Imagine you have two switches connected by a single cable. That cable carries all the traffic between them. If it fails, connectivity is lost. If you add a second cable for redundancy, Spanning Tree Protocol (STP) will normally block one of them to prevent a loop — so you get redundancy, but you don’t get extra bandwidth, since only one link is actively forwarding at a time.
EtherChannel solves this problem. It bundles multiple physical links into a single logical link, giving you both redundancy and increased bandwidth, while STP treats the whole bundle as just one link — no blocking needed.
This article explains EtherChannel from the ground up, focused on the industry-standard negotiation protocol: LACP (Link Aggregation Control Protocol). We’ll cover both Layer 2 (switched) and Layer 3 (routed) EtherChannel, with full Cisco configuration and verification examples.
What Is EtherChannel?
EtherChannel (Cisco’s term; the general industry term is Link Aggregation, standardized as IEEE 802.3ad and later 802.1AX) combines 2 to 8 physical Ethernet links into one logical interface called a Port-Channel.
Benefits:
- Increased bandwidth — traffic is load-balanced across all active links.
- Redundancy — if one physical link fails, traffic automatically shifts to the remaining links with no STP recalculation needed.
- Simplified STP topology — the bundle appears as a single logical link to STP, avoiding blocked ports and topology changes when individual member links fail.
LACP vs. PAgP vs. Static (ON Mode)
There are three ways to form an EtherChannel:
| Method | Negotiation? | Standard | Notes |
|---|---|---|---|
Static (mode on) | No negotiation at all | Cisco proprietary behavior | Risky — if misconfigured on one side, it can cause a bridging loop with no protection |
| PAgP | Yes | Cisco proprietary | Legacy; being phased out industry-wide |
| LACP | Yes | IEEE 802.3ad / 802.1AX (open standard) | Industry standard; works across multi-vendor environments |
Because LACP is an open standard and provides safe negotiation (mismatches are detected instead of silently causing loops), it is the recommended and most commonly tested method. We will focus on LACP throughout this article.
LACP Modes
| Mode | Behavior |
|---|---|
active | Actively sends LACP packets to try to negotiate a channel |
passive | Waits for the other side to initiate negotiation; won’t initiate itself |
on | No LACP at all — static bundling (not actually LACP) |
Critical rule: At least one side must be active. Two passive sides will never form a channel because both are waiting for the other to speak first.
| Side A | Side B | Result |
|---|---|---|
| active | active | ✅ Forms channel |
| active | passive | ✅ Forms channel |
| passive | passive | ❌ Does NOT form |
| on | on | ✅ Forms (static, no LACP) |
| on | active/passive | ❌ Does NOT form (mismatched methods) |
Requirements for Ports to Bundle Successfully
All physical ports in an EtherChannel bundle must match on these parameters, or the port will be suspended/excluded from the bundle:
- Speed
- Duplex
- Trunk encapsulation mode (if trunked)
- Native VLAN (if trunked)
- Allowed VLAN list (if trunked)
- Access/trunk mode (all ports must be configured the same way)
- STP settings (portfast, etc., should be consistent)
Layer 2 EtherChannel Configuration (Switched)
Let’s configure a Layer 2 EtherChannel between two switches, SW1 and SW2, using two Gigabit links (Gi0/1 and Gi0/2) bundled into Port-Channel 1, running as an 802.1Q trunk.
Topology
graph LR
SW1["SW1"] ---|Gi0/1| SW2["SW2"]
SW1 ---|Gi0/2| SW2
SW1 -.->|"Po1 (Logical Bundle)"| SW2
Step 1: Configure SW1
SW1(config)# interface range GigabitEthernet0/1 - 2
SW1(config-if-range)# channel-group 1 mode active
SW1(config-if-range)# exit
SW1(config)# interface Port-channel 1
SW1(config-if)# switchport trunk encapsulation dot1q
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk allowed vlan 10,20,30Step 2: Configure SW2 (Matching Configuration)
SW2(config)# interface range GigabitEthernet0/1 - 2
SW2(config-if-range)# channel-group 1 mode active
SW2(config-if-range)# exit
SW2(config)# interface Port-channel 1
SW2(config-if)# switchport trunk encapsulation dot1q
SW2(config-if)# switchport mode trunk
SW2(config-if)# switchport trunk allowed vlan 10,20,30Note: the channel-group number does not have to match between the two switches (SW1 could use group 1 while SW2 uses group 2) — LACP negotiates this independently on each side. However, using matching numbers is a best practice for readability.
