Configure an Aggregate Interface Group

Configure the general interface group parameters.
Select
Network
Interfaces
Ethernet
and
Add Aggregate Group
.
In the field adjacent to the read-only
Interface Name
, enter a number to identify the aggregate group. The range is 1 to the maximum number of aggregate interface groups supported by the firewall.
For the
Interface Type
, select
HA
,
Virtual Wire
,
Layer2
, or
Layer3
.
Configure the remaining parameters for the
Interface Type
you selected.
Configure the LACP settings.
Perform this step only if you want to enable LACP for the aggregate group.
You cannot enable LACP for virtual wire interfaces.
Select the
LACP
tab and
Enable LACP
.
Set the
Mode
for LACP status queries to
Passive
(the firewall just responds—the default) or
Active
(the firewall queries peer devices).
As a best practice, set one LACP peer to active and the other to passive. LACP cannot function if both peers are passive. The firewall cannot detect the mode of its peer device.
Set the
Transmission Rate
for LACP query and response exchanges to
Slow
(every 30 seconds—the default) or
Fast
(every second). Base your selection on how much LACP processing your network supports and how quickly LACP peers must detect and resolve interface failures.
Select
Fast Failover
if you want to enable failover to a standby interface in less than one second. By default, the option is disabled and the firewall uses the IEEE 802.1ax standard for failover processing, which takes at least three seconds.
As a best practice, use
Fast Failover
in deployments where you might lose critical data during the standard failover interval.
Enter the
Max Ports
(number of interfaces) that are active (1 to 8) in the aggregate group. If the number of interfaces you assign to the group exceeds the
Max Ports
, the remaining interfaces will be in standby mode. The firewall uses the
LACP Port Priority
of each interface you assign (Step 3) to determine which interfaces are initially active and to determine the order in which standby interfaces become active upon failover. If the LACP peers have non-matching port priority values, the values of the peer with the lower
System Priority
number (default is 32,768; range is 1 to 65,535) will override the other peer.
(
Optional
) For active/passive firewalls only, select
Enable in HA Passive State
if you want to enable LACP pre-negotiation for the passive firewall. LACP pre-negotiation enables quicker failover to the passive firewall (for details, see LACP and LLDP Pre-Negotiation for Active/Passive HA).
If you select this option, you cannot select
Same System MAC Address for Active-Passive HA
; pre-negotiation requires unique interface MAC addresses on each HA firewall.
(
Optional
) For active/passive firewalls only, select
Same System MAC Address for Active-Passive HA
and specify a single
MAC Address
for both HA firewalls. This option minimizes failover latency if the LACP peers are virtualized (appearing to the network as a single device). By default, the option is disabled: each firewall in an HA pair has a unique MAC address.
If the LACP peers are not virtualized, use unique MAC addresses to minimize failover latency.
Click
OK
.
Assign interfaces to the aggregate group.
Perform the following steps for each interface (1–8) that will be a member of the aggregate group.
Select
Network
Interfaces
Ethernet
and click the interface name to edit it.
Set the
Interface Type
to
Aggregate Ethernet
.
Select the
Aggregate Group
you just defined.
Select the
Link Speed
,
Link Duplex
, and
Link State
.
As a best practice, set the same link speed and duplex values for every interface in the group. For non-matching values, the firewall defaults to the higher speed and full duplex.
(
Optional
) Enter an
LACP Port Priority
(default is 32,768; range is 1 to 65,535) if you enabled LACP for the aggregate group. If the number of interfaces you assign exceeds the
Max Ports
value of the group, the port priorities determine which interfaces are active or standby. The interfaces with the lower numeric values (higher priorities) will be active.
Click
OK
.
If the firewalls have an active/active configuration and you are aggregating HA3 interfaces, enable packet forwarding for the aggregate group.
Select
Device
High Availability
Active/Active Config
and edit the Packet Forwarding section.
Select the aggregate group you configured for the
HA3 Interface
and click
OK
.
Commit
your changes.
Verify the aggregate group status.
Select
Network
Interfaces
Ethernet
.
Verify that the Link State column displays a green icon for the aggregate group, indicating that all member interfaces are up. If the icon is yellow, at least one member is down but not all. If the icon is red, all members are down.
If you configured LACP, verify that the Features column displays the LACP enabled icon for the aggregate group.
(
PA-7050 and PA-7080 firewalls only
) If you have an aggregate interface group that has interfaces located on different line cards, it is a best practice to enable the firewall so that it can handle fragmented IP packets it receives on multiple interfaces of the AE group that are spread over multiple cards. To do so, use the following CLI operational command with the
hash
keyword. (The other two keywords are also shown for completeness.)
Access the CLI.
Use the following operational CLI command:
set ae-frag redistribution-policy
<
self
|
fixed sXdpX
|
hash
>
self
—(default) This keyword is for legacy behavior; it does not enable the firewall to handle fragmented packets received on multiple interfaces of an AE interface group.
fixed
s
<
slot-number
>
dp
<
dataplane-cpu-number
>—Replace the
slot-number
variable and replace the
data-plane-cpu-number
variable with the dataplane number of the dataplane that will handle all IP fragments received by all members of all AE interfaces. The
fixed
keyword is intended mainly for troubleshooting purposes and shouldn’t be used in production.
hash
—Use to enable the firewall to handle fragmented packets it receives on multiple interfaces of an AE interface group that are located on more than one line card.