I am trying to bundle two 10-Gig interfaces on PA-3020 to Cisco Cat9300. Previously, I had bundled two Gigabit interfaces on same devices and everything worked fine. But now, when I try to configure it the same way, the 10 Gig port on Cisco side stays in "w - waiting to be aggregated" mode. And AE bundle on Palo Alto shows an amber sign on GUI.

show etherc 2 summary
Flags:  D - down        P - bundled in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        R - Layer3      S - Layer2
        U - in use      f - failed to allocate aggregator

        M - not in use, minimum links not met
        u - unsuitable for bundling
        w - waiting to be aggregated
        d - default port

        A - formed by Auto LAG

Number of channel-groups in use: 6
Number of aggregators:           6

Group  Port-channel  Protocol    Ports
2      Po2(SU)         LACP        Te3/1/6(P)    Te3/1/7(w)

show run int port-channel 2
Building configuration...

Current configuration : 107 bytes
interface Port-channel2
 switchport trunk native vlan 511
 switchport mode trunk
 lacp max-bundle 2

show run int te 3/1/6
Building configuration...

Current configuration : 150 bytes
interface TenGigabitEthernet3/1/6
 switchport trunk native vlan 511
 switchport mode trunk
 channel-protocol lacp
 channel-group 2 mode active

I have tried different modes of LACP on both Cisco and Palo Alto side but never can get both ports on Cisco to be bundled or green sign on AE bundle on Palo Alto.

Reading the documentation, Cisco says its possible to have Ggabit Etherchannels on 10 Gigabit interfaces. And I know it works on Palo Alto as other AS bundle is up. Is there something missing in the configuration here?

  • Is there anything in the log? Are both interfaces at 10G?
    – Ron Trunk
    Feb 28, 2020 at 15:26
  • Your question helped me look at the problem differently and wonder were both interfaces 10 Gig. Anyways, Palo Alto port was 1gig fiber and other port was 10gig fiber. Will ask my client to swap out the port and then see.I should have caught this in the first place. Feb 28, 2020 at 16:08
  • You should write an answer for your question so others can benefit from your experience.
    – Ron Trunk
    Feb 28, 2020 at 16:28
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Dec 17, 2020 at 15:34

1 Answer 1


The problem turned out to be two different types of physical interfaces on Palo Alto. PA3020 has two different types of SFP ports (1 gig abd 10 gig) which I forgot.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.