Configure ASA EtherChannel

Use this procedure to add a new EtherChannel interface to an ASA.

Before you begin

To configure EtherChannel on ASA interface, the following prerequisites must be met:

  • All interfaces in the channel group must be the same media type and capacity, and must be set to the same speed and duplex. The media type can be either RJ-45 or SFP; SFPs of different types (copper and fiber) can be mixed. You cannot mix interface capacities (for example 1GB and 10GB interfaces) by setting the speed to be lower on the larger-capacity interface, except for the Secure Firewall 3100, which supports different interface capacities as long as the speed is set to Detect SFP; in this case, the lowest common speed is used.

  • You cannot add a physical interface to the channel group if you configured a name for it. You must first remove the name.

  • You cannot add an interface part of another EtherChannel interface group, Switchport interfaces, and interfaces with subinterfaces.

Procedure

Step 1

In the left pane, click Security Devices.

Step 2

Click the ASA tab.

Step 3

Select the device you want to modify, and in the Management pane on the right, click Interfaces.

Step 4

Choose > EtherChannel Interface.

Step 5

In the Logical Name field, provide a name for the EtherChannel interface.

Step 6

In the EtherChannel ID, enter an integer between 1 and 8.

Step 7

Click the drop-down button for Link Aggregation Control Protocol and select one of the two options:

  • Active —Sends and receives LACP updates. An active EtherChannel can establish connectivity with either an active or a passive EtherChannel. You should use the active mode unless you need to minimize the amount of LACP traffic.
  • On— The EtherChannel is always on, and LACP is not used. An on EtherChannel can only establish a connection with another EtherChannel that is also configured to be on.

Step 8

Search for and select the interfaces you want to include in the EtherChannel as members. You must include at least one interface.

Warning

If you add an EtherChannel interface as a member and it already has an IP address configured, Security Cloud Control removes the IP address of the member.

Step 9

Select the IPv4, IPv6, or Advanced tab to configure the IP address of the subinterface.

Step 10

Move the State slider at the top right of the window to enable the EtherChannel interface.

Step 11

Click Save.

Step 12

Review and deploy the changes you made.