.1 Policy-Based Routing (PBR) & Route Maps 11.2 Route Redistribution & Loop Prevention

12 Chapter 12: IP Services & High Availability

12.1 First Hop Redundancy Protocols (HSRP, VRRP & GLBP) 12.2 Network Time Protocol (NTPv4) & Precision Time Protocol (PTP) 12.3 Network Address Translation (NAT/PAT) & VRF-Aware NAT

13 Chapter 13: IP Multicast Operations

13.1 IP Multicast Addressing, Group Management (IGMPv1/v2/v3) & IGMP Snooping 13.2 Protocol Independent Multicast (PIM-SM, PIM-SSM & Bidir-PIM) 13.3 Rendezvous Point (RP) Distribution Mechanisms

14 Chapter 14: Network Assurance & Monitoring

14.1 Diagnostic Utilities, Conditional Debugging & Path MTU Discovery 14.2 Syslog Architecture, Logging Facilities & Severity Levels 14.3 SNMPv1/v2c/v3 Security & Flexible NetFlow (FNF) Architecture 14.4 Switched Port Analyzer (SPAN, RSPAN, ERSPAN) & IP SLA Object Tracking

15 Chapter 15: Catalyst Center Assurance & Controller Operations

15.1 Cisco Catalyst Center (DNA Center) Assurance & AI Network Analytics 15.2 Cisco Catalyst Center Device Onboarding & Software Image Management (SWIM)

16 Chapter 16: Enterprise Security & Access Control

16.1 Device Hardening, AAA Architecture & RADIUS/TACACS+ 16.2 Access Control Lists (ACLs) for Infrastructure Security 16.3 Control Plane Policing (CoPP) & Control Plane Protection (CPPr) 16.4 Layer 2 Infrastructure Security Features 16.5 IEEE 802.1X Port-Based Authentication & MAB

17 Chapter 17: Threat Defense & API Security

17.1 Enterprise VPN Technologies (DMVPN Phase 1/2/3 & FlexVPN) 17.2 Next-Generation Threat Defense & Secure Access Service Edge (SASE)

18 Chapter 18: Network Automation, Programmability & Data Modeling

18.1 Python Fundamentals for Network Engineers & Cisco Libraries 18.2 YANG Data Modeling Language (RFC 6020/7950) & Model Types 18.3 REST API Architecture, HTTP Verbs, Security & Cisco Controller APIs 18.4 Model-Driven Telemetry (MDT) & NETCONF/RESTCONF Operations

19 Chapter 19: Orchestration, EEM & AI Operations

19.1 Configuration Management & Infrastructure as Code (Ansible & Terraform) 19.2 Cisco Embedded Event Manager (EEM) & Intent-Based Networking

7.4 EtherChannel Link Aggregation

Key Takeaways Explain This Topic AI

EtherChannel aggregates 2 to 8 active physical Ethernet links (up to 16 with LACP standby) into a single logical Port-Channel interface, multiplying bandwidth and providing sub-second link failover without STP topology changes.

Port Aggregation Protocol (PAgP - Cisco proprietary) supports 'auto' and 'desirable' modes; IEEE 802.3ad / 802.1AX Link Aggregation Control Protocol (LACP) supports 'passive' and 'active' modes.

LACP System Priority and Port Priority determine the master Actor switch and which physical ports are placed in active vs. hot-standby states in bundles exceeding 8 links.

EtherChannel frame distribution uses mathematical hash algorithms on Layer 2, Layer 3, or Layer 4 header fields; identical hashing algorithms across successive switch tiers can cause traffic polarization.

Multi-Chassis EtherChannel (MCEC) architectures—including Cisco StackWise, Virtual Switching System (VSS), and StackWise Virtual (SVL)—allow port-channels to span across distinct physical switches, eliminating Spanning Tree blocking and providing dual-active detection.

Last updated: August 2026

7.4 EtherChannel Link Aggregation

Core Blueprint Focus: Cisco 350-401 ENCOR v1.2 topic 3.1.b (troubleshoot static and dynamic EtherChannels) covers Layer 2 link bundling and high availability. Candidates must master Port Aggregation Protocol (PAgP) and Link Aggregation Control Protocol (LACP 802.3ad/802.1AX), configure LACP priorities (System Priority, Port Priority), diagnose load-balancing hash algorithms to prevent polarization, and implement Multi-Chassis EtherChannel (MCEC) solutions including Cisco StackWise and StackWise Virtual (SVL) with Dual-Active Detection (DAD).

Connecting switches with multiple parallel physical links creates Layer 2 loops. Under standard Spanning Tree rules, STP blocks all redundant uplinks except one, leaving substantial bandwidth unutilized. EtherChannel bundles up to 8 active physical links into a single logical Port-Channel interface. Spanning Tree views the bundle as a single logical link, preventing STP port blocking while aggregating full bi-directional bandwidth and providing seamless sub-second link failover.