Layer 3 EtherChannel Configuration (Routed)
A Layer 3 EtherChannel bundles physical links into a single logical routed interface, which gets its own IP address — commonly used between a switch and a router, or between two Layer 3 switches/routers, especially for OSPF/EIGRP adjacencies over a resilient, high-bandwidth link.
R1(config)# interface range GigabitEthernet0/0 - 1
R1(config-if-range)# no switchport
R1(config-if-range)# channel-group 5 mode active
R1(config-if-range)# exit
R1(config)# interface Port-channel 5
R1(config-if)# no switchport
R1(config-if)# ip address 10.10.10.1 255.255.255.252On the peer device:
R2(config)# interface range GigabitEthernet0/0 - 1
R2(config-if-range)# no switchport
R2(config-if-range)# channel-group 5 mode active
R2(config-if-range)# exit
R2(config)# interface Port-channel 5
R2(config-if)# no switchport
R2(config-if)# ip address 10.10.10.2 255.255.255.252The key difference from Layer 2 EtherChannel is the no switchport command, which converts the physical ports and the Port-Channel interface into routed (Layer 3) mode with a directly assigned IP address.
Verification Commands
show etherchannel summary
This is the single most useful verification command. It shows every channel group, its protocol, and the status of each member port.
SW1# show etherchannel summary
Flags: D - down P - bundled in port-channel
I - stand-alone s - suspended
H - Hot-standby (LACP only)
R - Layer3 S - Layer2
U - in use f - failed to allocate aggregator
M - not in use, minimum links not met
u - unsuitable for bundling
w - waiting to be aggregated
d - default port
Number of channel-groups in use: 1
Number of aggregators: 1
Group Port-channel Protocol Ports
------+-------------+-----------+-----------------------------------------------
1 Po1(SU) LACP Gi0/1(P) Gi0/2(P)Key flags to check:
SUnext to the Port-channel means Layer 2 (S), in Use (U) — a healthy bundle.RUwould mean Layer 3, in Use.(P)next to each physical port means it is successfully bundled.(I)means the port is standalone — NOT bundled — usually a sign of a mismatch.(s)means suspended — often caused by a configuration mismatch (VLANs, speed, duplex, or encapsulation).
show etherchannel port-channel
SW1# show etherchannel port-channel
Channel-group listing:
----------------------
Group: 1
----------
Port-channels in the group:
-----------------------
Port-channel: Po1 (Primary Aggregator)
------------
Age of the Port-channel = 02d:03h:14m:22s
Logical slot/port = 2/1 Number of ports = 2
GC = 0x00010001 HotStandBy port = null
Port state = Port-channel Ag-Inuse
Protocol = LACP
Port security = Disabledshow interfaces port-channel 1
Confirms the logical interface’s status, line protocol, and IP configuration (for Layer 3 EtherChannel).
SW1# show interfaces port-channel 1
Port-channel1 is up, line protocol is up (connected)
Hardware is EtherChannel, address is aabb.cc00.0100 (bia aabb.cc00.0100)
MTU 1500 bytes, BW 2000000 Kbit/sec, DLY 10 usec,Notice the bandwidth: with two Gigabit links bundled, the reported bandwidth is 2,000,000 Kbit/sec (2 Gbps) — confirming the logical aggregation of both physical links.
show lacp neighbor
Shows LACP-specific negotiation details, including partner (neighbor) system ID and port priority — very useful when troubleshooting negotiation failures.
