# Bond Interfaces (Link Aggregation) in VyOS

> Configure Bond interfaces in VyOS for link aggregation - LACP, round-robin, active-backup modes, load balancing and fault tolerance in the cloud

Source: https://opennix.org/en/docs/vyos/interfaces/vyos-bond/



A bond (bonding) combines several physical network interfaces into a single logical interface to increase throughput and provide fault tolerance.

## Overview

A bond provides:
- **Increased throughput** - link aggregation
- **Fault tolerance** - automatic failover
- **Load balancing** - traffic distribution
- **Redundancy** - link backup

**Also known as**:
- Link Aggregation
- Port Channel
- EtherChannel (Cisco)
- LAG (Link Aggregation Group)
- NIC Teaming

## Bonding Modes

### 802.3ad (LACP)

**IEEE 802.3ad Dynamic Link Aggregation** - the standard aggregation protocol.

```
set interfaces bonding bond0 mode '802.3ad'
commit
```

**Characteristics**:
- Requires LACP support on the switch
- Automatic detection and configuration
- Load balancing
- Failover on link failure
- Uses all active links

**When to use**:
- Modern managed switches
- Standard aggregation is needed
- Dynamic configuration is required

### active-backup

Only one interface is active; the rest are on standby.

```
set interfaces bonding bond0 mode 'active-backup'
commit
```

**Characteristics**:
- The simplest mode
- Does not require switch support
- Failover only (no load balancing)
- Fast switchover on failure

**When to use**:
- The switch does not support aggregation
- Only fault tolerance is needed
- Simple configuration

### balance-rr (Round-Robin)

Sequential packet transmission across all interfaces.

```
set interfaces bonding bond0 mode 'balance-rr'
commit
```

**Characteristics**:
- Load balancing
- Failover
- May cause packet reordering
- Does not require switch support

**When to use**:
- Local connection (no switch)
- Testing

### balance-xor

Hash-based balancing (MAC, IP).

```
set interfaces bonding bond0 mode 'balance-xor'
set interfaces bonding bond0 hash-policy 'layer2+3'
commit
```

**Characteristics**:
- Hash-based balancing
- Failover
- Predictable distribution
- Does not require LACP

**When to use**:
- Switch without LACP
- Balancing without a protocol is needed

### broadcast

Transmission on all interfaces simultaneously.

```
set interfaces bonding bond0 mode 'broadcast'
commit
```

**Characteristics**:
- Traffic duplication
- Maximum fault tolerance
- No throughput increase
- Consumes more resources

**When to use**:
- Critical systems
- Specific requirements

### balance-tlb (Transmit Load Balance)

Outbound traffic balancing without a protocol.

```
set interfaces bonding bond0 mode 'balance-tlb'
commit
```

**Characteristics**:
- TX balancing
- Failover
- Does not require switch support
- RX on a single interface

**When to use**:
- More outbound traffic
- Switch without aggregation

### balance-alb (Adaptive Load Balance)

Balancing of both inbound and outbound traffic.

```
set interfaces bonding bond0 mode 'balance-alb'
commit
```

**Characteristics**:
- TX and RX balancing
- Uses ARP negotiation
- Does not require switch support
- IPv4 only

**When to use**:
- Two-way balancing
- Switch without LACP
- IPv4 traffic only

## Basic Configuration

### Creating a bond interface

```
set interfaces bonding bond0 mode '802.3ad'
set interfaces bonding bond0 member interface eth1
set interfaces bonding bond0 member interface eth2
commit
```

### IP addressing

```
set interfaces bonding bond0 address 192.168.1.1/24
set interfaces bonding bond0 address 2001:db8::1/64
commit
```

### Description

```
set interfaces bonding bond0 description 'Bonded uplink to core switch'
commit
```

## Configuration Parameters

### Member Interfaces

Adding physical interfaces:

```
set interfaces bonding bond0 member interface eth0
set interfaces bonding bond0 member interface eth1
set interfaces bonding bond0 member interface eth2
commit
```

All member interfaces must have identical parameters (speed, duplex).

### Hash Policy

The traffic distribution algorithm (for 802.3ad, balance-xor):

```
set interfaces bonding bond0 hash-policy 'layer2+3'
commit
```

Options:
- **layer2** - uses MAC addresses (default)
- **layer2+3** - uses MAC + IP addresses
- **layer3+4** - uses IP + ports (TCP/UDP)

Recommendation: `layer2+3` or `layer3+4` for better balancing.

### LACP Rate

The LACP packet frequency (for 802.3ad only):

```
set interfaces bonding bond0 lacp-rate 'fast'
commit
```

Values:
- **slow** - LACP every 30 seconds (default)
- **fast** - LACP every second (fast failure detection)

Recommendation: `fast` for critical systems.

