cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
5850
Views
26
Helpful
9
Replies

load-balancing in ACI port-channel

Ahmed Ashfaque
Level 1
Level 1

Good Day,

 

Anyone can please help to understand how ACI load balancing is done in virtual port-channel? Also if there is vPC between leaf and Firewall, how firewall understands the load balance method from switches (leaf) side?

 

Many Thanks & Regards, 

9 Replies 9

RedNectar
VIP
VIP

Hi @Ahmed Ashfaque ,

Load balancing for Virtual Port Channels in ACI is determined by the Port Channel Policy assigned to the Virtual Interface Port Channel Group.

 

The mode can be:

  • Static Channel - Mode On— All static port channels (that are not running LACP) remain in this mode. If you attempt to change the channel mode to active or passive before enabling LACP, the device displays an error message.

  • Active—LACP mode that places a port into an active negotiating state in which the port initiates negotiations with other ports by sending LACP packets.

  • Passive—LACP mode that places a port into a passive negotiating state in which the port responds to LACP packets that it receives but does not initiate LACP negotiation. Passive mode is useful when you do not know whether the remote system, or partner, supports LACP.

  • MAC Pinning—Used for pinning VM traffic in a round-robin fashion to each uplink based on the MAC address of the VM. MAC Pinning is the recommended option for channeling when connecting to upstream switches that do not support multichassis EtherChannel (MEC).

  • MAC Pinning-Physical-NIC-load—Pins VM traffic in a round-robin fashion to each uplink based on the MAC address of the physical NIC.

The default is Static Channel - Mode On.

 

image.png

 

 

image.png

I hope this helps.


Don't forget to mark answers as correct if it solves your problem. This helps others find the correct answer if they search for the same problem.


RedNectar aka Chris Welsh.
Forum Tips: 1. Paste images inline - don't attach. 2. Always mark helpful and correct answers, it helps others find what they need.

Good Day,

 

Thanks for the explanation, but question remains same as how mode does the load balancing? each mode is having same way of doing load-balancing? How next device (let's say cisco FTD) will understand what load-balancing method is defined on ACI?

 

Regards, 

 

Hi @Ahmed Ashfaque ,

OK - bit more detail needed.

The answer is still in the Port Channel Policy assigned to the Virtual Interface Port Channel Group - clearly for the MAC Pinning options, the balancing is done based on MAC addresses.  But if LACP is used, LACP will negotiate the hashing as set by the other options that are found in the Control field.

And the control field has a few values that can be set.  The help explains them

Control: 

The LAG control properties. The control state can be:

  • Fast Select Hot Standby Ports—Configures fast select for hot standby ports. Enabling this feature will allow fast selection of a hot standby port when last active port in the port-channel is going down.

  • Graceful Convergence—Configures port-channel LACP graceful convergence. Disable this only with LACP ports connected to a Non-Nexus peer. Disabling this with Nexus peer can lead to port suspension.

  • Load Defer Member Ports—Configures the load-balancing algorithm for port channels that applies to the entire device or to only one module.

  • Suspend Individual Port—LACP sets a port to the suspended state if it does not receive an LACP bridge protocol data unit (BPDU) from the peer ports in a port channel. This can cause some servers to fail to boot up as they require LACP to logically bring up the port.

  • Symmetric Hashing—Bidirectional traffic is forced to use the same physical interface and each physical interface in the port channel is effectively mapped to a set of flows.

And if Symmetric Hashing is used:

When symmetric hashing is enabled, the parameters used for hashing, such as the source and destination IP address, are normalized before they are entered into the hashing algorithm. This process ensures that when the parameters are reversed (the source on the forward traffic becomes the destination on the reverse traffic), the hash output is the same. Therefore, the same interface is chosen.

  • Destination IP

  • Layer4 Dest Port

  • Layer4 Src Port

  • Source IP

 

You won't actually see those options UNLESS you select Symmetric Hashing 

image.png

Also be aware that only one hashing method can be deployed per switch.

 

RedNectar aka Chris Welsh.
Forum Tips: 1. Paste images inline - don't attach. 2. Always mark helpful and correct answers, it helps others find what they need.

Very Well explain, the bottom line is load-balancing is in control option "Load Defer Member Ports".

 

Many thanks & Regards, 

Hi @Ahmed Ashfaque ,

I'm not sure that the Load Defer Member Ports option does anything in ACI.  The help describes this option as:

  • Load Defer Member Ports—Configures the load-balancing algorithm for port channels that applies to the entire device or to only one module.

Given that leaf switches only have one module, I doubt that the Load Defer Member Ports option makes any difference on an ACI LEAF switch.

My suspicion is that the option is there as a carry-over from the Nexus 9000 chassis switch line, which can have multiple modules.

Maybe @Robert Burns may be able to shed more light on this option.

 

RedNectar aka Chris Welsh.
Forum Tips: 1. Paste images inline - don't attach. 2. Always mark helpful and correct answers, it helps others find what they need.

Load Defer Member Ports - Defers LACP TX enable on non-fop (first operational port) in a port-channel. This is done to avoid packet drops on the peer.

Robert

my fabric is behaving really strangely, as having 4 fabric and one of them is having issues one link is reaching 100% where as other link is almost idle. where both links are part of vPC that's why interested to understand how load balancing is getting done in vPC.

As per Cisco they are saying one session take maximum bandwidth on link and minimal gives to other link but question is why other link does not come into the picture and TAC is not able to answer this.

 

It all comes down to how many and what type of flows you have in your setup. Since the load-balancing is per-flow (meaning a flow will always take the same path), it could be possible that one flow to consume most of the bandwidth. I would suggest you make a SPAN of the VPC and compare the flows (wireshark can do that)

 

Take care,

Sergiu

RedNectar
VIP
VIP

Hi @Ahmed Ashfaque ,

Just wondering if there is sufficient information in all these replies to answer your original questions:

Anyone can please help to understand how ACI load balancing is done in virtual port-channel? Also if there is vPC between leaf and Firewall, how firewall understands the load balance method from switches (leaf) side?



If your question has been answered, it is a great idea to mark the question as being answered.  This helps:

  1. others with a similar problem find the correct answer
  2. people who look for "unanswered" questions to answer finding this
  3. prevent your question from becoming a "dead thread"
RedNectar aka Chris Welsh.
Forum Tips: 1. Paste images inline - don't attach. 2. Always mark helpful and correct answers, it helps others find what they need.

Save 25% on Day-2 Operations Add-On License