Active ports

Hi Everyone,I am studying for my CCNP switching exam, currently reading the chapter about EtherChannel. My doubt is with regards LACP, lets start with some background context just to make sure my theory is accurate:A.- When a port is configured in a group-channel as "Active" LACP mode, it means that the port will actively send LACP negotiation packets to the far end device waiting for a response in order to bundle the link into the channel. If the port is configured as "Passive", that means that the port will agree to negotiate but the far end is supposed to start sending the LACP packets.B.- LACP introduces the concept of "system-priority" and "port-priority" (very similar to their STP counterparts). This feature allows you to configure more links than allowed into the EtherChannel bundle, and then the switch with the lowest system-priority will decide which ones of these ports will be bundled into the channel and which ones will be in standby in case one of the latter goes down. These decisions will be based on the "port-priority".If my concepts are wrong, please let me know. Now my questions are related to 4 particular scenarios:SCENARIO 1: Let's assume I have two LACP-capable switches connected to one another with 16 ethernet cables. All of them identically configured (on both switches) and ALL OF THEM IN "ACTIVE" LACP MODE. At this stage, one of the switches will be the decision maker and will decide which 8 of the available ports (the ones with lowest port priority) will be bundled. What happens with the non-decision-maker switch? Will its ports just start sending LACP packets in a "blindfolded" manner until the decision makers shut 8 of their ports down?SCENARIO 2: Same scenario but now one of the switches is configured with all of its 16 LACP ports as "ON" mode (the other switch still has all of its ports in Active mode). How will the "active" switch know if it is the decision maker or not?, given that its far end partner is not sending LACP packets at all.SCENARIO 3: What happens if both switches are

Echo cancellation (optional)USB 2 external USB 2.0Analog Lines Fail-over In case of power outage or an Asterisk malfunction, up to six analog PSTN lines are routed directly to predetermined analog extensions.I/O Ports Input/Output ports for Asterisk peripheral device support (model-specific)Rapid PA™ Public Address capability for FXS port(s) (optional and model-specific)TelephonyMaximum number of concurrent calls 45 *Depends on codec usedMaximum number of built in analog ports 32 (additional ports with external Astribank units)Number of E1 / T1 ports 1 (up to 30 concurrent PRI/R2/CAS calls)Maximum telephony modules supported internally 4 (additional ports are supported by adding Astribank units)Maximum number of telephony ports supported internally 54 (1x E1 PRI/R2/CAS + 24 analog ports)Supported telephony modules8 ports FXS8 port FXS + I/O ports8 ports FXO2 ports FXO, 6 ports FXS + I/O ports6 ports FXO, 2 ports FXS1 E1 / T1 PRI/R2/CAS portUp to 8 BRI ISDN portsPowerPower supply InternalVoltage Switching, auto adjust 110/220 Volts, 50/60 HzPower consumption 230 Watts (maximum)Built in grounding connectionNetworkEthernet port 2x 10/100/1000 Mb/sMaintenance and SupportLCD (Liquid Crystal Display) touch panel, supporting:Status of active systems, including:all configured IP addressesTwinStar™ (dual-server redundancy)Redundant Power Supply (when configured)Blink ports (extensions, channels, XPD and SPAN)Active callsMaintenance issues, including:Asterisk restartDAHDI restartServer rebootServer power offSettings, including:Enable/disable DHCPManual IP configurationMonitor and keyboard supportInternal backup & restore utilityExternal Rapid Recovery™ backup utility provided on Disk-on-KeyRapid Tunneling™ utility providing secure remote access for product support purposesInternet updatesEvironmentStorage temperature -20° to 70° Celsius (-4°-158° F)Working temperature 0° to 40° Celsius (32°-104° F)Humidity 20%-95%, non condensingDimensions and WeightWeight 8 Kg 18Lbs (weight may vary and depends on configuration)Size 19″ 2U industry standard rack-mountable chassisXorcom PBX’s and Astribanks required Info1) Please advise how many of the following ports you will require?FXS (Analogue Extensions (phone/fax)FXO (Analogue Lines)E1/T1/PRI – Digital LinesBRI/ISDN2 – Digital LinesVoIP TrunksSIP/IAX ExtensionsMaximum number of concurrent calls2) Please advise if

