I'm in the process of redesigning my network and have a few questions about LACP configuration:
Can LACP be set up to connect to two different firewalls?
In the diagram I provided, there are three lines representing LACP. Can this be consolidated into a single line, especially given that the switches and firewalls are stacked?
Thank you for your assistance!
Can LACP be set up to connect to two different firewalls?
If LSW-1 and LSW-2 are indeed multi chassis LACP capable (Stack, Stackwise, M-LAG, multichassis LACP, VPC, VSS ... feature names vary by vendor), then .. probably not quite the way you word it, but a working setup is still possible.
Assuming that FW1 and FW2 are a "bread and butter" variety of active/standby firewall cluster, they probably won't be Multi Chassis LACP capable. Then again, they don't have to be.
and
To FW1 and FW2, their LACP bundle will appear to come from one single switch. LSW1 and LSW2 will see two separate Multi Chassis LACP bundles, one for FW1, one for FW2.
This way, FW1 and FW2 can fail over and back as they see fit; LSW-1 and LSW-2 will just see traffic shift from one (multichassis) bundle to the other and back.
If either LSW-1 or LSW-2 were to fail, FW1/FW2 would not necessarily have to track/replicate the switch's failure in their active/standby states. Of course, the FWs will perceive the loss of 2 of the 4 links in their 4x LACP bundle - but that's just as well.
Would this setup still work with Active-Active? Well.. "active/active" can be a bit of a marketing term: Sounds good, but remains foggy until someone actually explains what it actually means networker's language. Key point: FWs must not use the single/same (VRRP) MAC address from both units at the same time. Else, the LSWs would see that virt.MAC address flapping from LACP-to-FW1 to LACP-to-FW2 and back constantly. If "active/active" mans that the FWs are using one (set of) MAC address(es) from FW1 and a different (set of) MAC address(es) from FW to, then this setup may work.
Commented
Sep 25, 2023 at 13:01
Generally, LACP does not support grouping links from multiple chassis. LACP works between two entities, not more.
However, there are proprietary stacking solutions that combine multiple physical chassis into a logical chassis (MC-LAG). These can then act as a single entity towards another entity (that could in turn consist of a logical combination of multiple chassis as well).
That said, the firewalls should have a failover mechanism based on L3 (network layer), like HSRP or VRRP.
For a real active-active setup, that L3 failover would require two virtual IP and associated MAC addresses, one set for each firewall and any one failing over to the other side.