This chapter covers link aggregation using the IEEE 802.3ad standard (LACP) and Cisco's proprietary PAgP, both of which combine multiple physical Ethernet links into a single logical trunk to increase bandwidth and provide redundancy. For the N10-009 exam, link aggregation appears in approximately 8-12% of questions within Domain 2.0 (Network Implementation), specifically under Objective 2.1 (Install and configure network devices and technologies). Understanding the differences between LACP and PAgP, their negotiation modes, and how they interact with spanning tree and VLANs is critical for both the exam and real-world network design.
Jump to a section
Imagine a highway connecting two cities that needs more capacity than a single lane can provide. Instead of building one massive 10-lane road, engineers build 10 separate lanes and assign a traffic controller at each end that coordinates them into a single logical highway. Each lane can carry its own cars independently, but the controllers (LACP or PAgP) use a signaling protocol to ensure both ends agree on which lanes belong to the same logical bundle. When a car (frame) arrives, the controller assigns it to one of the lanes using a hash of its license plate (source/destination MAC/IP) to keep all cars from the same trip on the same lane (in-order delivery). If a lane gets damaged (link failure), the controller immediately redistributes traffic to the remaining lanes without disrupting the logical connection. The controllers periodically exchange hello messages (LACPDUs) every second to confirm lanes are healthy. Without this coordination, one end might think 5 lanes are bundled while the other thinks 10, causing frames to be dropped or misrouted. The protocol ensures both ends are perfectly synchronized on the bundle membership and operational parameters.
What is Link Aggregation?
Link Aggregation, also known as port trunking or NIC teaming, combines multiple physical Ethernet links into a single logical link. This provides:
Increased aggregate bandwidth beyond a single link (e.g., four 1 Gbps links = 4 Gbps logical link)
Load balancing of traffic across member links
Redundancy: if one link fails, traffic is redistributed to remaining links
No need for Spanning Tree Protocol (STP) to block redundant links — the bundle is treated as one logical interface
The IEEE standard is 802.3ad (later 802.1AX), commonly called LACP (Link Aggregation Control Protocol). Cisco also offers a proprietary version called PAgP (Port Aggregation Protocol). Both accomplish the same goal but are not interoperable.
How LACP Works (IEEE 802.3ad/802.1AX)
LACP uses frames called LACPDUs (Link Aggregation Control Protocol Data Units) exchanged between switches to negotiate the formation of a link aggregation group (LAG).
Key concepts: - Actor: The local switch sending LACPDUs - Partner: The remote switch receiving LACPDUs - System ID: A 64-bit value combining switch priority (2 bytes) and MAC address (6 bytes) - Port ID: A 16-bit value combining port priority (2 bytes) and port number (2 bytes) - Admin Key: A 16-bit value that identifies the aggregation group the port belongs to (configured by the administrator) - Oper Key: A 16-bit value that is the actual key used for aggregation after negotiation
LACP PDU format (simplified): - Subtype = 0x01 for LACP - Version = 1 - Actor Information (TLV): System Priority, System MAC, Port Priority, Port Number, Key, State (Activity, Timeout, Aggregation, Synchronization, Collecting, Distributing, Default, Expired) - Partner Information (TLV): Same fields for the remote side - Collector Information: Max delay (used for collecting frames) - Terminator TLV
LACP State Flags (8 bits): - Bit 0: LACP_Activity (1=active, 0=passive) - Bit 1: LACP_Timeout (1=short timeout, 0=long timeout) - Bit 2: Aggregation (1=port can be aggregated, 0=standalone) - Bit 3: Synchronization (1=port is in sync with partner, 0=not in sync) - Bit 4: Collecting (1=port is ready to receive frames) - Bit 5: Distributing (1=port is ready to send frames) - Bit 6: Default (1=using default partner info, 0=received partner info) - Bit 7: Expired (1=partner info is aged out)
LACP Modes: - Active: The port actively sends LACPDUs every second (default). This is the mode that initiates negotiation. - Passive: The port only responds to LACPDUs but does not initiate. A passive port will not form a LAG with another passive port — at least one side must be active.
LACP Timeouts: - Short timeout (3 seconds): Used when fast failure detection is needed. LACPDUs are sent every 1 second; partner info expires after 3 missed PDUs. - Long timeout (90 seconds): Default. LACPDUs sent every 30 seconds; partner info expires after 90 seconds.