SW1# show lacp neighbor
Flags: S - Device is requesting Slow LACPDUs
F - Device is requesting Fast LACPDUs
A - Device is in Active mode P - Device is in Passive mode
Channel group 1 neighbors
Partner's information:
LACP port Admin Oper Port Port
Port Flags Priority Key Key Number State
Gi0/1 SA 32768 0x1 0x1 0x2 60
Gi0/2 SA 32768 0x1 0x1 0x3 60
Visualizing the LACP Negotiation Process
sequenceDiagram
participant SW1 as SW1 (active)
participant SW2 as SW2 (active/passive)
SW1->>SW2: LACPDU (System ID, Port Priority, Key)
SW2->>SW1: LACPDU (System ID, Port Priority, Key)
SW1->>SW1: Compare parameters (speed, duplex, VLANs)
SW2->>SW2: Compare parameters (speed, duplex, VLANs)
Note over SW1,SW2: If parameters match, ports bundle into Po1
SW1-->>SW2: Channel established - traffic load-balanced across linksLoad Balancing Within the EtherChannel
Traffic isn’t simply duplicated or randomly split — Cisco switches use a hashing algorithm (based on source/destination MAC, IP, or port, depending on platform and configuration) to consistently assign a given flow to one specific physical link, ensuring packets from the same conversation don’t arrive out of order.
Configure the load-balancing method globally:
SW1(config)# port-channel load-balance src-dst-ipCommon load-balancing options include src-mac, dst-mac, src-dst-mac, src-ip, dst-ip, src-dst-ip, and (on newer platforms) Layer 4 port-based hashing.
Comparison Table: LACP vs. PAgP vs. Static
| Feature | LACP | PAgP | Static (ON) |
|---|---|---|---|
| Standard | IEEE 802.3ad/802.1AX | Cisco proprietary | N/A |
| Multi-vendor support | Yes | No (Cisco only) | Yes, but risky |
| Negotiation safety checks | Yes | Yes | No |
| Modes | active, passive | desirable, auto | on |
| Recommended for production | ✅ Yes | ⚠️ Legacy only | ⚠️ Only in tightly controlled labs |
Best Practices
- Always use LACP over static “on” mode in production — negotiation catches misconfigurations before they become loops or outages.
- Configure at least one side as
active— never leave both sides aspassive. - Match all port parameters exactly (speed, duplex, trunk settings, allowed VLANs) across all bundle members before adding them to the channel-group.
- Use descriptive interface descriptions on both physical members and the Port-channel interface for easier troubleshooting.
- Distribute member links across different line cards/ASICs (on modular switches) for true hardware redundancy — bundling both members on the same failing hardware defeats the purpose.
- Verify load balancing hash method aligns with your traffic patterns for even utilization across links.
Troubleshooting EtherChannel
Symptom: Port Shows as “Suspended” (s) or “Independent” (I)
Cause: mismatched configuration on one or more of the following:
- Trunk encapsulation (dot1q vs. ISL)
- Allowed VLAN list
- Native VLAN
- Speed/duplex mismatch
- Switchport mode (access vs. trunk) inconsistency
Fix: Compare show running-config interface on both sides, port by port, and correct any mismatches.
Symptom: Channel Won’t Form At All
Cause: Both sides configured as passive, or mismatched LACP/PAgP modes (e.g., one side on, other side active).
Fix: Set at least one side to active.
Symptom: Traffic Only Uses One Link
Cause: Load-balancing hash results in all traffic hashing to the same link (common in small labs with limited IP/MAC pairs), or the load-balance method isn’t suited to the traffic pattern.
Fix: Change the load-balancing algorithm (port-channel load-balance) to better match traffic diversity (e.g., src-dst-ip instead of src-mac in a routed environment).
Symptom: Intermittent Flapping of the Port-Channel
Cause: Physical layer issues (bad cable, SFP) on one member link causing repeated LACP renegotiation.
Fix: Check show interfaces counters for CRC errors, input/output errors on each member port individually.
Summary
EtherChannel bundles multiple physical links into a single logical interface, giving you more bandwidth and seamless redundancy without STP blocking. LACP (IEEE 802.3ad/802.1AX) is the modern, standards-based way to negotiate these bundles safely across vendors. Whether you configure Layer 2 (switched, trunk) or Layer 3 (routed, IP-addressed) EtherChannel, the underlying member port requirements — matching speed, duplex, and switchport settings — remain the same. Always verify with show etherchannel summary first; it’s the fastest way to confirm a healthy bundle.