EtherChannel: LACP vs PAgP vs mode on — which should I use?

Use LACP (mode active) unless something forces otherwise. LACP is the IEEE standard (802.3ad): both sides negotiate, verify they agree, and refuse to bundle on misconfig — the safe failure. PAgP is the Cisco-proprietary equivalent (only relevant vendor-locked). Mode on skips negotiation entirely: both sides just assume a bundle. If one side is on and the other isn't — or a member port's VLAN/speed config drifts — you can get forwarding loops or blackholed traffic with no protocol to catch it. Pairing rules matter too: active↔active or active↔passive bundle; passive↔passive never comes up (both waiting). Also remember all member links must match: speed, duplex, access/trunk mode, allowed VLANs — mismatch and the port is suspended from the bundle.