### Minimum Links

The minimum number of active links:

```
set interfaces bonding bond0 min-links 1
commit
```

The bond will be UP only if at least the specified number of member interfaces are active.

### Primary Interface

The preferred interface (for active-backup):

```
set interfaces bonding bond0 mode 'active-backup'
set interfaces bonding bond0 primary eth0
commit
```

### ARP Monitoring

Monitoring availability via ARP:

```
set interfaces bonding bond0 arp-monitor interval 100
set interfaces bonding bond0 arp-monitor target 192.168.1.254
commit
```

Parameters:
- **interval** - the check interval in milliseconds
- **target** - the IP address to monitor

An alternative to MII monitoring (default).

### System MAC

The MAC address of the bond interface:

```
set interfaces bonding bond0 mac '00:50:56:00:00:01'
commit
```

By default, it uses the MAC of the first member interface.

## VLAN on Bond

A bond can contain VLAN sub-interfaces:

```
set interfaces bonding bond0 vif 10 address 192.168.10.1/24
set interfaces bonding bond0 vif 10 description 'VLAN 10 - Management'

set interfaces bonding bond0 vif 20 address 192.168.20.1/24
set interfaces bonding bond0 vif 20 description 'VLAN 20 - Data'

commit
```

## Configuration Examples

### Basic 802.3ad (LACP) bond

Aggregation of two ports with LACP:

```
set interfaces bonding bond0 mode '802.3ad'
set interfaces bonding bond0 hash-policy 'layer2+3'
set interfaces bonding bond0 lacp-rate 'fast'
set interfaces bonding bond0 member interface eth0
set interfaces bonding bond0 member interface eth1
set interfaces bonding bond0 address 10.0.0.1/24
set interfaces bonding bond0 description 'Uplink to core switch'
commit
```

### Active-backup for fault tolerance

```
set interfaces bonding bond0 mode 'active-backup'
set interfaces bonding bond0 primary eth0
set interfaces bonding bond0 member interface eth0
set interfaces bonding bond0 member interface eth1
set interfaces bonding bond0 address 192.168.1.1/24
commit
```

### Bond with 4 interfaces

```
set interfaces bonding bond0 mode '802.3ad'
set interfaces bonding bond0 hash-policy 'layer3+4'
set interfaces bonding bond0 lacp-rate 'fast'
set interfaces bonding bond0 member interface eth0
set interfaces bonding bond0 member interface eth1
set interfaces bonding bond0 member interface eth2
set interfaces bonding bond0 member interface eth3
set interfaces bonding bond0 min-links 2
set interfaces bonding bond0 address 10.0.0.1/24
commit
```

### Bond with VLANs

```
# Bond interface
set interfaces bonding bond0 mode '802.3ad'
set interfaces bonding bond0 hash-policy 'layer2+3'
set interfaces bonding bond0 member interface eth0
set interfaces bonding bond0 member interface eth1

# VLANs on the bond
set interfaces bonding bond0 vif 100 address 192.168.100.1/24
set interfaces bonding bond0 vif 100 description 'VLAN 100 - Servers'

set interfaces bonding bond0 vif 200 address 192.168.200.1/24
set interfaces bonding bond0 vif 200 description 'VLAN 200 - Workstations'

commit
```

### Bond in a Bridge

Bond as a bridge member for virtualization:

```
# Bond
set interfaces bonding bond0 mode '802.3ad'
set interfaces bonding bond0 member interface eth0
set interfaces bonding bond0 member interface eth1

# Bridge with the bond
set interfaces bridge br0 member interface bond0
set interfaces bridge br0 address 192.168.1.1/24

commit
```

### Dual uplink with ARP monitoring

```
set interfaces bonding bond0 mode 'active-backup'
set interfaces bonding bond0 primary eth0
set interfaces bonding bond0 member interface eth0
set interfaces bonding bond0 member interface eth1
set interfaces bonding bond0 arp-monitor interval 100
set interfaces bonding bond0 arp-monitor target 10.0.0.254
set interfaces bonding bond0 address 10.0.0.1/24
commit
```

## Switch Configuration

### Cisco IOS/IOS-XE

```
interface Port-channel1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30

interface GigabitEthernet1/0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
 channel-group 1 mode active

interface GigabitEthernet1/0/2
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
 channel-group 1 mode active
```

### Juniper Junos

```
set interfaces ae0 aggregated-ether-options lacp active
set interfaces ae0 unit 0 family inet address 10.0.0.2/24

set interfaces ge-0/0/0 ether-options 802.3ad ae0
set interfaces ge-0/0/1 ether-options 802.3ad ae0
```

### Arista EOS

```
interface Port-Channel1
   switchport mode trunk
   switchport trunk allowed vlan 10,20,30

interface Ethernet1
   channel-group 1 mode active

interface Ethernet2
   channel-group 1 mode active
```

