How to configure wire mode with Link Aggregation( inline traffic monitor over LAG)

03/26/2020 1,083 People found this article helpful 46,197 Views

Description

A SonicWall security appliance can be connected inline over LAG (Link Aggregation group) to inspect the bypass traffic and allowing packets sent on the group to be bridged across to the destination transparently as well.

Resolution

The LAG connection has been established successfully with LACP enabled between two CISCO switches. A SonicWall appliance will be deployed inline to inspect the traffic over LAG and also bypassing all the traffic as well as LACP packet between the CISCO and CISCO switch.

Fig.1 LAG without SonicWall inline

Fig.2 C3550-24 LAG Summary

Fig.3 C3560G-24TS LAG Summary

Fig.4 Ping from PC 10.103.20.54 to Laptop

Following (Fig.5) is an example about how to deploy the SonicWall inline over LAG with 2 members.

Fig.5 LAG with SonicWall inline

Step 1: Connect C3550-Fa0/2 to SonicWall-X3, C3550-Fa0/3 to SonicWall-X5, C3560G-Gi0/2 to SonicWall-X4 and C3560G-Gi0/3 to SonicWall-X6.
Step 2: Navigate to Network | Interfaces page. Click on the Configure icon for the interface X3 and the Edit Interface window will be displayed.

Options in the General Tab

From the Zone menu, select the zone you want.
From the Mode/IP Assignment menu, select Wire Mode(2-Port Wire).
From the Wire Mode Type menu, select Secure (Active DPI of Inline Traffic).
From the Paired Interface menu, select the interface you want.
From the Paired Interface Zone menu, select the zone you want.
(Optional) Select the Disable Stateful Inspection option if you want it.
(Optional) Select the Enable Link State Propagation option if you want it.