1. EtherChannel Prerequisites & Port Compatibility Matrix

For physical interfaces to bundle into an active EtherChannel, all member ports must share identical configuration parameters : +-----------------------------------------------------------------------------------+

  • | ETHERCHANNEL PORT COMPATIBILITY REQUIREMENTS |
  • +-----------------------------------------------------------------------------------+
  • | 1. Speed & Duplex: Must match exactly (e.g., 10 Gbps Full Duplex). |
  • | 2. Switchport Mode: Must match (all Access or all Trunk). |
  • | 3. Access VLAN: If access, must belong to the exact same VLAN ID. |
  • | 4. Trunk Parameters: If trunk, Native VLAN and Allowed VLAN list must match. |
  • | 5. STP Settings: STP path cost, priority, and portfast settings match. |
  • | 6. MTU & Storm Control: Layer 2 MTU and broadcast storm thresholds must match. |
  • +-----------------------------------------------------------------------------------+

Caution

If any member interface has a mismatched parameter (e.g., different speed, native VLAN, or allowed VLAN list), Cisco IOS-XE will suspend the inconsistent port, generating %EC-5-CANNOT_BUNDLE2 error messages.

2. Dynamic Negotiation Protocols: PAgP vs. LACP

EtherChannels can be established statically or negotiated dynamically using either Cisco proprietary PAgP or open standard LACP . +-----------------------------------------------------------------------------------+

  • | PAgP & LACP NEGOTIATION MODES |
  • +-----------------------------------------------------------------------------------+
  • | |
  • | PAgP (Cisco Proprietary - Protocol ID 0x0104): |
  • | +----------------------+ +----------------------+ |
  • | | DESIRABLE (Active) | <=======================> | DESIRABLE (Active) | ===> OK |
  • | +----------------------+ +----------------------+ |
  • | | DESIRABLE (Active) | <=======================> | AUTO (Passive) | ===> OK |
  • | +----------------------+ +----------------------+ |
  • | | AUTO (Passive) | < - - - - - - - - - - - > | AUTO (Passive) | ===> NO! |
  • | +----------------------+ +----------------------+ |
  • | |
  • | LACP (IEEE 802.3ad / 802.1AX - EtherType 0x8809): |
  • | +----------------------+ +----------------------+ |
  • | | ACTIVE (Active) | <=======================> | ACTIVE (Active) | ===> OK |
  • | +----------------------+ +----------------------+ |
  • | | ACTIVE (Active) | <=======================> | PASSIVE (Passive) | ===> OK |
  • | +----------------------+ +----------------------+ |
  • | | PASSIVE (Passive) | < - - - - - - - - - - - > | PASSIVE (Passive) | ===> NO! |
  • | +----------------------+ +----------------------+ |
  • | |
  • | STATIC (Mode 'ON'): |
  • | +----------------------+ +----------------------+ |
  • | | MODE ON (Static) | ========================= | MODE ON (Static) | ===> OK |
  • | +----------------------+ +----------------------+ |
  • +-----------------------------------------------------------------------------------+
  • 1. Port Aggregation Protocol (PAgP - Cisco Proprietary)

Multicast MAC destination: 01:00:0C:CC:CC:CC .

desirable : Actively transmits PAgP packets to initiate bundle negotiation.

auto : Passively listens for PAgP packets; responds if requested but never initiates negotiation. Two switches configured with auto will never form an EtherChannel .

auto silent vs. non-silent : By default, PAgP operates in silent mode, allowing ports to attach to non-PAgP endpoints (such as file servers). In non-silent mode, the interface requires continuous bidirectional PAgP packets to prevent unidirectional loops.

2. Link Aggregation Control Protocol (LACP - IEEE 802.3ad / 802.1AX)

Standardized open protocol. Multicast MAC destination: 01:80:C2:00:00:02 (Slow Protocols EtherType 0x8809 ).

active : Actively transmits LACP packets to initiate bundle negotiation.

passive : Passively listens for LACP packets; responds if requested. Two switches configured with passive will never form an EtherChannel .

LACP System Priority & Port Priority Mechanics

LACP supports bundling up to 16 physical links , where 8 links are actively forwarding and up to 8 links remain in hot-standby mode.

LACP System Priority (2 Bytes, 1 to 65535, Default: 32768):

Combined with the switch base MAC address to form the LACP System ID .

The switch with the lowest System Priority (or lowest MAC address if tied) is elected as the Actor (Master) switch. The Actor switch makes all authoritative decisions regarding which links are active and which are standby.