VLANs shown in the table.Step 2: Assign switch ports to VLANs.Using the VLAN table, assign switch ports to the VLANs you created in Step 1, as follows: All switch ports that you assign to VLANsn should be configured to static access mode. All switch ports that you assign to VLANs should be activated. Note that all of the unused ports on SW-A should be assigned to VLAN 99. This configuration step on switches SW-B and SW-C is not required in this assessment for the sake of time. Secure the unused switch ports on SW-A by shutting them down.Step 3: Configure the SVIs.Refer to the Addressing Table. Create and address the SVIs on all three of the switches that are attached to Site 2. Configure the switches so that they can communicate with hosts on other networks. Full connectivity will be established after routing between VLANs has been configured later in this assessment.Step 4: Configure Trunking and EtherChannel.a. Use the information in the Port-Channel Groups table to configure EtherChannel as follows: Use LACP. The switch ports on both sides of Channels 1 and 2 should initiate negotiations for channel establishment. The switch ports on the SW-B side of Channel 3 should initiate negotiations with the switch ports on SW-C. The switch ports on the SW-C side of Channel 3 should not initiate negotiations with the switch ports on the other side of the channel. All channels should be ready to forward data after they have been configured.b. Configure all port-channel interfaces as trunks.c. Configure static trunking on the switch port on SW-B that is connected to Site 2.Step 5: Configure Rapid PVST+.Configure Rapid PVST+ as follows:a. Activate Rapid PVST+ and set root priorities. All three switches should be configured to run Rapid PVST+. SW-A should be configured as root primary for VLAN 2 and VLAN 4 using the default primary priority values. SW-A should be configured as root secondary for VLAN 8 and VLAN 15 using the default secondary priority values. SW-C should be configured as root primary for VLAN 8 and VLAN 15 using the default primary priority values. SW-C should be configured as root secondary for VLAN 2 and VLAN 4 using the default secondary priority values.b. Activate PortFast and BPDU Guard on the active SW-C switch access ports. On SW-C, configure PortFast on the access ports that are connected to hosts. On SW-C, activate BPDU Guard on the access ports that are connected to hosts.Step 6: Configure switch security.You are required to complete the following only on some of the devices in the network for this assessment. In reality, security should be configured on all devices in the network.a. Configure port security on all active access ports that have hosts connected on SW-A. Each active access port should accept only two MAC addresses before a security action occurs. The learned MAC addresses should be recorded in the running configuration. If a security violation occurs, the switch ports should provide notification that a violation has occurred but not place

Special notes about the failover condition and actions. Table 3. Failover Events Failure Event Policy Active Unit Action Standby Unit Action Notes Active unit failed (power or hardware) Failover n/a Become active Mark active as failed No hello messages are received on any monitored interface or the failover link. Formerly active unit recovers No failover Become standby No action None. Standby unit failed (power or hardware) No failover Mark standby as failed n/a When the standby unit is marked as failed, then the active unit does not attempt to fail over, even if the interface failure threshold is surpassed. Failover link failed during operation No failover Mark failover link as failed Mark failover link as failed You should restore the failover link as soon as possible because the unit cannot fail over to the standby unit while the failover link is down. Failover link failed at startup No failover Become active Mark failover link as failed Become active Mark failover link as failed If the failover link is down at startup, both units become active. State link failed No failover No action No action State information becomes out of date, and sessions are terminated if a failover occurs. Interface failure on active unit above threshold Failover Mark active as failed Become active None. Interface failure on standby unit above threshold No failover No action Mark standby as failed When the standby unit is marked as failed, then the active unit does not attempt to fail over even if the interface failure threshold is surpassed. Requirements and Prerequisites for High Availability Model Support Firepower Threat Defense Supported Domains Any User Roles Admin Network Admin Guidelines for High Availability Model Support Firepower 1010: You should not use the switch port functionality when using High Availability. Because the switch ports operate in hardware, they continue to pass traffic on both the active and the standby units. High Availability is designed to prevent traffic from passing through the standby unit, but this feature does not extend to switch ports. In a normal High Availability network setup, active switch ports on both units will lead to network loops. We suggest that you use external switches for any switching capability. Note that VLAN interfaces can be monitored by failover, while switch ports cannot. Theoretically, you can put a single switch port on a VLAN and successfully use High Availability, but a simpler setup is to use physical firewall interfaces instead. You can only use a firewall interface as the failover link. Note On Firepower 1010 devices on which version 6.5 or above is freshly installed and managed by the FMC version 6.5 or later, the default interfaces will be of switch port type. Since the switch port functionality is not supported for failover, turn off switch port on those interfaces, do a deployment, and then create failover. For Firepower 1010 systems that are upgraded from versions prior to 6.5, the default interfaces will be the same as those in the previous version. Firepower 9300—Intra-chassis High Availability