LACP Negotiation Process: 1. An active port sends LACPDUs with its system and port information, including its state flags (Activity=Active, Timeout=Long, Aggregation=Yes, Sync=No, Collecting=No, Distributing=No). 2. The passive port receives the PDU and responds with its own information, setting its Activity flag to Passive. 3. Both ports compare each other's system ID and port IDs. The system with the lower system priority (or lower MAC if equal) becomes the aggregator. The aggregator's key is used as the operational key. 4. Once both sides agree on the aggregation parameters, they set the Sync flag to 1, then the Collecting and Distributing flags to 1. The LAG becomes operational. 5. LACPDUs continue to be exchanged periodically to maintain the link. If a PDU is missed for the timeout period, the link is considered down and removed from the LAG.
How PAgP Works (Cisco Proprietary)
PAgP (Port Aggregation Protocol) is Cisco's pre-standard implementation, defined before IEEE 802.3ad. It is not interoperable with LACP. PAgP uses Cisco Discovery Protocol (CDP) messages to exchange aggregation information.
PAgP Modes: - Desirable: The port actively sends PAgP packets and tries to form an EtherChannel. Equivalent to LACP Active. - Auto: The port only responds to PAgP packets but does not initiate. Equivalent to LACP Passive. - On: The port is forced into the channel without negotiation. Both ends must be set to On for the channel to form. No negotiation occurs.
PAgP Negotiation: - PAgP uses CDP packets with a type code of 0x2000 (PAgP). - The packets contain the system ID, port ID, and capabilities. - The negotiation follows similar logic to LACP: both sides exchange information, and the switch with the lower bridge ID (priority + MAC) becomes the aggregator. - PAgP does not have the concept of keys; instead, it uses the channel-group number directly.
PAgP Timers: - PAgP packets are sent every 30 seconds (default). - If 3 consecutive packets are missed (90 seconds), the port is considered down.
Configuration and Verification
LACP Configuration on Cisco IOS:
interface GigabitEthernet0/1
channel-group 1 mode active
interface GigabitEthernet0/2
channel-group 1 mode active
interface Port-channel1
switchport mode trunkPAgP Configuration:
interface GigabitEthernet0/1
channel-group 1 mode desirable
interface GigabitEthernet0/2
channel-group 1 mode desirable
interface Port-channel1
switchport mode trunkVerification Commands:
- show etherchannel summary – Displays port-channel status, member ports, and protocol (LACP or PAgP)
- show etherchannel port-channel – Detailed info about the port-channel interface
- show lacp neighbor – Shows LACP neighbor details, including system ID, port ID, and state flags
- show pagp neighbor – Shows PAgP neighbor details
- show interfaces port-channel 1 – Shows interface statistics and bandwidth
Example Output:
Switch# show etherchannel summary
Flags: D - down P - in port-channel
I - stand-alone s - suspended
H - Hot-standby (LACP only)
R - Layer3 S - Layer2
U - in use f - failed to allocate aggregator
u - unsuitable for bundling
w - waiting to be aggregated
d - default port
Number of channel-groups in use: 1
Number of aggregators: 1
Group Port-channel Protocol Ports
------+-------------+-----------+----------------------------------------------
1 Po1(SU) LACP Gi0/1(P) Gi0/2(P)Interaction with Related Technologies
Spanning Tree Protocol (STP): STP treats the entire port-channel as a single logical link. STP runs on the port-channel interface, not on individual member links. This prevents loops while allowing redundancy within the bundle.
VLANs: A port-channel can be configured as a trunk (802.1Q) carrying multiple VLANs. All member ports must have the same VLAN configuration (same allowed VLANs, same native VLAN). Mismatched VLAN configurations can cause the channel to fail to form.
Load Balancing: Traffic distribution across member links is based on a hash algorithm using source/destination MAC, IP, or TCP/UDP port numbers. The hash is computed per frame/packet, and all frames in a flow use the same link to maintain ordering. Common hash algorithms include: - src-mac - dst-mac - src-dst-mac - src-ip - dst-ip - src-dst-ip - src-port - dst-port - src-dst-port
MTU: The MTU of the port-channel interface applies to all member links. All member links should have the same MTU setting.
Maximum Number of Links
LACP: Up to 16 links can be in a port-channel, but only up to 8 can be active at once. The remaining 8 can be in hot-standby mode (if configured).
PAgP: Up to 8 links can be active. No standby mechanism.
Static (On mode): Up to 8 links.
