Switch dependencies — LAG, port-channel, MLAG, and switch model specifics

A bond is only half the aggregation. The other half is the upstream switch. If the host is configured for 802.3ad and the switch is configured as access ports, the bond never forms. The two ends must agree on the mode, the hash policy, and the failure window. This lesson walks through the switch-side configuration, the three flavours of switch aggregation (static LAG, LACP, and MLAG), and the model-specific gotchas that production teams encounter.

The three aggregation flavours on the switch

flowchart LR
  A[Switch port aggregation] --> B[Static LAG]
  A --> C[LACP]
  A --> D[MLAG]
  B -->|description| E[Switch group<br/>with no protocol]
  C -->|description| F[Switch group<br/>with LACP protocol]
  D -->|description| G[Two switches<br/>appear as one]

The host bond does not know which one the switch is using. From the host’s perspective, the link is up, the slaves are up, and the aggregate is up. The switch is what determines whether the aggregation is honoured, what the hash policy is, and what happens when a slave dies.

Static LAG (no protocol)

In a static LAG, the switch ports are grouped into a channel without any negotiation. The switch is told “these two ports are one logical port” and that is the whole configuration. The host does not need to speak LACP; the switch assumes the host will send traffic on the channel.

Cisco IOS / NX-OS
interface Ethernet1/1
  channel-group 10 mode on
interface Ethernet1/2
  channel-group 10 mode on
interface port-channel 10
  switchport
  switchport mode trunk

The mode on is the key. The switch is told to use the channel without any protocol. The host must be configured for a mode that does not require LACP — balance-xor is the standard choice for this case.

The trap: if the host is configured for 802.3ad and the switch is in static mode, the host will keep sending LACPDU and the switch will ignore them. The bond will appear up but the aggregation will be slightly different than the operator expects. The switch will distribute by its own hash; the host will distribute by its own hash. The hashes do not match.

LACP (the standard)

LACP is the protocol-based aggregation. The switch and the host negotiate the channel via LACPDU. Both ends agree on the aggregation or the channel does not form.

Cisco IOS / NX-OS
interface Ethernet1/1
  channel-group 10 mode active
interface Ethernet1/2
  channel-group 10 mode active
interface port-channel 10
  switchport
  switchport mode trunk

The mode active is the LACP equivalent of “I will speak LACP, please aggregate me”. mode passive is the other option — the switch will speak LACP only if the peer speaks first.

Arista EOS
interface Ethernet1
  channel-group 10 mode active
interface Ethernet2
  channel-group 10 mode active
interface Port-Channel10
  switchport
  switchport mode trunk

Arista EOS uses the same mode active / passive / on syntax. The hosting bonding mode on the VyOS side is 802.3ad.

MLAG (multi-chassis LAG)

In a multi-chassis LAG, the two switch ports are on different switches. The two switches coordinate via a peer-link so that the host sees a single logical port-channel. MLAG is the modern replacement for stacked switches: a stack of two switches appears as one device, and the host can bond to both.

flowchart LR
  A[VyOS bond0<br/>eth0 + eth1] --> B[Switch A<br/>port 1]
  A --> C[Switch B<br/>port 1]
  B -. peer-link .-> C
  B --> D[Switch A<br/>continues]
  C --> E[Switch B<br/>continues]

The two switches need a peer-link between them (typically a dedicated 10G or 40G link) and they need to run a coordination protocol (MLAG on Arista, vPC on Cisco Nexus, MC-LAG on Juniper). The host sees eth0 and eth1 as bond slaves, and each slave is on a different physical switch.

The advantage: one switch can fail entirely and the host keeps forwarding. The remaining slave continues; the peer-link isolates the failed switch; the host’s bond never noticed because one slave is still up.

Switch model specifics

The exact syntax differs across vendors. The aggregate semantics are the same; the CLI is not.