LACP Port Priority (2 Bytes, 1 to 65535, Default: 32768):

Configured per interface. The Actor switch evaluates Port Priority to choose active bundle members.

Ports with the lowest Port Priority integer (or lowest physical interface number if tied) are selected as active forwarding links. Remaining links are placed into hot-standby.

LACP Timers (Fast vs. Slow):

Fast Rate ( lacp rate fast ): Transmits LACP packets every 1 second (timeout = 3 seconds), enabling rapid link failure detection.

Slow Rate ( lacp rate slow - Default): Transmits LACP packets every 30 seconds (timeout = 90 seconds).

3. Load-Balancing Mechanisms & Hash Polarization

EtherChannel does not use round-robin packet distribution because round-robin causes out-of-order packet delivery, breaking TCP windowing performance. Instead, EtherChannel employs a deterministic mathematical hash algorithm . +-----------------------------------------------------------------------------------+

  • | ETHERCHANNEL HASH LOAD-BALANCING FLOW |
  • +-----------------------------------------------------------------------------------+
  • | |
  • | Frame Enters Switch |
  • | | |
  • | v |
  • | [ Extract Header Fields ] ===> Source IP, Destination IP, L4 Ports, MAC |
  • | | |
  • | v |
  • | [ Compute XOR Hash ] ===> Produces an n-bit hash index value |
  • | | |
  • | v |
  • | [ Map Index to Port ] ===> Index maps deterministically to Member Link (1-8) |
  • | | |
  • | v |
  • | Frame Transmitted across selected physical link (Frames in same flow stay in-order)|
  • +-----------------------------------------------------------------------------------+
  • Configurable Load-Balancing Algorithms

Cisco IOS-XE supports multiple load-balancing algorithms configured via port-channel load-balance <method> :

src-mac / dst-mac / src-dst-mac : Hashing based on Layer 2 MAC addresses.

src-ip / dst-ip / src-dst-ip : Hashing based on Layer 3 IPv4/IPv6 addresses.

src-port / dst-port / src-dst-port : Hashing based on Layer 4 TCP/UDP port numbers.

src-dst-mixed-ip-port : Enhanced 5-tuple hash (Source/Dest IP + Source/Dest Port) available on modern Catalyst 9000 switches.

The EtherChannel Polarization Effect

Problem: In multi-tier hierarchical campus designs (e.g., Access → \to → Distribution → \to → Core), if all switches use the same load-balancing hash algorithm (e.g., src-dst-ip ) and have the same number of active member links (e.g., 2 links per bundle), the hashing calculation produces identical results at each layer.

Consequence: Traffic distributed onto Link 1 at the Access layer will produce the exact same hash at the Distribution layer, funneling all traffic onto Link 1 of the upstream Core EtherChannel while Link 2 remains completely idle (0% utilization).

Mitigation:

Use mixed Layer 3 / Layer 4 hashing ( src-dst-mixed-ip-port ) to maximize entropy.

Configure different hashing algorithms at different switching tiers (e.g., src-ip at access, src-dst-port at distribution).

Deploy modern Catalyst ASICs that incorporate unique internal pseudo-random hash offsets.

Loading diagram... Traditional STP vs. Multi-Chassis EtherChannel (StackWise Virtual)

4. Multi-Chassis EtherChannel (MCEC) Technologies

Standard EtherChannel requires all aggregated physical links to terminate on the same physical switch chassis . If that chassis fails, all connectivity is lost. Multi-Chassis EtherChannel (MCEC) allows physical member links to terminate across two separate physical switches while presenting a single logical switch entity to downstream devices, completely eliminating Spanning Tree blocking.

1. Cisco StackWise-480 / StackWise-1T (Hardware Stacking)

Architecture: Up to 8 or 9 switches (e.g., Catalyst 9300 series) interconnected using specialized hardware stacking cables in a bidirectional ring topology.

Plane Operations: Single centralized management IP, single control plane (Active, Standby, and Member roles with SSO/NSF), and distributed wire-rate ASIC forwarding across a 480 Gbps or 1 Tbps backplane ring.

Cross-Stack EtherChannel: Member links of an EtherChannel can connect to different physical switches in the stack. If one switch fails, the remaining physical links in the port-channel maintain continuous data forwarding.

2. Cisco Virtual Switching System (VSS - Legacy Catalyst 6500/6800/4500X)

Combines two modular chassis into a single virtual switch using Virtual Switch Links (VSL) carrying specialized VSS header-encapsulated control and data traffic.

3. Cisco StackWise Virtual (SVL - Catalyst 9000 Series)

Architecture: Combines two modular or fixed switches (such as Catalyst 9500, 9600) into a single logical entity using standard 10G, 25G, 40G, or 100G Ethernet fiber interfaces configured as StackWise Virtual Links (SVL) .

