Combination of LAG and VLAN doesn't work

Marco,

on my XG I have 3 VLAN (1, 100, 200) using a Cisco switch, the port connected to XG LAN interface transports the 3 VLANs to XG. So the CIsco port is configured as TRUNK.

Then I have 2 additional zones (zVlan100, zVLAN200).

Also to permit traffic between VLAN (1, 100, 200 in my case) you have to create Policy rule otherwise traffic is denied.

it is not a policy problem. the problem is, that etherframes with vlan 203 terminated as untagged. when i configure it without LAG, vlan works well. (same configuration)

other example:

ARP request on VLAN 203 by SG210:

09:35:14.260887 Internal.203, OUT: ARP, Request who-has 10.207.10.29 tell 10.207.10.254, length 28

Server (10.207.10.28 as untagged on vlan203) got request and answer.

Firewall see Request on Internal and not on Internal.203

09:35:20.321258 Internal, IN: ARP, Reply 10.207.10.28 is-at 84:2b:2b:06:3c:cd (oui Unknown), length 46

No i didn't use LACP because i have select Active/Backup as mode.

Ok (Active/Passive).

It should work even for VLAN.

Can you show your switch running config? I mean VLAN and both ports attached to LAG group.

Thanks.

Luk

Yes. I have at the moment only 1 port active (test setup)

FW

interface tengigabitethernet1/0/2
 switchport mode general 
 switchport general allowed vlan add 202-205 tagged 
 switchport general allowed vlan add 201 untagged 
 switchport general pvid 201 
!

Server

interface gigabitethernet1/0/28
 switchport mode general 
 switchport general allowed vlan add 203 untagged 
 switchport general pvid 203
!

Marco,

on interface tengigabitethernet1/0/2 add VLAN 201 as Tagged. Also confiugure an additional port on Switch with the same settings and connect to XG LAG.

Luk

I preferre normaly only tagged ports, but on XG it is not possible to configure VLAN without untagged / active ipv4 config.

So i have remove LAG von Port1 and Port2 (FlexiModul) and have reconfigure Port1 (201 untagged) and Port1.203 nnd so it works perfect. without any changes on switch. it must be a bug in XG.

> on interface tengigabitethernet1/0/2 add VLAN 201 as Tagged. Also confiugure an additional port on Switch with the same settings and connect to XG LAG.

i have no free port on switch but it must work with one port. a failover configuration that only works with both ports active woukld be a bad joke :D

Nice Marco!

Anyway on switch the second port should be available in case the first one is not available.

Thank you for sharing your issue/config.

[:D]

Luk

Hi Marco,

Were you able to get this working? I discovered this problem as well where tagged traffic on a port-channel using the flexi-ports doesn't seem to be forwarded to the tagged interface and ends up on the native trunk port vlan.

Did you happen to lodge a Sofserv case with support? 

Hi Marco,

Were you able to get this working? I discovered this problem as well where tagged traffic on a port-channel using the flexi-ports doesn't seem to be forwarded to the tagged interface and ends up on the native trunk port vlan.

Did you happen to lodge a Sofserv case with support? 

We opened a ticket about this (same problem on XG330 with SFP+ on FlexiPorts and a Huawei stack).
It's a known problem for them ("lots of issues about LAG") and their official answer is to upgrade to 16.x firmware.

However, online upgrade (download GPG firmware then upload it to the admin interface) of our XG330 to the last 16.x firmware (16.01.1) killed them.
They boot then freeze (no more web interface access, even serial console is dead: "Password:" prompt is here but nothing happens).

Next try is to reinstall from them scratch with the ISO.

HI David , 

Thank you for an update , Let us know if it works with the same setup . 

Thanks and Regards

Aditya Patel | Network and Security Engineer.