interface GigabitEthernet0/0description ## 외부 및 터널 IP ##ip address 172.17.1.1 255.255.255.252no shutdown!interface GigabitEthernet0/1description ## 내부 서버 IP ##ip address 10.20.10.1 255.255.255.0no shutdown
interface GigabitEthernet0/0description ## 외부 및 터널 IP ##ip address 172.17.1.2 255.255.255.252no shutdown!interface GigabitEthernet0/1description ## 내부 서버 IP ##ip address 192.168.1.1 255.255.255.0no shutdown
EtherChannel를 사용하면 여러 물리적 이더넷 링크를 하나의 논리적 채널로 결합하는 기술입니다.
EtherChannel를 통해 데이터 트래픽 로드를 공유할 수 있습니다.
EtherChannel를 사용하여 하나 이상의 링크에 장애가 발생할 경우 이중화가 가능합니다.
EtherChannel을 사용하여 UTP(Unshielded Twisted Pair) 와이어링 또는 단일 모드 및 다중 모드 파이버를 통해 LAN 스위치, 라우터, 서버 및 클라이언트를 연결할 수 있습니다.
단일 용어인 EtherChannel을 사용하는 Fast EtherChannel, Gigabit EtherChannel, Port Channel, Channel Group 및 Port Group을 가리킵니다.이 문서의 정보는 이러한 모든 EtherChannel과 같은 기술입니다.
요구사항
EtherChannel을 사용하기전에 해당 스위치와 포트가 지원이 되는지 확인해야합니다.
Switch#show interfaces Gi2/0/23 capabilities GigabitEthernet2/0/23Model: WS-C3750G-24TType: 10/100/1000BaseTXSpeed: 10,100,1000,autoDuplex: half,full,autoTrunk encap. type: 802.1Q,ISLTrunk mode: on,off,desirable,nonegotiateChannel: yesBroadcast suppression: percentage(0-100)Flowcontrol: rx-(off,on,desired),tx-(none)Fast Start: yesQoS scheduling: rx-(not configurable on per port basis),tx-(4q2t)CoS rewrite: yes ToS rewrite: yesUDLD: yes Inline power: noSPAN: source/destinationPortSecure: yesDot1x: yesSwitch#
EtherChannel 협상 프로토콜 종류
PAgP (Cisco 장비만 사용가능)
LACP (IEEE 802.3ad = 모든 장비 사용가능)
EtherChannel 협상 모드
모드
협상 프로토콜
내용
on
None (둘다)
EtherChannel을 항상 활성화합니다. Workstation/Server에서 협상 프로토콜을 지원하지 않는 경우 권장합니다.
off
None (둘다)
EtherChannel을 항상 비활성화합니다.
active
LACP
LACP 패킷을 전송하여 협상을 시작합니다. Workstation/Server가 LACP를 지원하는 경우 권장됩니다.
passive
LACP
연결된 Peer 장비가 LACP 패킷을 전송하면 협상이 시작됩니다.
desirable
PAgP
PAgP 패킷을 전송하여 협상을 시작합니다. Workstation/Server가 PAgP를 지원하는 경우 권장됩니다.
auto
PAgP
연결된 Peer 장비가 PAgP 패킷을 전송하면 협상이 시작됩니다.
서버와 클라이언트 설정과 맞추면서 NIC 어댑터에서 지원하는 협상 프로토콜에 따라 적절한 모드를 사용합니다.