Important Defaults
LACP system priority: 32768 (configurable)
LACP port priority: 32768 (configurable)
LACP long timeout: 30 second PDU interval, 90 second expiration
LACP short timeout: 1 second PDU interval, 3 second expiration
PAgP PDU interval: 30 seconds
PAgP expiration: 90 seconds (3 missed PDUs)
Determine Aggregation Need
A network engineer identifies that a link between two switches is saturated (e.g., 90% utilization on a 1 Gbps link). Instead of upgrading to 10 Gbps hardware, the engineer decides to bond four 1 Gbps links using LACP. The physical ports (e.g., Gi0/1-4) are identified on both switches. The engineer verifies that all ports have the same speed and duplex settings (auto-negotiation should be disabled or consistent). The VLAN configuration must match: all ports are set to trunk mode with identical allowed VLANs. This step also involves planning the load-balancing hash algorithm, typically src-dst-ip for routed traffic or src-dst-mac for switched traffic. The engineer documents the planned port-channel number (e.g., 1) and the LACP mode (active on both sides).
Configure Port-Channel Interface
On both switches, the engineer creates the logical port-channel interface using the command 'interface port-channel 1'. This interface inherits the Layer 2 or Layer 3 configuration. For a trunk, the engineer applies 'switchport mode trunk' and optionally 'switchport trunk allowed vlan all'. The port-channel interface must exist before or concurrently with member port configuration. If the port-channel does not exist, the member ports will remain in standalone mode. The engineer also sets the load-balancing method globally or per port-channel using 'port-channel load-balance src-dst-ip' (global) or 'lacp port-priority' (to influence active port selection).
Assign Physical Ports to Channel
On each physical interface (e.g., Gi0/1), the engineer enters interface configuration mode and issues 'channel-group 1 mode active'. This command assigns the port to port-channel 1 and sets LACP to active mode. The switch immediately starts sending LACPDUs on that port every second (if using short timeout) or every 30 seconds (long timeout). The engineer repeats this for Gi0/2, Gi0/3, and Gi0/4. The switch validates that the physical ports have compatible configurations: same speed, duplex, VLAN settings, and STP port type. If any mismatch is detected, the port is placed in 'suspended' state and does not join the channel. The engineer verifies with 'show etherchannel summary' to see the ports in 'P' (in port-channel) state.
LACP Negotiation and Synchronization
LACPDUs are exchanged between the two switches. Each switch sends its system priority (default 32768) and MAC address. The switch with the lower system priority becomes the aggregator. If equal, the lower MAC address wins. The aggregator's key is used as the operational key. The ports transition through states: initially, the Sync flag is 0, Collecting and Distributing are 0. Once both sides agree on the aggregation parameters (keys, port IDs), the Sync flag is set to 1. Then Collecting and Distributing flags become 1, and the port becomes active in the LAG. This process takes a few seconds (typically 3-5 seconds). The engineer can monitor progress with 'show lacp neighbor' to see the state flags. If a port fails to synchronize, the Expired flag may appear, indicating a timeout.
Verification and Load Balancing
After the LAG is established, the engineer verifies the port-channel is operational. Commands: 'show etherchannel summary' shows the port-channel as SU (Layer2 in use), 'show interfaces port-channel 1' shows the aggregated bandwidth (e.g., 4 Gbps). The engineer tests load balancing by generating traffic (e.g., iperf or pings) and checks 'show etherchannel load-balance' to confirm the hash algorithm. The engineer also tests redundancy by disabling one member link (e.g., 'shutdown' on Gi0/1). The remaining three links continue forwarding traffic; the 'show etherchannel summary' shows the failed port as 'D' (down) and the channel bandwidth drops to 3 Gbps. The engineer confirms that no traffic loss occurred (except for packets in transit on the failed link). Finally, the engineer brings the link back up and verifies it rejoins the LAG.
In enterprise data centers, link aggregation is ubiquitous. Here are two common deployment scenarios:
1. Server-to-Switch Aggregation (NIC Teaming): A web server with four 1 Gbps NICs is connected to a top-of-rack (ToR) switch. The server's OS (e.g., Windows Server or Linux) uses LACP (mode 802.3ad) to bond the four NICs into a single logical interface with 4 Gbps throughput. The switch ports are configured as LACP active. The load-balancing hash on the server is typically based on source and destination IP addresses. This setup provides both increased bandwidth and failover: if one NIC or cable fails, traffic continues on the remaining three. A common misconfiguration is mismatched speed or duplex on one NIC, causing the link to be suspended. The engineer must ensure all NICs are set to the same speed (1 Gbps full duplex) and that the switch ports match. Another issue is VLAN mismatch: if the switch trunk allows VLANs 10,20,30 but the server is configured for VLAN 10 only, the LAG may form but traffic for VLAN 20/30 will be dropped. The solution is to configure the port-channel as a trunk with matching allowed VLANs.
