topic What do you want to achieve in Network Security

ASA port-channel command on IOS v. 9.0(4)

Rosa Ladeira — Tue, 12 Mar 2019 05:12:32 GMT

I have configured 2 of ASA 5550 on a port channel as follows:

=======================================
router# show version
Cisco Adaptive Security Appliance Software Version 8.4(2)

router# show module
0 ASA 5550 Adaptive Security Appliance ASA5550 JMX1226L1S9
1 SSM-4GE Included with ASA 5550 System SSM-4GE-INC JAF1224ATNS

router# show interface Port-channel48
Interface Port-channel48 "", is up, line protocol is up
Hardware is EtherChannel/ON, BW 2000 Mbps, DLY 10 usec
    Auto-Duplex(Full-duplex), Auto-Speed(1000 Mbps)
    Input flow control is unsupported, output flow control is off
    Media-type configured as RJ45 connector
    Available but not configured via nameif
    MAC address 001f.ca97.44e2, MTU not set
    IP address unassigned
Members in this channel:
      Active:   Gi1/2 Gi1/3

router# show startup-config
!
interface GigabitEthernet1/2
channel-group 48 mode on
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/3
channel-group 48 mode on
no nameif
no security-level
no ip address
!
interface Port-channel48
no nameif
no security-level
no ip address
!
interface Port-channel48.4
vlan 4
!
interface Port-channel48.5
vlan 5

After migrating to version 9.0(4) I could not configure channel group on int g 1/2.

=======================================
router# show version
Cisco Adaptive Security Appliance Software Version 9.0(4)

router# show module
0 ASA 5550 Adaptive Security Appliance ASA5550 JMX1421L333
1 SSM-4GE Included with ASA 5550 System SSM-4GE-INC JAF1419ALAK

router# configure terminal
router(config)# interface GigabitEthernet1/2
router(config-if)# channel-group 48 mode on
^
ERROR: % Invalid input detected at '^' marker.
router(config-if)# ?

So I have the following questions about verion 9:

1. Can I still use port-channels on a sigle ASA?
2. Should I replace port-channel by lacp command on a sigle ASA?
3. Does lacp command can be used only on clusters ?

Att.,
Rosa

The following is documented

Karsten Iwen — Wed, 10 Dec 2014 21:28:58 GMT

The following is documented in the config guide for both 8.4 and 9.0:

•You cannot use interfaces on the 4GE SSM, including the integrated 4GE SSM in slot 1 on the ASA 5550, as part of an EtherChannel.

So, even with 8.4 it was probably never meant to work.

Should I replace port-channel

Rosa Ladeira — Wed, 10 Dec 2014 22:52:11 GMT

Should I replace port-channel by lacp command on a sigle ASA?
Does lacp command can be used only on clusters ?

Att.,
Rosa

What do you want to achieve

Karsten Iwen — Wed, 10 Dec 2014 23:00:43 GMT

What do you want to achieve with the lacp-commands? They are used to control *how* a channel is formed. But they won't help if channels are not supported at all.

Is there any way to configure

Rosa Ladeira — Thu, 11 Dec 2014 08:12:41 GMT

Is there any way to configure channel on ASAs interfaces in order to agregate interfaces throughput ?

Yes, on the build-in

Karsten Iwen — Thu, 11 Dec 2014 08:20:49 GMT

Yes, on the build-in interfaces of the ASA (g0/0 to g0/3). But the overall throughput of the 5550 is only slightly higher than the capacity of a single gig-link. So it's more about the higher availability that can be achieved than the throughput.