EtherChannel 설정 (L2)
SW1
#EtherChannel 생성SW1(config)#interface range ethernet 1/2-3SW1(config-if-range)#switchportSW1(config-if-range)#switchport mode trunkW1(config-if-range)#channel-group 1 mode ?active Enable LACP unconditionallyauto Enable PAgP only if a PAgP device is detecteddesirable Enable PAgP unconditionallyon Enable Etherchannel onlypassive Enable LACP only if a LACP device is detectedSW1(config-if-range)#channel-group 1 mode activeCreating a port-channel interface Port-channel 1SW1(config-if-range)#no shutdown#Port-Channel 설정SW1(config)#interface port-channel 1SW1(config-if)#switchportSW1(config-if)#switchport mode trunkSW1(config-if)#no shutdown
SW1#show interfaces po1Port-channel1 is up, line protocol is up (connected)Hardware is EtherChannel, address is aabb.cc00.1031 (bia aabb.cc00.1031)MTU 1500 bytes, BW 20000 Kbit/sec, DLY 1000 usec, reliability 255/255, txload 1/255, rxload 1/255Encapsulation ARPA, loopback not setKeepalive set (10 sec)Full-duplex, Auto-speed, media type is RJ45input flow-control is off, output flow-control is unsupported Members in this channel: Et1/2 Et1/3 ARP type: ARPA, ARP Timeout 04:00:00Last input never, output never, output hang neverLast clearing of "show interface" counters neverInput queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0Queueing strategy: fifoOutput queue: 0/40 (size/max)5 minute input rate 0 bits/sec, 0 packets/sec5 minute output rate 0 bits/sec, 0 packets/sec0 packets input, 0 bytes, 0 no bufferReceived 0 broadcasts (0 multicasts)0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored0 input packets with dribble condition detected966 packets output, 77372 bytes, 0 underruns0 output errors, 0 collisions, 0 interface resets0 unknown protocol drops0 babbles, 0 late collision, 0 deferred0 lost carrier, 0 no carrier0 output buffer failures, 0 output buffers swapped outSW1#SW1# show etherchannel summaryFlags: D - down P - bundled in port-channelI - stand-alone s - suspendedH - Hot-standby (LACP only)R - Layer3 S - Layer2U - in use N - not in use, no aggregationf - failed to allocate aggregatorM - not in use, minimum links not metm - not in use, port not aggregated due to minimum links not metu - unsuitable for bundlingw - waiting to be aggregatedd - default portA - formed by Auto LAGNumber of channel-groups in use: 1Number of aggregators: 1Group Port-channel Protocol Ports------+-------------+-----------+-----------------------------------------------1 Po1(SU) LACP Et1/2(P) Et1/3(P)SW1#
SW2
SW2#show interfaces po1Port-channel1 is up, line protocol is up (connected)Hardware is EtherChannel, address is aabb.cc00.2021 (bia aabb.cc00.2021)MTU 1500 bytes, BW 20000 Kbit/sec, DLY 1000 usec, reliability 255/255, txload 1/255, rxload 1/255Encapsulation ARPA, loopback not setKeepalive set (10 sec)Full-duplex, Auto-speed, media type is RJ45input flow-control is off, output flow-control is unsupported Members in this channel: Et1/2 Et1/3 ARP type: ARPA, ARP Timeout 04:00:00Last input 00:00:00, output never, output hang neverLast clearing of "show interface" counters neverInput queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0Queueing strategy: fifoOutput queue: 0/40 (size/max)5 minute input rate 0 bits/sec, 0 packets/sec5 minute output rate 0 bits/sec, 0 packets/sec820 packets input, 47560 bytes, 0 no bufferReceived 820 broadcasts (0 multicasts)0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored0 input packets with dribble condition detected148 packets output, 24112 bytes, 0 underruns0 output errors, 0 collisions, 0 interface resets0 unknown protocol drops0 babbles, 0 late collision, 0 deferred0 lost carrier, 0 no carrier0 output buffer failures, 0 output buffers swapped outSW2#SW2# show etherchannel summaryFlags: D - down P - bundled in port-channelI - stand-alone s - suspendedH - Hot-standby (LACP only)R - Layer3 S - Layer2U - in use N - not in use, no aggregationf - failed to allocate aggregatorM - not in use, minimum links not metm - not in use, port not aggregated due to minimum links not metu - unsuitable for bundlingw - waiting to be aggregatedd - default portA - formed by Auto LAGNumber of channel-groups in use: 1Number of aggregators: 1Group Port-channel Protocol Ports------+-------------+-----------+-----------------------------------------------1 Po1(SU) LACP Et1/2(P) Et1/3(P)SW2#
Switch에서 포트에 대해 장애 및 에러유무를 주기적으로 모니터링하며 에러가 발생하면 자동으로 포트가 Errdisabled 상태로 변경되며 Shutdown 상태가 됩니다. 이후 관리자가 조치를 취할 수 있도록 Event Log를 발생시켜줍니다.
Errdisabled 포트를 복구하려면 해당 포트에서 no shutdown 명령어를 입력해주어야 합니다.
