Controllerless Networks

PROBLEM: I am trying to get LAG configuration setup on Cisco 3750 for Aruba Instant Access Point IAP-225-US. As I understand it the IAP-225-US has automatic LACP detection and should auto configure for LACP when connected to a switch that is setup for the LAG.

When I log into the IAP, and run the command show lacp status it is telling me that LACP Not Configured.

Cisco 3750X

interface GigabitEthernet1/0/8
 description Aruba_Ether0
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport nonegotiate
 speed 1000
 duplex full
 channel-group 2 mode active
end

interface GigabitEthernet1/0/20
 description Aruba_Ether1
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport nonegotiate
 speed 1000
 duplex full
 channel-group 2 mode active
end

interface Port-channel2
 description Aruba_Test_LAG
 switchport trunk encapsulation dot1q
 switchport mode trunk
end

ArubaIAP

wired-port-profile default_wired_port_profile
 switchport-mode trunk
 allowed-vlan all
 native-vlan 1
 shutdown
 access-rule-name default_wired_port_profile
 speed 1000
 duplex full
 no poe
 type employee
 auth-server InternalServer
 captive-portal disable
 no dot1x

 Cisco Status

show eth summary
Flags:  D - down        P - bundled in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        R - Layer3      S - Layer2
        U - in use      f - failed to allocate aggregator

        M - not in use, minimum links not met
        u - unsuitable for bundling
        w - waiting to be aggregated
        d - default port


Number of channel-groups in use: 2
Number of aggregators:           2

Group  Port-channel  Protocol    Ports
------+-------------+-----------+-----------------------------------------------
1      Po1(SU)         LACP      Gi1/0/9(P)  Gi1/0/10(P)
2      Po2(SD)         LACP      Gi1/0/8(I)  Gi1/0/20(I)

Before it setting it to fixed, it was saying status of SD, and the ports were in suspended.  

Aruba Status

show lacp status

LACP Not Configured

Can you see if your Cisco switch has a command "no independent-state" for the LAG?

I came across this post, but pretty sure I did everything it suggested...

http://community.arubanetworks.com/t5/ArubaOS-and-Controllers/EtherChannel-between-Aruba-and-Cisco-switch/m-p/130611#M7083

Looking here...

http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_53_se/configuration/guide/3750xscg/swethchl.html

"

When you configure one end of an EtherChannel in either PAgP or LACP mode, the system negotiates with the other end of the channel to determine which ports should become active. If the remote port cannot negotiate an EtherChannel, the local port is put into an independent state and continues to carry data traffic as would any other single link. The port configuration does not change, but the port does not participate in the EtherChannel.

•When you configure an EtherChannel in the on mode, no negotiations take place. The switch forces all compatible ports to become active in the EtherChannel. The other end of the channel (on the other switch) must also be configured in the on mode; otherwise, packet loss can occur.

"

I'll try channel-group mode on instead of active and do a reload of IAP to see if that fixes it.

Well, I think it's in a LAG, but not LACP....

(config-if)#int range gi1/0/8, gi1/0/20
(config-if-range)#no channel-group 2
(config-if-range)#channel-group 2 mode on
(config-if-range)#end
#show ether sum
Flags:  D - down        P - bundled in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        R - Layer3      S - Layer2
        U - in use      f - failed to allocate aggregator

        M - not in use, minimum links not met
        u - unsuitable for bundling
        w - waiting to be aggregated
        d - default port


Number of channel-groups in use: 2
Number of aggregators:           2

Group  Port-channel  Protocol    Ports
------+-------------+-----------+-----------------------------------------------
1      Po1(SU)         LACP      Gi1/0/9(P)  Gi1/0/10(P)
2      Po2(SU)          -        Gi1/0/8(P)  Gi1/0/20(P)

 Aruba Status

iap1# show lacp status

LACP Not Configured

You do want mode active.    I did run into a similar issue using the Aruba MAS where LACP would not come up until I set "no independent-state".  Here is a snip of the Aruba config:

interface-profile lacp-profile <NAME>

   group-id 1

   mode active

   timeout short

   no independent-state

Once this was set LACP came up on the -225.

I am unsure if the aruba instant product virtual controller has this capability, when I look at the Aruba Instant 6.3.1.1-4.0 User Guide on page 315, it says this...

http://www.arubanetworks.com/techdocs/Instant_41_Mobile/Advanced/Content/UG_files/Wired_port_profile/lacp_support.htm

every time I try to type a command such as "interface-profile lacp-profile 1", I am getting a %Parse Error....

http://community.arubanetworks.com/t5/Software-User-Reference-Guides/Aruba-Instant-6-4-0-2-4-1-Command-Line-Interface-Reference-Guide/ta-p/168356

The interface profile config snip is for the Aruba switch.   The IAP auto-detects LACP and no configuration is needed on the IAP.

