Cisco EtherChannel Cheat Sheet (LACP and PAgP)
EtherChannel turns two or more physical links into one logical interface, so Spanning Tree stops blocking the spares and the bandwidth adds up. These are the commands in configuration order, plus the two ordering rules that silently break a bundle. Verified on Cisco IOS 17.16 — commands the image rejects are not listed.
Part of the EtherChannel learning hub
1. Bundle the physical links
Configure the SAME mode, speed, duplex and VLAN settings on every member, and on both switches. IOS creates the Port-channel interface for you the moment the first channel-group command lands.
| Command | What it does |
|---|---|
interface range <type/first> - <last> | Select the member interfaces together so their settings cannot drift apart. |
channel-group <1-N> mode active | LACP, and actively asks the far end to bundle. The usual choice. |
channel-group <1-N> mode passive | LACP, but only responds — it never initiates. |
channel-group <1-N> mode desirable | PAgP (Cisco-proprietary), actively negotiating. |
channel-group <1-N> mode auto | PAgP, responds only. |
channel-group <1-N> mode on | No negotiation at all. Both ends must be 'on' — it will not talk to LACP or PAgP. |
channel-protocol lacp | pagp | Pin the protocol explicitly, so a later mode keyword cannot switch it by accident. |
2. Which mode combinations actually form a bundle
Two passive ends never start the conversation, and neither do two auto ends. 'on' is not a protocol — it refuses to negotiate, so pairing it with LACP or PAgP leaves the link down.
| Switch A | Switch B | Forms? | Protocol |
|---|---|---|---|
active | active | Yes | LACP |
active | passive | Yes | LACP |
passive | passive | No — nobody initiates | LACP |
desirable | desirable | Yes | PAgP |
desirable | auto | Yes | PAgP |
auto | auto | No — nobody initiates | PAgP |
on | on | Yes | None (static) |
on | active or desirable | No — 'on' will not negotiate | Mismatched |
3. Configure the Port-channel as a trunk
Order matters here. 'switchport mode trunk' is rejected outright until the encapsulation is set, with the device saying: An interface whose trunk encapsulation is "Auto" can not be configured to "trunk" mode. Configure the Port-channel, not the members — IOS copies these settings down onto every member interface for you.
| Command | What it does |
|---|---|
interface Port-channel <n> | Configure the logical interface. Changes here propagate to the physical members. |
switchport trunk encapsulation dot1q | Required FIRST on this platform; without it the next command is rejected. |
switchport mode trunk | Make the bundle a trunk. |
switchport trunk native vlan <id> | Set the untagged VLAN. It must match on the far end. |
switchport trunk allowed vlan <list> | Restrict which VLANs cross the bundle, e.g. 10,20. |
4. Layer 3 (routed) EtherChannel
The trap: put 'no switchport' on the MEMBER interfaces before adding them to the channel group. With the members left as switchports the channel-group does not stay applied — the ports drop out of the bundle and end up shut down, and IOS prints no error explaining it.
| Command | What it does |
|---|---|
interface range <type/first> - <last> | Select the members first. |
no switchport | Make each member a routed port BEFORE bundling it. |
channel-group <n> mode on | Now bundle them. Negotiated modes work here too. |
interface Port-channel <n> | Then configure the logical interface. |
no switchport | Make the Port-channel itself routed. |
ip address <ip> <mask> | Give the bundle its IP address — one Layer 3 interface over many links. |
5. Verify and troubleshoot
The most common failure is a one-sided bundle. If you configure 'active' and the far end has nothing, the port is suspended and the log says so: %ETC-5-L3DONTBNDL2: Et0/0 suspended: LACP currently not enabled on the remote port.
| Command | What it does |
|---|---|
show etherchannel summary | The one command to run first: every port-channel, its protocol, and each member's state flags. |
show lacp neighbor | Confirm the far end is actually speaking LACP, and see what it is advertising. |
show running-config interface Port-channel <n> | Check the logical interface's settings, which are the ones that propagate to members. |
show running-config interface <member> | Compare a member against the Port-channel — mismatched settings are what keep a port out. |
Frequently asked questions
Why is my EtherChannel not coming up?
Usually one of three things. The two ends are in incompatible modes — two passive or two auto ends never start negotiating, and an 'on' end refuses to talk to LACP or PAgP at all. Or the member interfaces differ in speed, duplex, or VLAN configuration. Or only one side is configured, in which case the log tells you plainly: 'Et0/0 suspended: LACP currently not enabled on the remote port.' Start with 'show etherchannel summary' on both switches.
Should I configure the Port-channel or the physical interfaces?
The Port-channel. Settings applied to the logical interface are copied down onto every member, which keeps them consistent by construction — configure trunking on Port-channel1 and you will find the same lines on each member interface afterwards. The one thing you apply to the physical ports is the channel-group command itself.
Why was my 'switchport mode trunk' rejected on the Port-channel?
Because the trunk encapsulation is still 'Auto'. On a switch that supports more than one trunking encapsulation you must set 'switchport trunk encapsulation dot1q' before 'switchport mode trunk', or IOS refuses with: An interface whose trunk encapsulation is "Auto" can not be configured to "trunk" mode.
What is the difference between LACP and PAgP?
LACP is the IEEE standard (802.3ad) and works between vendors; its modes are active and passive. PAgP is Cisco-proprietary and its modes are desirable and auto. Both negotiate the bundle. 'on' is neither — it forces the bundle up with no negotiation, so a misconfigured far end can create a loop instead of failing safely. Prefer LACP unless you have a reason not to.
Now build it
Labs that drill this on real Cisco IOS — configure it yourself, then grade your config against the answer key.
Stop memorizing — configure it on real Cisco IOS
A cheat sheet gets you unstuck; a graded lab makes it stick. Edit a real Cisco config and grade it instantly — free, no signup.