How to Configure a Layer 3 (Routed) EtherChannel on Cisco (Step by Step)

Step 1 — Confirm you need a routed bundle (and pick the negotiation protocol)

A Layer 2 EtherChannel is a switchport: it trunks or accesses VLANs and shows up as a single logical switchport to Spanning Tree. A Layer 3 EtherChannel is the opposite — it is a routed interface with an IP address, used for router-to-router or switch-to-switch links where you want a routing adjacency, not a trunk. Reach for it when you have two (or more) parallel cables between distribution/core devices and you want the bandwidth and redundancy of both without STP blocking one of them.

This requires a Layer 3-capable device. On a multilayer switch (for example a Catalyst 9300, or CML's IOSvL2 / Catalyst 9000v node) ports default to switchports, so you must convert them with 'no switchport' — that is the case this guide covers. On a plain router (IOSv, CSR/Cat8000v) interfaces are already routed and have no 'switchport' command, so you would skip 'no switchport' and just add the 'channel-group' line.

Choose how the bundle negotiates. LACP (the open standard) uses 'mode active' or 'mode passive'; at least one side must be 'active'. PAgP (Cisco) uses 'desirable'/'auto'. Static uses 'mode on' with no negotiation. Use LACP 'mode active' on both ends — it's standards-based and it actively verifies the neighbor before bundling, which catches miscabling instead of silently forwarding into a loop.

Step 2 — Plan the topology and the point-to-point subnet

Decide which physical ports form the bundle and pick the addressing before you touch the CLI. A routed EtherChannel is a point-to-point link, so a /30 (255.255.255.252) is the natural fit — two usable host addresses, one per side.

For this walk-through: SW1 and SW2 are connected by two links, GigabitEthernet0/1 and GigabitEthernet0/2 on each side. They bundle into Port-channel 1. SW1 gets 10.0.0.1/30 on the Port-Channel; SW2 gets 10.0.0.2/30. Your interface IDs will differ by platform (for example Gi1/0/1 on a stacked Catalyst) — substitute your own. The Port-Channel number is locally significant, so the two ends do not have to use the same number, but keeping them identical (Po1 on both) makes the design far easier to read.

Step 3 — Make the member ports routed and add them to the channel group

Configure both physical members together with 'interface range' so their settings are guaranteed identical — EtherChannel refuses to bundle ports whose properties don't match. 'no switchport' converts each port from a Layer 2 switchport into a routed interface; without it the ports stay Layer 2 and the bundle will form as a switchport, not a routed link.

'channel-group 1 mode active' binds both ports to LACP group 1 and, because these are the first members, IOS automatically creates the Port-channel 1 interface for you. Do not put any IP address on these physical ports — the address belongs on the logical interface in the next step.

SW1# configure terminal
SW1(config)# interface range GigabitEthernet0/1 - 2
SW1(config-if-range)# no switchport
SW1(config-if-range)# channel-group 1 mode active
Creating a port-channel interface Port-channel 1
SW1(config-if-range)# no shutdown
SW1(config-if-range)# exit

Step 4 — Configure the logical Port-Channel interface (IP + no shutdown)

This is where the IP address lives. Enter the Port-channel interface that was auto-created in Step 3, confirm it is routed with 'no switchport' (the members made it routed, but setting it explicitly removes any ambiguity), assign the IP, and bring it up.

The physical members now inherit their Layer 3 behavior from this interface. Any routing you run — a static route, OSPF, EIGRP — points at Port-channel 1, never at Gi0/1 or Gi0/2 individually. Traffic is then load-balanced across the physical members by the switch's 'port-channel load-balance' hash.

SW1(config)# interface Port-channel 1
SW1(config-if)# no switchport
SW1(config-if)# ip address 10.0.0.1 255.255.255.252
SW1(config-if)# no shutdown
SW1(config-if)# end

Step 5 — Mirror the configuration on the far end

Repeat the same steps on SW2. The only value that changes is the IP address on the Port-Channel — 10.0.0.2 to sit in the same /30 as SW1. The channel mode must be compatible with SW1: since SW1 is LACP 'active', SW2 can be 'active' or 'passive' (two 'passive' ends will never bundle because neither one initiates).

