Link Aggregation

What Is Link Aggregation?

Link aggregation is the bundling of two or more physical Ethernet links into one logical link between two devices. The links share traffic and cover for each other if one fails.

The bundle is called a link aggregation group, or LAG. Your switch treats it as a single interface. You assign VLANs to it and read one traffic counter for it. Four cables might sit underneath.

Vendors use their own names for the same idea. Cisco calls it EtherChannel or a port channel. Linux calls it bonding, and Windows Server calls it NIC teaming.

All of them follow the IEEE 802.1AX standard. It absorbed the older 802.3ad in 2008.

You will meet LAGs most often on switch uplinks, hypervisor hosts and storage arrays. Those carry the most traffic, so they hurt the most when they drop.

How Does Link Aggregation Work?

The switch spreads traffic across the member links with a hash. Every frame in one conversation lands on the same link.

The hash reads fields from the frame header. Depending on the switch, you can hash on the MAC pair, the IP pair, or the IP pair plus TCP or UDP ports. The result picks one member link, and the same inputs always produce the same pick.

Keeping a flow on one link stops frames from arriving out of order. The trade is that the load only balances across many flows. Two hosts talking to each other use one link, however many links the bundle holds.

When a member link fails, the switch drops it from the hash table. Its flows move to the surviving links. The LAG stays up, and most applications never notice beyond a lost packet or two.

What Is LACP and How Does It Work?

Link Aggregation Control Protocol (LACP) is the part of 802.1AX that lets two devices negotiate a LAG between themselves. Without it, you configure both ends by hand and hope they match.

Each side sends small frames called LACPDUs on every member port. The frames carry a system ID, a port key and a priority. When both ends agree that a port belongs to the same group, that port joins the bundle and starts carrying traffic.

Active and Passive Modes

A port runs in one of two LACP modes.

• Active: the port sends LACPDUs on its own.

• Passive: the port only answers LACPDUs it receives.

A LAG forms when at least one side runs active. Two passive ends never come up. We set both ends to active by default, because that removes one thing to get wrong.

Slow and Fast Timers

LACP keeps watching the link after it forms. A port that misses three LACPDUs in a row gets pulled from the group. At the default slow rate of one frame every 30 seconds, you wait 90 seconds. Fast rate sends one per second and cuts that to three seconds.

Which Layer LACP Runs At

LACP runs at Layer 2. It rides directly on Ethernet and needs no IP address on the ports. Routing never enters into it.

Static LAG vs LACP: Which Should You Use?

A static LAG bundles the ports with no protocol at all. You tell each switch which ports belong together and connect the cables. An LACP LAG negotiates the same result and keeps checking it.

Here is how the two compare on the points that matter in production.

Choose static only when one side cannot run LACP. We see that mostly on older storage controllers.

A virtual switch with LACP turned off is the other common case. Everywhere else, LACP costs nothing and catches the miscabling that a static bundle forwards traffic into.

Cisco also ships PAgP, its own negotiation protocol. Between two Cisco switches it does the same job as LACP. Nothing else speaks it. LACP stays the safer default in a mixed estate.

Does Link Aggregation Increase Speed?

Link aggregation raises total capacity, but it does not make any single connection faster.

Four 1 Gbps links in a LAG give you 4 Gbps of bandwidth headroom. A single file copy between two servers still tops out at 1 Gbps, because the hash pins that flow to one member. Twenty users pulling files at once do spread across all four links.

The hash can also land unevenly. With few flows, or with many flows between the same two addresses, one member can sit at 95 percent while the other three idle.

If one host needs more than one link's worth of throughput, buy a faster port. A LAG solves crowding, and a 10 Gbps uplink solves a single fat flow.

What Are the Requirements for Link Aggregation?

Every member link in a LAG has to look identical to the switch. The rules below hold across vendors.

• Same speed and duplex: A 1 Gbps port and a 10 Gbps port cannot share a bundle.

• Same port configuration on every member: Trunk or access mode, native VLAN, allowed VLANs and MTU must all match before a port can join.

• Support on both ends: Unmanaged switches have no LAG feature, so a LAG cannot terminate on one.

• One neighbor for all members: Every cable in the bundle lands on the same device, unless the far end is a switch stack or an MLAG pair that presents two chassis as one.

• A member cap: Most switches allow 8 active links per group, with a few more held in standby.

A good rule of thumb is to configure the LAG on both ends before you plug in the second cable.

Two parallel links between switches with no bundle and no spanning tree form a loop. And a loop takes the segment down in seconds.

How Do You Monitor a Link Aggregation Group?

Monitor the member ports as well as the bundle. The LAG interface stays up when one member dies, so a check on the logical interface alone reports green while a quarter of your capacity is gone.

Poll each physical member for operational status and utilization over SNMP. The IF-MIB stacking table maps each physical port to its aggregate.

A monitoring tool that reads it can alert on the member and name the LAG it belongs to in the same message.

We alert on three signals.

1. A member port goes down while the LAG stays up: capacity is gone and nothing else will tell you.

2. One member sits above 80 percent while its siblings idle: the hash is polarized, or one flow is hogging a link.

3. LACP state flips on a port that should be stable: usually a failing transceiver or a marginal fiber run.

Bundles hide problems by design, and that is the whole point of them. Per-member switch monitoring gives that design a witness, so you fix the first failed link before the second one turns redundancy into an outage.