The vSphere services and route toward other subnets corresponding to other racks. Restricting access between different service subnets then requires ACL configurations on every access ToR for every service Layer 3 interface. Limiting traffic within a service subnet is even more complicated—and practically impossible. Cisco ACI simplifies configuring the network connectivity required for vSphere traffic. It also enables securing the infrastructure using Cisco ACI contracts. The next two sections review how to configure physical ports to redundantly connect ESXi hosts and then how to configure Cisco ACI logical networking constructs to enable secure vSphere traffic connectivity. Physically connecting ESXi hosts to the fabric ESXi software can run on servers with different physical connectivity options. Sometimes physical Network Interface Cards (NICs) are dedicated for management, storage, and other functions. In other cases, all traffic is placed on the same physical NICs, and traffic may be segregated by using different port groups backed by different VLANs. It is beyond the scope of this document to cover all possible options or provide a single prescriptive design recommendation. Instead, let’s focus on a common example where a pair of physical NICs is used to obtain redundancy for ESXi host-to-fabric connectivity. In modern servers, these NICs could be dual 10/25GE or even dual 40GE. When using redundant ports, it is better to favor designs that enable active/active redundancy to maximize the bandwidth available to the server. For instance, when using Cisco ACI GX or FX leaf models, access ports support 25/40 Gbps. With modern server NICs also adding 25/40G Ethernet support, it becomes affordable to have 50/80 Gbps of bandwidth available to every server. Note that Cisco also offers Nexus switches that provide 100G server connectivity but at the writing of this document very few servers are deployed with 100G NICs. In Cisco ACI, interface configurations are done using leaf policy groups. For redundant connections to a pair of leaf switches, a VPC policy group or access policy group with MAC-pinning on VMM vSwitch Port Channel Policy is required. Policies Groups are configured under Fabric Access Policies in the ACI GUI. Within a policy group, the administrator can select multiple policies to control the interface behavior. Such settings include Storm Control, Control Plane Policing, Ingress or Egress rate limiting, LLDP, and more. These policies can be reused across multiple policy groups. For link redundancy, port-channel policies must be set to match the configuration on the ESXi host. Table 1 summarizes the options available in vSphere distributed switches and the corresponding settings recommended for Cisco ACI interface policy group configuration. Table 1. Cisco ACI port-channel policy configuration vSphere Distributed Switch (VDS) Teaming and Failover Configuration Redundancy Expected with dual VMNIC per host ACI Interface Policy Configuration Route Based on originating virtual port Active/Active MAC Pinning Route based on Source MAC Hash Active/Active MAC Pinning Route based on physical NIC load Active/Active MAC Pinning-Physical-NIC-load LACP (802.3ad) Active/Active LACP Active, LACP Passive: Graceful Convergence, Fast Select Hostandby Ports (remove Suspend Individual Port Option) Route Based on IP Hash