2

I'm in the process of redesigning my network and have a few questions about LACP configuration:

Can LACP be set up to connect to two different firewalls? In the diagram I provided, there are three lines representing LACP. Can this be consolidated into a single line, especially given that the switches and firewalls are stacked? Thank you for your assistance! enter image description here

1
  • Can you share brand and model for switch and firewall? Does the switch stack present as one logical device with multiple physical switches and some stacking cables that aren't simple ethernet ?
    – Criggie
    Commented Sep 25, 2023 at 21:30

2 Answers 2

5

Can LACP be set up to connect to two different firewalls?

If LSW-1 and LSW-2 are indeed multi chassis LACP capable (Stack, Stackwise, M-LAG, multichassis LACP, VPC, VSS ... feature names vary by vendor), then .. probably not quite the way you word it, but a working setup is still possible.

Assuming that FW1 and FW2 are a "bread and butter" variety of active/standby firewall cluster, they probably won't be Multi Chassis LACP capable. Then again, they don't have to be.

  • On FW1, configure a single LACP bundle of 4 ports.
  • On LSW-1 and LSW-2 configure one multi chassis LACP bundle with 2 ports on each switch, for FW1 to connect to.
  • be sure to configure the multi chassis LACP bundle the same as the one for FW2 (same set of allowed VLANs, same spanning-tree settings etc)
  • connect FW1 to both LSW-1 and LSW-2 accordingly

and

  • On FW2, configure a single LACP bundle of 4 ports.
  • On LSW-1 and LSW-2 configure a second multichassis LACP bundle with 2 ports on each switch, for FW2 to connect to.
  • be sure to configure the multi chassis LACP bundle the same as the one for FW1 (same set of allowed VLANs, same spanning-tree settings etc)
  • connect FW2 to both LSW-1 and LSW-2 accordingly

To FW1 and FW2, their LACP bundle will appear to come from one single switch. LSW1 and LSW2 will see two separate Multi Chassis LACP bundles, one for FW1, one for FW2.

This way, FW1 and FW2 can fail over and back as they see fit; LSW-1 and LSW-2 will just see traffic shift from one (multichassis) bundle to the other and back.

If either LSW-1 or LSW-2 were to fail, FW1/FW2 would not necessarily have to track/replicate the switch's failure in their active/standby states. Of course, the FWs will perceive the loss of 2 of the 4 links in their 4x LACP bundle - but that's just as well.

2
  • The firewalls are Active-Active i just confirmed that they dont support MC-LAG. Would this setup still work with Active-Active?
    – kevin
    Commented Sep 25, 2023 at 11:50
  • 1
    Would this setup still work with Active-Active? Well.. "active/active" can be a bit of a marketing term: Sounds good, but remains foggy until someone actually explains what it actually means networker's language. Key point: FWs must not use the single/same (VRRP) MAC address from both units at the same time. Else, the LSWs would see that virt.MAC address flapping from LACP-to-FW1 to LACP-to-FW2 and back constantly. If "active/active" mans that the FWs are using one (set of) MAC address(es) from FW1 and a different (set of) MAC address(es) from FW to, then this setup may work. Commented Sep 25, 2023 at 13:01
4

Generally, LACP does not support grouping links from multiple chassis. LACP works between two entities, not more.

However, there are proprietary stacking solutions that combine multiple physical chassis into a logical chassis (MC-LAG). These can then act as a single entity towards another entity (that could in turn consist of a logical combination of multiple chassis as well).

That said, the firewalls should have a failover mechanism based on L3 (network layer), like HSRP or VRRP.

For a real active-active setup, that L3 failover would require two virtual IP and associated MAC addresses, one set for each firewall and any one failing over to the other side.

1
  • BTW: I think all implementations of MC-LAG are susceptible to split-brain under contrived scenarios Commented Sep 26, 2023 at 23:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.