SW2# configure terminal
SW2(config)# interface range GigabitEthernet0/1 - 2
SW2(config-if-range)# no switchport
SW2(config-if-range)# channel-group 1 mode active
SW2(config-if-range)# no shutdown
SW2(config-if-range)# exit
SW2(config)# interface Port-channel 1
SW2(config-if)# no switchport
SW2(config-if)# ip address 10.0.0.2 255.255.255.252
SW2(config-if)# no shutdown
SW2(config-if)# end

Step 6 — Verify: the Port-Channel should read RU, and the link should ping

'show etherchannel summary' is the single most important check. In the Group line, the Port-Channel flag must read (RU): R = Layer 3 and U = in use. That 'R' is your proof the bundle is routed, not switched — a Layer 2 bundle would show (SU) instead. Each member must show (P), meaning it is bundled in the port-channel. A member showing (I) is standalone (not bundling), (s) is suspended, and (w) is still waiting to negotiate.

'show ip interface brief' should list Port-channel1 with your IP and a status/protocol of up/up. 'show lacp neighbor' confirms the LACP partner was actually seen on both members. Finally, ping the other side's Port-Channel IP to prove end-to-end reachability across the routed bundle.

SW1# show etherchannel summary
Flags:  D - down        P - bundled in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        R - Layer3      S - Layer2
        U - in use      f - failed to allocate aggregator
        M - not in use, minimum links not met
        u - unsuitable for bundling
        w - waiting to be aggregated
        d - default port

Number of channel-groups in use: 1
Number of aggregators:           1

Group  Port-channel  Protocol    Ports
------+-------------+-----------+------------------------------
1      Po1(RU)         LACP      Gi0/1(P)    Gi0/2(P)

SW1# show ip interface brief | include Port-channel
Port-channel1          10.0.0.1        YES manual up                    up

SW1# show lacp neighbor

SW1# ping 10.0.0.2

Common problems (and the fix)

1) IP address on a member instead of the Port-Channel. The link comes up physically but routing is broken, or IOS rejects/ignores the address once the port joins the group. The IP must live only on Port-channel 1. Fix: remove the address from the physical port, then set it on the logical interface (see code).

2) Forgot 'no switchport' on the members. The bundle still forms, but 'show etherchannel summary' shows Po1(SU) — S for Layer 2 — and the Port-Channel refuses an IP because it is still a switchport. Fix: make the members routed and set 'no switchport' on the Port-Channel. Because you're changing a member's core property, the cleanest path is to default the interfaces and reconfigure so the members and the Po agree.

3) Inconsistent settings across members. If the two physical ports differ in speed, duplex, or switchport state, one drops out to (I) standalone or sits in (w). Fix: configure the members together with 'interface range' so speed, duplex, and 'no switchport' are identical; only then will both bundle as (P).

4) Mismatched channel modes. Both ends set to LACP 'passive' never bundle (no one initiates); one side 'on' (static) with the other 'active' (LACP) also fails because 'on' does no negotiation. Fix: use compatible modes — at least one 'active' end for LACP, or 'on' on both ends for a static bundle.

5) Members left administratively down, or the Port-Channel left shut. LACP can't negotiate on a shut port, so the group stays empty or the members show (w)/(D). Fix: 'no shutdown' on both the member range and the Port-Channel interface.

! Fix #1 — move the IP off the member and onto the Port-Channel
SW1(config)# interface GigabitEthernet0/1
SW1(config-if)# no ip address
SW1(config)# interface Port-channel 1
SW1(config-if)# ip address 10.0.0.1 255.255.255.252

! Fix #2 — reset the members clean, then rebuild as routed
SW1(config)# default interface range GigabitEthernet0/1 - 2
SW1(config)# interface range GigabitEthernet0/1 - 2
SW1(config-if-range)# no switchport
SW1(config-if-range)# channel-group 1 mode active
SW1(config-if-range)# no shutdown
SW1(config)# interface Port-channel 1
SW1(config-if)# no switchport
SW1(config-if)# ip address 10.0.0.1 255.255.255.252
SW1(config-if)# no shutdown

! Fix #4 — align the negotiation mode (LACP on both ends)
SW2(config)# interface range GigabitEthernet0/1 - 2
SW2(config-if-range)# channel-group 1 mode active