### HP/Aruba

```
trunk 1-2 trk1 lacp
vlan 10 tagged trk1
vlan 20 tagged trk1
```

## Operational Commands

### Viewing bond interfaces

All bond interfaces:
```
show interfaces bonding
```

A specific bond:
```
show interfaces bonding bond0
```

Detailed information:
```
show interfaces bonding bond0 detail
```

Example output:
```
bond0: <BROADCAST,MULTICAST,MASTER,UP> mtu 1500 state UP
    address: 00:0c:29:ab:cd:ef
    mode: 802.3ad
    hash-policy: layer2+3
    lacp-rate: fast
    min-links: 1

    member interfaces:
        eth0: <SLAVE,UP> speed 1000 duplex full
        eth1: <SLAVE,UP> speed 1000 duplex full
```

### LACP information

```
show interfaces bonding bond0 lacp
```

### Status of slave interfaces

```
show interfaces bonding bond0 slaves
```

## Monitoring and Diagnostics

### Checking LACP negotiation

```
show interfaces bonding bond0 lacp detail
```

Check:
- Actor and Partner system ID
- LACP activity
- The Aggregator ID is the same for all ports

### Checking load balancing

```
show interfaces bonding bond0 statistics
```

Traffic should be distributed across the member interfaces.

### Testing failover

Disable one member interface:
```
set interfaces ethernet eth0 disable
commit
```

Check the bond:
```
show interfaces bonding bond0
```

Re-enable it:
```
delete interfaces ethernet eth0 disable
commit
```

## Troubleshooting

### Bond does not come up

Check the member interfaces:
```
show interfaces
```

All member interfaces must be UP.

Check the configuration:
```
show configuration interfaces bonding bond0
```

### LACP is not working

Check the switch:
- LACP is enabled on the ports
- The ports are in the same port-channel
- LACP mode: active or passive

Check LACP on VyOS:
```
show interfaces bonding bond0 lacp
```

### No traffic balancing

Check the hash-policy:
```
show configuration interfaces bonding bond0 hash-policy
```

Try a different hash-policy:
```
set interfaces bonding bond0 hash-policy 'layer3+4'
commit
```

Make sure there is diversity in the hash (different IPs, MACs, ports).

### Frequent failovers

Check the cables and interfaces:
```
show interfaces ethernet eth0 physical
```

Increase the LACP rate (if slow is used):
```
set interfaces bonding bond0 lacp-rate 'fast'
commit
```

### MTU mismatch

Set the same MTU on all member interfaces and the bond:
```
set interfaces bonding bond0 mtu 9000
commit
```

Member interfaces inherit the MTU from the bond.

## Performance

### Maximum throughput

A bond increases the aggregate bandwidth:
- 2x1G ports = ~2 Gbps
- 4x1G ports = ~4 Gbps
- 2x10G ports = ~20 Gbps

**Important**: A single flow (one TCP session) will not exceed the speed of a single member interface due to hashing.

### Hash Policy for better balancing

- **layer2** - good for different MACs
- **layer2+3** - better for different IPs
- **layer3+4** - best for many TCP/UDP connections

### Jumbo Frames

For high-performance networks:
```
set interfaces bonding bond0 mtu 9000
commit
```

All member interfaces and the switch must support jumbo frames.

## Security

### MAC Spoofing Protection

A bond uses a single MAC address for all member interfaces.

### LACP Authentication

VyOS does not support LACP authentication (802.1X). Use physical security and port security on the switch.

## Best Practices

1. **Use 802.3ad (LACP)** - standard and reliable
2. **Identical interfaces** - the same speed/duplex for all members
3. **LACP fast mode** - for fast failover
4. **Min-links** - set a minimum number of active links
5. **Hash-policy layer3+4** - for better balancing
6. **Monitoring** - track the status of member interfaces
7. **Backup** - save the configuration
8. **Test failover** - verify switchover
9. **Same MTU** - on all members
10. **Document** - which ports belong to which bond

## Limitations

- Maximum throughput is limited by the sum of the member interfaces
- A single TCP connection will not exceed the speed of a single interface
- LACP requires switch support
- Not all modes support RX balancing

## Migration from a Single Interface to a Bond

1. Create a bond with a new name
2. Move the IP configuration to the bond
3. Add the member interfaces
4. Test
5. Remove the old configuration

## Next Steps

- [Bridge](/docs/vyos/interfaces/vyos-bridge/) - using a bond in a bridge
- [VLAN](/docs/vyos/interfaces/vyos-vlan/) - VLANs on a bond
- [High Availability](/docs/vyos/ha/) - bonds for HA
- [Firewall](/docs/vyos/firewall/) - protecting bond traffic