Control Plane: Operates with Stateful Switchover (SSO) and Nonstop Forwarding (NSF). Switch 1 acts as Active; Switch 2 acts as Standby.

Dual-Active Detection (DAD) & Split-Brain Prevention:

If all SVL interconnect links fail simultaneously, both switches assume the other has died. Both would attempt to act as the Active switch, resulting in a catastrophic split-brain condition with duplicate IP addresses, duplicate MAC addresses, and routing loops.

DAD Mechanisms:

Fast Hello DAD: A dedicated, direct Layer 2 point-to-point link configured between the two switches specifically for heartbeat exchange.

Enhanced PAgP (ePAgP): Transmits dual-active TLV heartbeat messages within PAgP packets across downstream dual-homed access switches.

Recovery Action: When DAD detects a split-brain condition, the Standby switch immediately enters Recovery Mode , shutting down all of its front-panel data interfaces (except the SVL links), preventing duplicate traffic until the SVL is restored.

5. Cisco IOS-XE EtherChannel Configuration & Verification

1. Configure LACP Port-Channel with Priority Control ! Step 1: Set LACP System Priority on authoritative Core Switch

Core-Switch-A(config)# lacp system-priority 4096

  • ! Step 2: Configure member interfaces for LACP Active mode and Port Priority
  • Core-Switch-A(config)# interface range HundredGigE 1/0/1 - 2
  • Core-Switch-A(config-if-range)# description LACP-UPLINK-TO-CORE-B
  • Core-Switch-A(config-if-range)# switchport mode trunk
  • Core-Switch-A(config-if-range)# switchport trunk allowed vlan 10,20,30,100
  • Core-Switch-A(config-if-range)# channel-group 10 mode active
  • Core-Switch-A(config-if-range)# lacp port-priority 8192
  • Core-Switch-A(config-if-range)# lacp rate fast
  • Core-Switch-A(config-if-range)# exit
  • ! Step 3: Set Enhanced 5-Tuple Load Balancing globally
  • Core-Switch-A(config)# port-channel load-balance src-dst-mixed-ip-port

2. Configure Cisco StackWise Virtual Link (SVL) and DAD ! Configure StackWise Virtual Link on Catalyst 9500 (Node 1)

  • Switch-1(config)# stackwise-virtual
  • Switch-1(config-stackwise-virtual)# domain 10
  • Switch-1(config-stackwise-virtual)# exit
  • ! Assign 40G/100G interfaces to StackWise Virtual Link
  • Switch-1(config)# interface range FortyGigabitEthernet 1/0/49 - 50
  • Switch-1(config-if-range)# stackwise-virtual link 1
  • Switch-1(config-if-range)# exit
  • ! Configure dedicated Fast Hello Dual-Active Detection interface
  • Switch-1(config)# interface GigabitEthernet 1/0/1
  • Switch-1(config-if)# stackwise-virtual dual-active-detection
  • Switch-1(config-if)# exit
  • 3. Verification & Troubleshooting Commands ! Verify EtherChannel summary and member port status
  • Core-Switch-A# show etherchannel summary
  • Flags: D - down P - bundled in port-channel
  • I - stand-alone s - suspended
  • H - Hot-standby (LACP only)
  • R - Layer3 S - Layer2
  • U - in use N - not in use, no aggregation
  • Group Port-channel Protocol Ports
  • -----+-------------+-----------+-----------------------------------------------
  • 10 Po10(SU) LACP Hu1/0/1(P) Hu1/0/2(P)
  • ! Verify LACP neighbor negotiation details
  • Core-Switch-A# show lacp neighbor 10
  • Channel group 10 neighbors

Partner's information:

  • LACP port Admin Oper Port Port
  • Port Flags Priority Dev ID Age key Key Number State
  • Hu1/0/1 SA 32768 5006.0420.0002 12s 0x1 0x1 0x1 0x3D
  • Hu1/0/2 SA 32768 5006.0420.0002 8s 0x1 0x1 0x2 0x3D
  • ! Verify StackWise Virtual and DAD link operational status
  • Core-Switch-A# show stackwise-virtual dual-active-detection

Dual-Active-Detection Configuration:

  • ------------------------------------
  • Switch Stackwise Virtual Link Dual-Active-Detection Link
  • ------ ----------------------- --------------------------
  • 1 FortyGigabitEthernet1/0/49 GigabitEthernet1/0/1
  • FortyGigabitEthernet1/0/50
  • 2 FortyGigabitEthernet2/0/49 GigabitEthernet2/0/1
  • FortyGigabitEthernet2/0/50

Status: PASSED (Operational)