Group-Interface/MLT with VLAN tagging: LACP base circuit assumes non-visible "logical-all" statement


Article ID: 168113


Updated On:




Group-Interface/MLT with VLAN tagging: LACP base circuit assumes non-visible "logical-all" statementThis inherent logical-all of the group-interface base circuit can pose potential problems for applications that rely on the use and proper receipt of broadcast or multicast packets on a specified interface (ie. Check Point state synchronization).


The following is an example of a misconfigured Cisco configuration related to Crossbeam configuration referenced below.

Port channel configuration
interface Port-channel12
description WAN-MLT
switchport access vlan 195
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 191,195
<-----accidentally tagging vlan 191
switchport mode trunk
no ip address
spanning-tree portfast

Within the following line of the XOS configuration, using the "wan" base circuit to establish LACP will automatically assume the "logical-all" statement, which is not visible within the CLI configuration.

mode multi-link circuit wan

As a reminder, the "logical-all" statement accepts all valid vlans ranging from 1-4094.

Crossbeam configuration:

[truncated for brevity]
vap-group fw xslinux_v3
vap-count 3
max-load-count 3
ap-list ap3 ap4 ap5 ap6 ap7 ap8 ap9 ap10
load-balance-vap-list 3
ip-flow-rule r65lb
action load-balance
timeout 30-seconds
[truncated for brevity]
circuit wan circuit-id 1050
device-name wan
vap-group fw
[truncated for brevity]
circuit w_195 circuit-id 1051
device-name wan195
vap-group fw
default-egress-vlan-tag 195
[truncated for brevity]
group-interface wan_group
interface-type gigabitethernet
mode multi-link circuit wan
interface 1/2
interface 2/2
logical l_195 ingress-vlan-tag 195 195
circuit w_195


In the Crossbeam configuration referenced, the circuit "wan" is considered the base template circuit. This base circuit exchanges LACP BPDUs and is used to establish the LACP interface bundle to the adjacent, connected device.

It is important to note that if the adjacent switch has been misconfigured to trunk additional, undesired vlans within the LACP interface bundle connected to the Crossbeam X-series NPM, all related non-unicast IP tagged packets will be accepted by the base circuit and passed to the vap-group due to the implied "logical-all" configuration.