That's what I thought, so what should the ports and port-channel on switch look like to get the Aruba IAP Auto detect to work?

That was a config snip of the LACP config from the switch. With the Aruba switch the command "no independent state" was what got it working for me.  Hopefully there is an equivalent on the Cisco side.

interface-profile lacp-profile <NAME>

   group-id 1

   mode active

   timeout short

   no independent-state

(config-if-range)#channel-group 2 mode ?
  active     Enable LACP unconditionally
  auto       Enable PAgP only if a PAgP device is detected
  desirable  Enable PAgP unconditionally
  on         Enable Etherchannel only
  passive    Enable LACP only if a LACP device is detected

I can switch it back to active, but before it wasn't working... 

Did "mode on" fix it for you?  It seems like that ~might~ do the same thing.

Well if you look in previous, when I had it in "mode on" it appears to be bundled in a LAG, but was not LACP. Supposedly Aruba and Cisco can work together with LACP. My goal was to try and type "show lacp status" on Aruba and see that it is working....

mode on aggregates unconditionally and does not use a protocol.

Can you try adding "channel-mode lacp" to the two interfaces?

(config-if-range)#channel-protocol ?
  lacp  Prepare interface for LACP protocol
  pagp  Prepare interface for PAgP protocol

 Current Configuration of the Switch Port

interface GigabitEthernet1/0/8
 description Aruba_Ether0
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport nonegotiate
 speed 1000
 duplex full
 channel-protocol lacp
 channel-group 2 mode active
end

interface GigabitEthernet1/0/20
 description Aruba_Ether1
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport nonegotiate
 speed 1000
 duplex full
 channel-protocol lacp
 channel-group 2 mode active
end

interface Port-channel2
 description Aruba_Test_LAG
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport nonegotiate
end

sh eth sum
Flags:  D - down        P - bundled in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        R - Layer3      S - Layer2
        U - in use      f - failed to allocate aggregator

        M - not in use, minimum links not met
        u - unsuitable for bundling
        w - waiting to be aggregated
        d - default port


Number of channel-groups in use: 2
Number of aggregators:           2

Group  Port-channel  Protocol    Ports
------+-------------+-----------+-----------------------------------------------
1      Po1(SU)         LACP      Gi1/0/9(P)  Gi1/0/10(P)
2      Po2(SD)         LACP      Gi1/0/8(I)  Gi1/0/20(I)

 Rebooting IAP. After 56 seconds of waiting the device came back up.

cisco3750#sh eth sum
Flags:  D - down        P - bundled in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        R - Layer3      S - Layer2
        U - in use      f - failed to allocate aggregator

        M - not in use, minimum links not met
        u - unsuitable for bundling
        w - waiting to be aggregated
        d - default port


Number of channel-groups in use: 2
Number of aggregators:           2

Group  Port-channel  Protocol    Ports
------+-------------+-----------+-----------------------------------------------
1      Po1(SU)         LACP      Gi1/0/9(P)  Gi1/0/10(P)
2      Po2(SD)         LACP      Gi1/0/8(I)  Gi1/0/20(I)

iap1# show lacp status

LACP Not Configured

iap1#

It appears to be that Po2 is still showing that it's in a "D" state and that the Aruba has no LACP configured.

there have some earlier subjects about this.

one mentions first connecting eth0 and only then eth1, did you try this?

it also mentioneds not working with a static IP, but with DHCP, what are you using?

I contacted the TAC and this is the response so far...

Upon reviewing this case, I notice that you are facing issues setting up LACP between IAP-225 and Cisco 3750 switch. LACP comes up when used with DHCP IP however when static IP is used, the LACP doesn’t work. I would like to inform you that this is a known issue which is already reported to the engineering team and will be fixed in IAP firmware version 4.2.x. At this moment, we don’t have any ETA on when this code will be released. The bug reference ID is 95472. With respect to automatic code upgrade not working in IAP, you could login to Aruba support site and download the latest image for the IAP based on the model number. Please refer the below link to download the latest version of IAP firmware. http://support.arubanetworks.com/DownloadSoftware/tabid/75/DMXModule/510/EntryId/14924/Default.aspx

I am still awaiting account creation to download the updated firmware since my Aruba for some reason when clicking the Check for Updates button did not get the latest release which supposedly fixes the issue.

Will Discussion Forum updated to see what happens...