2. Switch-to-Switch Uplink Aggregation: In a campus network, two distribution switches are connected via four 10 Gbps fiber links. The links are aggregated using LACP to form a 40 Gbps logical uplink. The configuration on both switches uses LACP active mode. The load-balancing algorithm is set to src-dst-ip because traffic is Layer 3 (routed). The port-channel is configured as a trunk carrying multiple VLANs. The network engineer also configures the port-channel as a member of a spanning tree instance (e.g., Rapid PVST+), and STP treats the LAG as a single link. A failure scenario: one fiber link is accidentally cut. LACP detects the loss of LACPDUs within 3 seconds (if short timeout is configured) and removes the link from the LAG. The remaining three links continue to carry traffic without STP reconvergence. However, if LACP is not used and the link is configured in 'on' mode, a unidirectional link failure (one direction works, other fails) can cause a loop because the switch on the working side still thinks the link is up. LACP's continuous handshake prevents this by detecting the loss of PDUs in both directions. This is why LACP is strongly recommended over static 'on' mode.
3. Cloud Provider Leaf-Spine Fabric: In a modern leaf-spine architecture, each leaf switch connects to each spine switch via multiple 100 Gbps links aggregated into a 400 Gbps LAG. The configuration uses LACP with short timeout (1 second) for fast convergence. The load-balancing algorithm is often 'src-dst-ip' to spread flows across all links. The spine switches are configured with LACP passive to reduce PDU overhead (since leaves initiate). A common issue is when a leaf switch's LACP system priority is accidentally set too high, causing a different leaf to become the aggregator and disrupting traffic. The engineer must ensure consistent system priority across all switches. Also, the maximum of 8 active links per LAG is a hard limit; if more than 8 links are needed, the engineer must use multiple LAGs or upgrade to higher-speed interfaces.
The N10-009 exam tests link aggregation under Objective 2.1 (Install and configure network devices and technologies). Expect 2-4 questions covering LACP and PAgP modes, negotiation, and troubleshooting. Key areas:
1. LACP vs PAgP Modes: The exam loves to ask which modes can form a channel. Remember: Active+Active, Active+Passive, Passive+Passive (will NOT form). Similarly, Desirable+Desirable, Desirable+Auto, Auto+Auto (will NOT form). The 'on' mode is static and requires both ends to be 'on'.
2. Common Wrong Answers: Candidates often confuse LACP Active with PAgP Desirable, or think Passive+Passive works (it doesn't — both sides wait for the other to initiate). Another trap: thinking that LACP and PAgP can interoperate — they cannot. Also, some think that link aggregation eliminates the need for STP altogether — false; STP still runs on the port-channel interface.
3. Specific Numbers: Know these verbatim: LACP short timeout = 1 second PDU interval, 3 second expiration. Long timeout = 30 second PDU interval, 90 second expiration. PAgP sends PDUs every 30 seconds, expires after 90 seconds. Maximum active links = 8 for both LACP and PAgP (LACP supports up to 16 ports but only 8 active, 8 standby). Default LACP system priority = 32768. Default port priority = 32768.
4. Edge Cases: The exam may test that a port in 'passive' mode will not form a channel with another passive port. Also, if a member port has a different VLAN configuration (e.g., different native VLAN), the port will be suspended. The exam might ask about load-balancing methods: the default is src-dst-mac for Layer 2, src-dst-ip for Layer 3. A question might present a scenario where all traffic uses one link in a LAG — the cause is likely a poorly chosen hash algorithm (e.g., using src-mac when all traffic comes from one source MAC).
5. Eliminating Wrong Answers: If a question asks which protocol provides 'automatic negotiation and fault detection', eliminate 'static' (on mode) because it lacks negotiation. If a question asks for 'Cisco proprietary', eliminate LACP (it's IEEE standard). If a question mentions 'hot-standby' links, it must be LACP (PAgP does not have standby). Use the underlying mechanism: LACP uses LACPDUs, PAgP uses CDP. The exam may show a 'show etherchannel summary' output and ask you to identify the protocol based on the flags (LACP shows 'L', PAgP shows 'P').
Link aggregation combines multiple physical links into one logical link for increased bandwidth and redundancy.
LACP is IEEE 802.3ad standard; PAgP is Cisco proprietary — they are not interoperable.
LACP modes: Active (initiates) and Passive (responds). At least one side must be Active.
PAgP modes: Desirable (initiates) and Auto (responds). At least one side must be Desirable.
Static 'on' mode requires manual configuration on both ends with no negotiation.
Maximum active links per LAG: 8 for both LACP and PAgP (LACP allows 8 additional standby).
LACP short timeout: PDUs every 1s, expiration after 3s. Long timeout: PDUs every 30s, expiration after 90s.
