Link aggregation (LACP)

Configure and troubleshoot link aggregation (LACP) on Vectra appliances.

Vectra packet capture ports are designed as entirely passive interfaces that do not generate any packets. Due to this, capture interfaces cannot participate in active link aggregation technologies such as LACP/802.3ad. This article provides guidance on configuring link aggregation for Vectra packet capture interfaces.

---

Key Details:

1. Passive Capture Interfaces:

   • Vectra packet capture ports are passive and cannot transmit packets.

   • As a result, these interfaces cannot support active link aggregation protocols like LACP (Link Aggregation Control Protocol) or 802.3ad.

2. Link Aggregation Configuration:

   • Capture interfaces can accept all packets from any port without differentiation.

   • To aggregate links, use a static configuration approach rather than an active negotiation.

   • In Arista and Cisco switch configurations, this is referred to as configuring the link aggregation in 'mode on' instead of 'mode active'.

3. Traffic Flow Considerations:

   • When configuring link aggregation, ensure that all packets belonging to the same flow (e.g., TCP or UDP streams) are delivered to the same sensor.

   • Vectra sensors can reassemble asymmetric flows if both directions arrive on different ports of the same sensor.

   • However, if the two directions of an asymmetric flow are split across multiple sensors, reassembly will not be possible.

---

Best Practices for Configuration:

• Use static aggregation (mode on) when connecting switches to Vectra sensors to ensure proper packet capture functionality.

• Verify switch hashing algorithms to ensure that all packets of a single flow are directed to the same sensor. Common hashing methods include source/destination IP, MAC, or port.

• Avoid configurations where traffic flows are split across multiple sensors, as this will lead to incomplete flow reassembly.

---

Example Configuration:

For an Arista or Cisco switch:

interface Port-Channel1
  switchport mode trunk
  channel-group 1 mode on

interface Ethernet1
  channel-group 1 mode on

interface Ethernet2
  channel-group 1 mode on

In this example:

• Port-Channel1 is the logical aggregation interface.

• Ethernet1 and Ethernet2 are member interfaces configured in static aggregation mode mode on.

---

Troubleshooting Tips:

• Confirm that all flows for the same session are routed to the same sensor by reviewing switch hashing configurations.

• Use packet capture tools to validate that traffic is not split across sensors.

• Check switch logs for any errors related to aggregation misconfigurations.

---

By using static link aggregation mode on and ensuring proper flow-based hashing, you can effectively aggregate links for Vectra packet capture interfaces. This approach ensures accurate packet reassembly and optimal sensor performance.