Larry,

LACP will only "listen" during bootup of the IAP. Can you grab the console ouput of the IAP as it is booting up while attached to the 3750?

Best regards,

Madani

Larry,

I have an old 3750 running IOS 15.0(2)SE1 and was able to get the port channel up using the following:

Switch#show run | begin interface
interface Port-channel1
 switchport mode access
!
interface GigabitEthernet1/0/1
 switchport mode access
 power inline never
 channel-group 1 mode active
!
interface GigabitEthernet1/0/2
 switchport mode access
 power inline never
 channel-group 1 mode active

Disregard that PoE is disabled. My 3750 only support Pre-Standard and 802.3af and to have the second eth1 up on the IAP-225, you need 802.3at or at least 51v on the PoE rail which this one does not so I'm using an external supply for my IAP-225. You need to set the mode to Active because that instructs the switch to send LACP PDUs.

Here are the relevent Cisco outputs once LACP was up:

Switch#show lacp 1 counters
             LACPDUs         Marker      Marker Response    LACPDUs
Port       Sent   Recv     Sent   Recv     Sent   Recv      Pkts Err
---------------------------------------------------------------------
Channel group: 1
Gi1/0/1     68     16       0      0        0      0         0
Gi1/0/2     64     14       0      0        0      0         0

Switch#show lacp 1 neighbor
Flags:  S - Device is requesting Slow LACPDUs
        F - Device is requesting Fast LACPDUs
        A - Device is in Active mode       P - Device is in Passive mode

Channel group 1 neighbors

Partner's information:

                  LACP port                        Admin  Oper   Port    Port
Port      Flags   Priority  Dev ID          Age    key    Key    Number  State
Gi1/0/1   SA      255       1864.72c5.843a  28s    0x0    0x11   0x1     0x3D
Gi1/0/2   SA      255       1864.72c5.843a  28s    0x0    0x11   0x2     0x3D

Switch#show lacp 1 internal
Flags:  S - Device is requesting Slow LACPDUs
        F - Device is requesting Fast LACPDUs
        A - Device is in Active mode       P - Device is in Passive mode

Channel group 1
                            LACP port     Admin     Oper    Port        Port
Port      Flags   State     Priority      Key       Key     Number      State
Gi1/0/1   SA      bndl      32768         0x1       0x1     0x102       0x3D
Gi1/0/2   SA      bndl      32768         0x1       0x1     0x103       0x3D

Here is the bootup sequence from my IAP. I am running 6.3.1.4-4.0.0.5. Notice at the 22/23 second mark, the interface is being configured for 802.3ad which is LACP.