All member ports must have identical speed, duplex, VLAN configuration, and trunk settings.
Load balancing is per flow (hash of src/dst MAC, IP, or port) — not per packet.
STP treats the LAG as a single link, preventing loops while allowing link redundancy.
Default LACP system priority is 32768; default port priority is 32768.
Verification commands: show etherchannel summary, show lacp neighbor, show pagp neighbor.
These come up on the exam all the time. Here's how to tell them apart.
LACP (IEEE 802.3ad)
Open standard (IEEE 802.3ad/802.1AX)
Supports up to 16 ports per group (8 active, 8 standby)
Uses LACPDUs with subtype 0x01
Modes: Active (initiates) and Passive (responds)
Configurable timeout: short (1s/3s) or long (30s/90s)
PAgP (Cisco Proprietary)
Cisco proprietary, not interoperable with other vendors
Supports up to 8 active ports, no standby
Uses CDP packets with type 0x2000
Modes: Desirable (initiates) and Auto (responds)
Fixed timeout: 30s PDU interval, 90s expiration
Mistake
Link aggregation doubles bandwidth for a single TCP connection.
Correct
Link aggregation load-balances per flow, not per packet. A single TCP connection uses one link (based on hash of source/destination IPs and ports). It cannot exceed the bandwidth of a single member link. Aggregate bandwidth is only realized with multiple concurrent flows.
Mistake
LACP and PAgP can be used together on the same port-channel.
Correct
They are not interoperable. A port-channel must use either LACP on both ends or PAgP on both ends. Mixing protocols will prevent the channel from forming. Some switches support both protocols but only one per port-channel.
Mistake
All ports in a LAG must have the same speed and duplex.
Correct
True for proper operation. Mismatched speed/duplex will cause the port to be suspended or the channel to fail. The exam expects that all member ports must be identical in speed, duplex, and VLAN configuration.
Mistake
LACP passive mode never sends any packets.
Correct
Passive mode sends LACPDUs in response to received PDUs from an active partner. It does not initiate, but it does transmit. A passive port will not send PDUs until it receives one from the other side.
Mistake
Link aggregation eliminates the need for Spanning Tree Protocol.
Correct
STP still runs on the port-channel interface to prevent loops with other switches. The LAG itself is treated as a single link, so STP does not block member ports, but the overall topology still requires STP.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
LACP Active mode sends LACPDUs to initiate the formation of a link aggregation group. Passive mode only responds to received LACPDUs but does not initiate. For a LAG to form, at least one side must be Active. If both sides are Passive, no PDUs are exchanged and the LAG will not form. This is a common exam question — remember 'Active+Active' or 'Active+Passive' works, 'Passive+Passive' does not.
Yes, LACP is an IEEE standard (802.3ad) and is supported by virtually all enterprise switch vendors. However, PAgP is Cisco proprietary and only works between Cisco devices. For multi-vendor environments, always use LACP. On the exam, if a question involves mixed vendors, the answer is LACP.
LACP detects the failure when it misses three consecutive LACPDUs (or based on the configured timeout). The failed link is removed from the LAG, and traffic is redistributed across the remaining active links. The logical port-channel remains up as long as at least one link is active. There is no disruption to existing flows except those that were using the failed link.
Load balancing uses a hash algorithm on fields like source/destination MAC (Layer 2), source/destination IP (Layer 3), or TCP/UDP ports (Layer 4). The hash is computed per frame/packet, and all frames in a flow (same src/dst IP and ports) use the same link to maintain packet order. The default hash is src-dst-mac for Layer 2 interfaces and src-dst-ip for Layer 3 interfaces.
For both LACP and PAgP, the maximum number of active links is 8. LACP supports up to 16 ports in a group, but only 8 can be active; the remaining 8 can be in hot-standby mode. PAgP does not support standby; only 8 ports total. Static 'on' mode also supports 8 links.
Ports are suspended due to configuration mismatches. Common causes: different speed/duplex settings, mismatched VLAN configurations (allowed VLANs or native VLAN differ), or incompatible trunk modes. Check that all member ports have identical settings. Also ensure that LACP or PAgP modes are compatible (e.g., not Passive+Passive).
'On' mode is static — it forces the port into the channel without any negotiation. Both ends must be configured with 'on' for the channel to form. LACP and PAgP use dynamic negotiation to verify compatibility and automatically detect failures. 'On' mode does not detect unidirectional link failures, which can cause loops. The exam considers 'on' mode as less reliable than dynamic protocols.
You've just covered Link Aggregation: LACP and PAgP — now see how well it sticks with free N10-009 practice questions. Full explanations included, no account needed.
Done with this chapter?