Today’s task was get LACP working on a Palo Alto, so traffic and fault tolerance could be spread across multiple members of a Cisco 3750X switch stack. The default settings on the Palo Alto surprised me a bit:
Usually the switch is set to passive and the other network device active, likewise fast timers should be preferred. But whatever. I can just change that:
Unfortunately during testing, it took a good minute for failover to work. This is because the standby unit disables interfaces until going active, so there’s a delay of 30-40 seconds for LACP bundling plus an additional 25-50 seconds for Spanning-Tree. Working around Spanning-Tree was easy: just use Edge port aka PortFast. Note it should be enabled at the channel level and ‘trunk’ must be added for it to work on trunk ports:
interface Port-channel4 description Palo Alto Firewall - LACP switchport trunk encapsulation dot1q switchport mode trunk logging event trunk-status logging event bundle-status spanning-tree portfast trunk !
Speeding up LACP took a bit more research. Apparently, only data center grade Cisco switches like the Catalyst 6500 and Nexus line support LACP 1-second fast timers out of the box. The Catalyst 3750 line will only do slow 30-second timers, but can do fast on the bleeding edge 15.2(4)E train.
Upon testing, the failover downtime due to LACP bundling is now only 10 seconds:
Jul 20 17:58:22 PST: %EC-5-UNBUNDLE: Interface Gi4/1/1 left the port-channel Po31 Jul 20 17:58:22 PST: %EC-5-UNBUNDLE: Interface Gi3/1/1 left the port-channel Po31 Jul 20 17:58:30 PST: %EC-5-BUNDLE: Interface Gi3/1/2 joined port-channel Po32 Jul 20 17:58:32 PST: %EC-5-BUNDLE: Interface Gi4/1/2 joined port-channel Po32