[    0.000000]
[    0.000000] Aruba Networks
[    0.000000] ArubaOS Version 6.3.1.4-4.0.0.5 (build 43022 / label #43022)
[    0.000000] Built by p4build@stan on 2014-04-03 at 13:50:44 PDT (gcc version 4.5.1)
[    0.000000]
[    0.000000] Memory: 508988k/524288k available (9744k kernel code, 15300k reserved, 504k data, 355k bss, 6380k init)
[    0.002949] Processor 1 found.
[    0.123952] Brought up 2 CPUs
[    0.200475] PCI: Probing PCI hardware
[    0.243530] pci 0000:00:00.0: PCI bridge to [bus 01-ff]
[    0.306536] pci 0001:02:00.0: PCI bridge to [bus 03-ff]
[    0.368744] pci 0000:00:00.0: enabling device (0106 -> 0107)
[    0.435941] pci 0001:02:00.0: enabling device (0106 -> 0107)
[    5.006300] ee000000.nor: Found 1 x16 devices at 0x0 in 16-bit bank
[    5.081344] Amd/Fujitsu Extended Query Table at 0x0040
[    5.142863] number of CFI chips: 1
[    5.188059] /proc/gfar_eth0_stats created
[    5.238783] /proc/gfar_eth1_stats created
[    5.302922] wdg_create_new_proc_entry: proc initializedEnabling watchdog on CPU 1
[    5.363393] Enabling watchdog on CPU 0
[    5.444182]
[    5.444186] Starting Kernel SHA1 KAT ...Starting Kernel HMAC SHA1 FIPS KAT ...Completed Kernel HMAC SHA1 FIPS KAT
[    5.452389] Starting Kernel HMAC SHA256 FIPS KAT ...Completed Kernel HMAC SHA256 FIPS KAT
[    5.453137] Starting Kernel HMAC SHA384 FIPS KAT ...Completed Kernel HMAC SHA384 FIPS KAT
[    5.453638] Starting Kernel HMAC SHA512 FIPS KAT ...Completed Kernel HMAC SHA512 FIPS KAT
[    5.454194] Starting Kernel AES-CBC FIPS KAT ...Completed Kernel AES-CBC FIPS KAT
[    5.459264] Starting Kernel AES-CCM FIPS KAT ...Completed Kernel AES-CCM FIPS KAT
[    5.459702] Starting Kernel 3DES-CBC FIPS KAT ...Completed Kernel 3DES-CBC FIPS KAT
[    6.156822] Completed Kernel SHA1 KAT
[    6.201643] Starting Kernel HMAC-SHA1 KAT ...Completed Kernel HMAC-SHA1 KAT
[    6.289910] Starting Kernel DES KAT ...Completed Kernel DES KAT
[    6.361859] Starting Kernel AES KAT ...Completed Kernel AES KAT
[    6.405658]
Domain Name: arubanetworks.com
No panic info available
Check backup ENV.
[    9.726448] p1020_soc: P1020 Misc Utils Driver version 1
Ethernet port 1 mode: active-standby
[    9.984975] ADDRCONF(NETDEV_UP): eth0: link is not ready
[   10.053719] ADDRCONF(NETDEV_UP): bond0: link is not ready
[   10.139552] bonding: bond0: enslaving eth0 as a backup interface with a down link.
[   10.246082] ADDRCONF(NETDEV_UP): eth1: link is not ready
[   10.331463] bonding: bond0: enslaving eth1 as a backup interface with a down link.
Using primary ap config
wifi uplink not present...
extended ssid config detected...
do ethtool autoneg on for eth0
[   13.388241] PHY: eth0 (mdio@ffe24000:00) - Link is Up - 1000/Full
[   13.711016] bonding: bond0: link status definitely up for interface eth0.
[   13.769629] PHY: eth1 (mdio@ffe24000:01) - Link is Up - 1000/Full
[   13.865235] bonding: bond0: making interface eth0 the new active one.
[   13.942383] bonding: bond0: first active interface up!
[   14.004014] ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[   14.403015] bonding: bond0: link status definitely up for interface eth1.
Mesh is DISABLED on this device.
[   16.412516] AP xml model 66, num_radios 2 (jiffies 7999)
[   16.476113] init_asap_mod: installation:0
[   16.524071] radio 0: band 1 ant 0 max_ssid 16
[   16.576182] radio 1: band 0 ant 0 max_ssid 16
[   16.628299] election init: rand=11 HZ=500
[   16.676239] IAP client match init
[   16.715895] ethernet_device_event: dev eth0 is up
[   16.772189] ethernet_device_event: dev eth1 is up
[   16.836991] ASAP Slowpath initialized
notify asap_mod 3g no present...
Starting watchdog process...
Getting an IP ad[   16.999965] bonding: bond0: eth0 is already the current active slave.
dress...
Dec 31 16:00:16 udhcpc[2052]: udhcpc (v0.9.9-pre) started
Dec 31 16:00:16 udhcpc[2052]: send_discover: pkt num 0, secs 0
Dec 31 16:00:16 udhcpc[2052]: Sending discover...
Dec 31 16:00:18 udhcpc[2052]: send_discover: pkt num 1, secs 2
Dec 31 16:00:18 udhcpc[2052]: Sending discover...
Dec 31 16:00:20 udhcpc[2052]: send_discover: pkt num 2, secs 4
Dec 31 16:00:20 udhcpc[2052]: Sending discover...
[   22.392621] bonding: bond0: Warning: the permanent HWaddr of eth0 - 18:64:72:c5:84:3a - is still in use by bond0. Set the HWaddr of eth0 to a different address to avoid conflicts.
[   22.584322] bonding: bond0: releasing active interface eth0
[   22.651064] bonding: bond0: making interface eth1 the new active one.
[   22.737175] ethernet_device_event: dev eth0 is down
[   22.798566] bonding: bond0: releasing active interface eth1
[   22.875132] ethernet_device_event: dev eth1 is down
[   22.945569] bonding: bond0: setting xmit hash policy to layer2+3 (2).
[   23.025047] bonding: bond0: setting mode to 802.3ad (4).
[   23.091034] ADDRCONF(NETDEV_UP): bond0: link is not ready
[   23.161806] ethernet_device_event: dev eth0 is up
[   23.218155] bonding: bond0: enslaving eth0 as a backup interface with an up link.
[   23.308019] ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
Dec 31 16:00:22 [   23.393065] ethernet_device_event: dev eth1 is up
udhcpc[2052]: No[   23.459771] bonding: bond0: enslaving eth1 as a backup interface with an up link.
 lease, forking to background.
[   26.642407] PHY: eth0 (mdio@ffe24000:00) - Link is Up - 1000/Full
[   26.862292] PHY: eth1 (mdio@ffe24000:01) - Link is Up - 1000/Full
Dec 31 16:00:42 udhcpc[2202]: send_discover: pkt num 0, secs 26
Dec 31 16:00:42 udhcpc[2202]: Sending discover...
Dec 31 16:00:44 udhcpc[2202]: send_discover: pkt num 1, secs 28
Dec 31 16:00:44 udhcpc[2202]: Sending discover...
Dec 31 16:00:46 udhcpc[2202]: send_discover: pkt num 2, secs 30
Dec 31 16:00:46 udhcpc[2202]: Sending discover...
Dec 31 16:01:08 udhcpc[2202]: send_discover: pkt num 0, secs 52
Dec 31 16:01:08 udhcpc[2202]: Sending discover...
Dec 31 16:01:08 udhcpc[2202]: send_selecting: pkt num 0, secs 52
Dec 31 16:01:08 udhcpc[2202]: Sending select for 192.168.210.3...
Dec 31 16:01:08 udhcpc[2202]: Lease of 192.168.210.3 obtained, lease time 86400
D[   68.819005] ip_time_handler: Got ip and packets on bond0 Started master election 3-0, rand 14
ec 31 16:01:08 udhcpc[2202]: DHCP OPT 43 deleted airwave config

