Port Channel Hybrid Port Issue

Question

I have a Dell Sonicwall NSA 4600 running the latest firmware with an Interface that's configured to have a secondary redundant port. This interface also has a VLAN sub interface assigned to it.

On the switch, a Dell S4048-ON, there is a Port Channel configured with the two physical interfaces connected to the Sonicwall. This Port Channel is a hybrid switchport with one untagged and one tagged VLAN.

I'm having issues with traffic when I connect a client to the switch on either the tagged or untagged VLAN uplink to the Firewall. I can't ping the Firewall's Interfaces when setting the clients IP statically in either VLAN.

If I do this same configuration but on a single physical interface, and thus no Port Channel, it works as I'd expect.

Is there something I'm missing here when trying to introduce a Port Channel?

Let me know if there's anymore info I can provide that might be of use.

Switch Port Channel

interface Port-channel 3
 no ip address
 portmode hybrid
 switchport
 channel-member TenGigabitEthernet 1/17,1/19
 no shutdown

Switch VLANs

interface Vlan 515
 no ip address
 tagged Port-channel 3
 no shutdown
!
interface Vlan 516
 no ip address
 untagged TenGigabitEthernet 1/18
 untagged Port-channel 3
 no shutdown

Answer 1

Port channel or EtherChannel is a Cisco proprietary protocol for link aggregation (LAG). Other vendors' hardware may or may not be compatible with it. It's quite possible that it's supported on the switch but not on the Sonicwall.

Generally, a standard LAG protocol should be preferred, especially LACP (802.1AX). If LACP isn't supported you should use static, non-protocol trunking between different devices. Also, each end of a LAG trunk needs to be configured in the exact same way. With LACP, at least one end must be configured as active.

Moreover:

When the primary interface is active, it processes all traffic to and from the interface. If the primary interface goes down, the secondary interface takes over all outgoing and incoming traffic. The secondary interface assumes the MAC address of the primary interface and sends the appropriate gratuitous ARP on a failover event. When the primary interface comes up again, it resumes responsibility for all traffic handling duties from the secondary interface.

In a typical Port Redundancy configuration, the primary and secondary interfaces are connected to different switches. This provides for a failover path in case the primary switch goes down. Both switches must be on the same Ethernet domain. Port Redundancy can also be configured with both interfaces connected to the same switch.

[1]

So, the secondary port is logically offline while the primary is operating normally. Since the Sonicwall takes care of gracious failover, do not configure anything on the switch, apart from required VLAN trunking. Do not use EtherChannel or LACP or static LAG. In case of failover, the Sonicwall will simply move traffic over to the secondary interface.