Errdisable Detect 설정
장비마다 다르지만 아래와 같이 설정 가능한 옵션들이 많이 있습니다.여기서 자주 사용하는 옵션만 설명 드리겠습니다.Switch(config)#errdisable detect cause ?all Enable error detection on all casesarp-inspection Enable error detection for arp inspectiondhcp-rate-limit Enable error detection on dhcp-rate-limitdtp-flap Enable error detection on dtp-flappinggbic-invalid Enable error detection on gbic-invalidinline-power Enable error detection for inline-powerl2ptguard Enable error detection on l2protocol-tunnellink-flap Enable error detection on linkstate-flappingloopback Enable error detection on loopbackpagp-flap Enable error detection on pagp-flappingpppoe-ia-rate-limit Enable error detection on PPPoE IA rate-limitpsp Enable error detection on PSPsecurity-violation Enable error detection on 802.1x-guardsfp-config-mismatch Enable error detection on SFP config mismatch
Switch(config)#errdisable detect cause all모든 옵션을 포함합니다.Switch(config)#errdisable detect cause dtp-flap스위치를 Trunk로 연결했을 경우 trunk는 access 와 다르게 모든 VLAN 트래픽을 실어나르기 때문에 어떤 VLAN에 속하는지 표시해주는 헤더가 필요한데 두 스위치가 사용하는 encapsulation 설정이 다를 경우 발생합니다.Switch(config)#errdisable detect cause link-flap짧은 시간동안 스위치 포트가 Up/Down을 반복할 떄 발생합니다.Switch(config)#errdisable detect cause pagp-flap스위치간 Etherchannel 구성을 통해 여러개의 포트를 하나로 묶었을 때 묶음 조건이 다를 경우(ex=duplex)Switch(config)#errdisable detect cause udldSTP프로토콜이 동작하기 위해 양방향 BPDU 프레임 교환이 필요한 스위치 연결에서 단방향 연결만 가능하여 STP프로토콜이 제대로 동작할 수 없을 경우에 발생합니다.Switch(config)#errdisable detect cause rootguardSTP프로토콜의 root 역활을 하는 스위치에 root 스위치로부터 BPDU 프레임이 도착한 경우에 발생합니다.
자동으로 Errdisable 포트를 복구하는 명령어에 대해서 알아볼게요.
errdisable recovery 설정
Switch(config)#errdisable recovery cause ?all Enable timer to recover from all error causesarp-inspection Enable timer to recover from arp inspection error disable statebpduguard Enable timer to recover from BPDU Guard errorchannel-misconfig (STP) Enable timer to recover from channel misconfig errordhcp-rate-limit Enable timer to recover from dhcp-rate-limit errordtp-flap Enable timer to recover from dtp-flap errorgbic-invalid Enable timer to recover from invalid GBIC errorinline-power Enable timer to recover from inline-power errorl2ptguard Enable timer to recover from l2protocol-tunnel errorlink-flap Enable timer to recover from link-flap errorlink-monitor-failure Enable timer to recover from link monitoring failureloopback Enable timer to recover from loopback errormac-limit Enable timer to recover from mac limit disable stateoam-remote-failure Enable timer to recover from OAM detected remote failurepagp-flap Enable timer to recover from pagp-flap errorport-mode-failure Enable timer to recover from port mode change failurepppoe-ia-rate-limit Enable timer to recover from PPPoE IA rate-limit errorpsecure-violation Enable timer to recover from psecure violation errorpsp Enable timer to recover from pspsecurity-violation Enable timer to recover from 802.1x violation errorsfp-config-mismatch Enable timer to recover from SFP config mismatch errorstorm-control Enable timer to recover from storm-control errorudld Enable timer to recover from udld errorunicast-flood Enable timer to recover from unicast flood errorvmps Enable timer to recover from vmps shutdown error
Switch(config)#errdisable recovery cause all (all대신에 하나씩 사용 가능합니다.)Switch(config)#errdisable recovery interval 30 (기본 복구시간은 300초이고 30~86400초까지 설정가능합니다.)
테스트로 포트를 Errdisable 상태로 만들고 자동 복구가 되는지 확인해봤습니다.
*Jul 9 15:39:44.822: %PM-4-ERR_DISABLE: psecure-violation error detected on Et0/0, putting Et0/0 in err-disable state*Jul 9 15:39:44.822: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 0050.7966.6802 on port Ethernet0/0.*Jul 9 15:39:45.822: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet0/0, changed state to down*Jul 9 15:39:46.823: %LINK-3-UPDOWN: Interface Ethernet0/0, changed state to down
Switch#show errdisable recoveryErrDisable Reason Timer Status----------------- --------------arp-inspection Enabledbpduguard Enabledchannel-misconfig (STP) Enableddhcp-rate-limit Enableddtp-flap Enabledgbic-invalid Enabledinline-power Enabledl2ptguard Enabledlink-flap Enabledmac-limit Enabledlink-monitor-failure Enabledloopback Enabledoam-remote-failure Enabledpagp-flap Enabledport-mode-failure Enabledpppoe-ia-rate-limit Enabledpsecure-violation Enabledsecurity-violation Enabledsfp-config-mismatch Enabledstorm-control Enabledudld Enabledunicast-flood Enabledvmps Enabledpsp Enableddual-active-recovery DisabledTimer interval: 30 secondsInterfaces that will be enabled at the next timeout:Interface Errdisable reason Time left(sec)--------- ----------------- --------------Et0/0 psecure-violation 19
*Jul 9 15:40:14.813: %PM-4-ERR_RECOVER: Attempting to recover from psecure-violation err-disable state on Et0/0*Jul 9 15:40:16.813: %LINK-3-UPDOWN: Interface Ethernet0/0, changed state to up*Jul 9 15:40:17.813: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet0/0, changed state to up