192.168.210.3 255.255.255.0 192.168.210.1
Compressing all files in the /etc/httpd directory...
Done.
Starting Webserver
bind: Transport endpoint is not connected
bind: Transport endpoint is not connected
bind: Transport endpoint is not connected
NTP Server not saved in flash... using default
[   72.836531] wifi0: AP type AP-225, radio 0, max_bssids 16
[   72.933052] Enabling eth1 due to power change [power profile 1]
[   73.060137] wifi1: AP type AP-225, radio 1, max_bssids 16
Clearing P1020 PCIe Error Status
shutting down watchdog process (nanny will restart it)...
Completed SW FIPS KAT test

        <<<<<       Welcome to the Access Point     >>>>>

And then finally here is the LACP output from the IAP.

18:64:72:c5:84:3a# show lacp status

AP LACP Status
--------------
Link Status  LACP Rate  Num Ports  Actor Key  Partner Key  Partner MAC
-----------  ---------  ---------  ---------  -----------  -----------
Up           slow       2          17         1            00:27:0c:6d:d8:80
Slave Interface Status
----------------------
Slave I/f Name  Permanent MAC Addr  Link Status  Member of LAG  Link Fail Count
--------------  ------------------  -----------  -------------  ---------------
eth0            18:64:72:c5:84:3a   Up           Yes            0
eth1            18:64:72:c5:84:3b   Up           Yes            0
Traffic Sent on Enet Ports
--------------------------
Radio Num  Enet 0 Tx Count  Enet 1 Tx Count
---------  ---------------  ---------------
0          0                0
1          0                0
non-wifi   2                10

I hope this helps to compare against what you are seeing.

I captured the console logs during bootup, and I suspect I am running into the same POE issue. Even though on Cisco's site the 3750X does as POE plus.

[   49.403688] bonding: bond0: setting xmit hash policy to layer2+3 (2).
[   49.483076] bonding: bond0: setting mode to 802.3ad (4).

Can you tell me what the AC adapter power requirements are to see if I have one here that I can use opposed to ordering a power adapter.

Hi

did you finally solve the issue with LCAP and your Cisco Switch?

What was the correct config

Thx and _best reagrds

Stefan

• Must have an ARUBA AC ADAPTER
• Must have ARUBA Configured for DHCP and not a static address. 
• Must have a 3x3 802.11ac Wireless Network Adapter capable of supporting 1300 Mbps, some only max out at 867 Mbps. 
• Must have two ports available in a LAG configuration on the switch. 
• The switch must be able to support as many LAG's that you will need if doing multiple AP's. Some switches only support 4
  Aruba IAP-225-US firmware version6.4.2.0-4.1.1.0 45226

 interface GigabitEthernet11
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 1,25,75,200
 switchport mode trunk
 spanning-tree portfast disable
 channel-group 2 mode active
end
interface GigabitEthernet12
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 1,25,75,200
 switchport mode trunk
 spanning-tree portfast disable
 channel-group 2 mode active
end
interface Port-channel2
 description Aruba_Test_LAG
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 1,25,75,200
 switchport mode trunk
end

I should also mention that after upgrading the firmware, I am unable to login with SSH. I think it sets the username and password to some hidden credentials used by Aruba developers. I did get them to release the firmware to me before it was released to the public.