Cisco IOS / NX-OS

• channel-group <id> mode active | passive | on
• interface port-channel <id> to configure the logical interface
• show etherchannel summary to verify
• show etherchannel <id> detail for the per-channel PDU counters

Arista EOS

• channel-group <id> mode active | passive | on
• interface Port-Channel<id> (note the capitalisation)
• show etherchannel summary
• show mlag to confirm the MLAG state

Juniper Junos

• set interfaces <name> ether-options 802.3ad <bundle>
• set interfaces <name> ether-options 802.3ad <bundle> mode active | passive
• show lacp interfaces
• show interfaces <bundle>

Huawei VRP

• interface Eth-Trunk <id>
• trunkport <member>
• mode lacp
• display eth-trunk

The lacp-rate is implicit on most modern switches; slow mode is the default. Some switches (especially older Cisco) have a global lacp system-priority that affects election.

Hash policy mismatch

The hash policy determines which slave a frame uses. The host and the switch both compute the hash; they must agree on the inputs.

flowchart LR
  A[Frame] --> B[Hash inputs]
  B --> C{Policy?}
  C -- layer2 --> D[MAC XOR]
  C -- layer3+4 --> E[IP + port XOR]
  D --> F[Slave: eth0]
  E --> G[Slave: eth1]

If the host is configured for layer3+4 and the switch is configured for layer2, the two ends select different slaves for the same flow. The result is asymmetric distribution: the host sends a flow on eth0, the switch expects it on eth1. Conversations break.

The fix is to align the hash policy on both sides. On VyOS:

[edit]
vyos@vyos# set interfaces bonding bond0 hash-policy 'layer3+4'
[edit]
vyos@vyos# commit
[edit]
vyos@vyos# save

On the switch side, the equivalent is port-channel load-balance src-dst-ip-l4port (Cisco) or port-channel load-balance ethernet src-dst-ip (Arista).

Verification across the switch boundary

The host sees the bond state. The switch sees the channel state. Both must agree. The cross-check:

vyos@vyos:~$ cat /proc/net/bonding/bond0
...
Slave Interface: eth0
MII Status: up
Aggregator ID: 1
Partner MAC: aa:bb:cc:dd:ee:ff
...

The bond’s Partner MAC is the switch’s system MAC. If the partner MAC is the same for both slaves, they are on the same switch. If the partner MACs differ, they are on different switches — which is the MLAG case.

Cisco IOS
Switch# show etherchannel summary
Group  Port-channel  Protocol    Ports
------+-------------+-----------+---------------------
10     Po10(SU)       LACP       Eth1/1(P)  Eth1/2(P)

The SU flag means the channel is up and in layer-2 state. The P next to each port means the port is bundled in the channel.

Arista EOS
Switch# show etherchannel summary
Group  Port-channel  Protocol    Ports
------+-------------+-----------+---------------------
10     Port-Channel10 LACP       Eth1(P)  Eth2(P)

Same field layout, slightly different syntax. The substantive output is the same: the channel is up, the ports are bundled.

How it fails

The production failure modes the engineer must recognise:

• Mode mismatch. Host is 802.3ad, switch is static LAG. The host sends LACPDU; the switch ignores them. The bond appears up but the aggregation is not deterministic.
• VLAN mismatch on the trunk. The switch port-channel is configured as access VLAN 10 but the host is sending tagged frames on VLAN 20. The frames are dropped.
• Hash policy mismatch. Host and switch use different hash inputs. Conversations get split across slaves unpredicably.
• MLAG peer-link down. The two switches in the MLAG pair cannot coordinate. The host bond may flap or fail.
• Spanning-tree blocking the secondary slave. Even on a LAG, STP may block one of the ports if the STP topology is misconfigured. The channel is up but one port is in blocking state.
• MTU mismatch. The switch port-channel has MTU 9216 (jumbo) but the host is configured for MTU 1500. Jumbo frames are dropped.

Rollback

The recovery from a switch-side misconfiguration:

• Wrong mode: reconfigure the switch ports to LACP active.
• VLAN mismatch: change the switch port-channel to trunk and allow the right VLANs.
• Hash mismatch: align the host and switch hash policy.
• MLAG peer-link down: fix the peer-link cable or the configuration on the switches.

If the switch cannot be brought back to a consistent state, fall back to active-backup on the host. The single-switch configuration is easier to revert than the multi-switch MLAG.

Production discipline

Cross-course references

The OPNsense course’s VII-OPNsense-Interfaces covers the firewall-side LAG concepts. The Proxmox course’s XXIX-Proxmox-Networking covers the host-side bonding for hypervisor bridges. The Observability course covers the telemetry side for monitoring LACP state.

Quiz