Cisco: Storm-control configuration put interface in port-channel in suspended state

Question

I recently ran across an issue where the storm-control that was configured on my port-channel interfaces caused the physical interfaces to go into a suspended state.

Hardware: 3 stacked 3850 (IOS XE release 3.7.3E) access switches connecting to a Juniper legacy core and a new 6807-XL core

Interface/EtherChannel configuration:

    interface GigabitEthernet1/1/1
     description Uplink to 6807
     switchport trunk native vlan 2248
     switchport trunk allowed vlan 2106,2248,2510
     switchport mode trunk
     load-interval 30
     auto qos trust 
     channel-protocol lacp
     channel-group 1 mode active
     service-policy input AutoQos-4.0-Trust-Cos-Input-Policy
     service-policy output AutoQos-4.0-Output-Policy
    end

    interface GigabitEthernet2/1/1
     description Uplink to 6807
     switchport trunk native vlan 2248
     switchport trunk allowed vlan 2106,2248,2510
     switchport mode trunk
     load-interval 30
     auto qos trust 
     channel-protocol lacp
     channel-group 1 mode active
     service-policy input AutoQos-4.0-Trust-Cos-Input-Policy
     service-policy output AutoQos-4.0-Output-Policy
    end

    interface Port-channel1
     description Uplink to 6807
     switchport trunk native vlan 2248
     switchport trunk allowed vlan 2106,2248,2510
     switchport mode trunk
     logging event trunk-status
     storm-control broadcast level 50.00
     storm-control multicast level 50.00
     storm-control unicast level 50.00
    end

and

    interface GigabitEthernet1/1/2
     description Legacy Network
     switchport trunk allowed vlan 12,30,50,111
     switchport mode trunk
     load-interval 30
     auto qos trust 
     no cdp enable
     channel-protocol lacp
     channel-group 2 mode active
     service-policy input AutoQos-4.0-Trust-Cos-Input-Policy
     service-policy output AutoQos-4.0-Output-Policy
    end

    interface GigabitEthernet2/1/2
     description Legacy Network
     switchport trunk allowed vlan 12,30,50,111
     switchport mode trunk
     load-interval 30
     auto qos trust 
     no cdp enable
     channel-protocol lacp
     channel-group 2 mode active
     service-policy input AutoQos-4.0-Trust-Cos-Input-Policy
     service-policy output AutoQos-4.0-Output-Policy
    end

    interface Port-channel2
     description Legacy Network
     switchport trunk allowed vlan 12,30,50,111
     switchport mode trunk
     logging event trunk-status
     storm-control broadcast level 50.00
     storm-control multicast level 50.00
     storm-control unicast level 50.00
    end

show etherchannel detail revealed that storm-control (broadcast suppression) was the issue:

                Channel-group listing: 
                ----------------------

Group: 1 
----------
Group state = L2 
Ports: 2   Maxports = 16
Port-channels: 1 Max Port-channels = 16
Protocol:   LACP
Minimum Links: 0

                Ports in the group:
                -------------------
Port: Gi1/1/1
------------

Port state    = Up Cnt-bndl Suspend Not-in-Bndl 
Channel group = 1           Mode = Active          Gcchange = -
Port-channel  = null        GC   =   -             Pseudo port-channel = Po1
Port index    = 0           Load = 0x00            Protocol =   LACP

Flags:  S - Device is sending Slow LACPDUs   F - Device is sending fast LACPDUs.
        A - Device is in active mode.        P - Device is in passive mode.

Local information:
                            LACP port     Admin     Oper    Port        Port
Port      Flags   State     Priority      Key       Key     Number      State
Gi1/1/1   SA      susp      32768         0x1       0x0     0x132       0x45  

Age of the port in the current state: 0d:00h:10m:48s

Probable reason: Broadcast suppression: Level of Gi1/1/1 is not configured. Level of Po1 is 
50.00%, 50.00%.

<output omitted>

I ended up removing storm-control on both port-channels because I was working in a limited window of time (cutover) and the link lights turned green and started passing traffic. I haven't been able to find much about this regarding why the interfaces went into a suspended state, as this is not the default behavior of storm-control or etherchannel (to my knowledge).

Also, interfaces Gi2/1/1 (to 6807) and Gi2/1/2 (to legacy) were not connected because not enough fiber was ran to accommodate this, but it is anticipated to happen in the future. So, I'm not sure if that has something to do with it:

• Gi1/1/1 is part of Port-channel1 to the 6807 core
• Gi1/1/2 is part of Port-channel2 to the legacy core

The show etherchannel summary:

switch#show etherchannel summary

<output omitted>

Group  Port-channel  Protocol    Ports
------+-------------+-----------+-----------------------------------------------
1      Po1(SU)         LACP      Gi1/1/1(P)  Gi2/1/1(D)  
2      Po2(SU)         LACP      Gi1/1/2(P)  Gi2/1/2(D)  

Any insight as to why Gi1/1/1 and Gi1/1/2 were in a suspended state because of storm-control would be appreciated. Thanks in advance.

Answer 1

Except for BPDUs, traffic storm control does not differentiate between control traffic and data traffic.

Catalyst 6500 Release 12.2SX Software Configuration Guide

Thus, storm-control can cause LACP to fail. Personally, I don't use LACP for infrastructure links.

(You'll have to hunt down documentation for your specific hardware and software to see what's what.)