RHEL: LACP Bonding with Tagged VLANs

This guide describes how to configure two LACP bonds on Red Hat Enterprise Linux using NetworkManager and nmcli.

Goal:

  • Port 1 + 2 form one LACP bond for VLAN 129
  • Port 3 + 4 form one LACP bond for VLAN 330 and VLAN 380
  • The bond interfaces themselves do not get any IP configuration
  • IP configuration is only applied to the VLAN interfaces
  • VLANs are configured as tagged VLANs on the switch side

Target Design

Physical Ports Bond VLANs VLAN Interfaces
Port 1 + 2 bond12 129 bond12.129
Port 3 + 4 bond34 330, 380 bond34.330, bond34.380

Example interface names:

ens1f0
ens1f1
ens2f0
ens2f1

Adjust the interface names to match your system.

Install Required Packages

dnf install -y NetworkManager iproute ethtool
systemctl enable --now NetworkManager

Check the current status:

nmcli dev status
nmcli con show

Important Notes Before Starting

The bond interfaces themselves are configured without IP addresses.

ipv4.method disabled
ipv6.method ignore

IP addresses are configured later only on the VLAN interfaces, for example:

bond12.129
bond34.330
bond34.380

The Ethernet port profiles that are added to the bond must also be allowed to come up automatically.

These settings are important:

connection.autoconnect yes
connection.autoconnect-ports 1

If the port profiles are not allowed to autoconnect, the network adapters may stay inactive and may not appear as active bond ports.

Bond 1: Port 1 + 2 for VLAN 129

Create Bond bond12

nmcli con add type bond con-name bond12 ifname bond12 \
  bond.options "mode=802.3ad,miimon=100,lacp_rate=fast,xmit_hash_policy=layer2+3" \
  ipv4.method disabled \
  ipv6.method ignore

Add Ethernet Ports to the Bond

Example using ens1f0 and ens1f1:

nmcli con add type ethernet con-name bond12-p1 ifname ens1f0 \
  port-type bond controller bond12

nmcli con add type ethernet con-name bond12-p2 ifname ens1f1 \
  port-type bond controller bond12

Enable Autoconnect for the Bond and Its Ports

This is important so that the Ethernet adapters actually become active members of the bond.

nmcli con mod bond12 connection.autoconnect yes
nmcli con mod bond12 connection.autoconnect-ports 1

nmcli con mod bond12-p1 connection.autoconnect yes
nmcli con mod bond12-p2 connection.autoconnect yes

Create VLAN 129 on bond12

nmcli con add type vlan con-name bond12.129 ifname bond12.129 \
  vlan.parent bond12 \
  vlan.id 129 \
  ipv4.method disabled \
  ipv6.method ignore

Bond 2: Port 3 + 4 for VLAN 330 and 380

Create Bond bond34

nmcli con add type bond con-name bond34 ifname bond34 \
  bond.options "mode=802.3ad,miimon=100,lacp_rate=fast,xmit_hash_policy=layer2+3" \
  ipv4.method disabled \
  ipv6.method ignore

Add Ethernet Ports to the Bond

Example using ens2f0 and ens2f1:

nmcli con add type ethernet con-name bond34-p1 ifname ens2f0 \
  port-type bond controller bond34

nmcli con add type ethernet con-name bond34-p2 ifname ens2f1 \
  port-type bond controller bond34

Enable Autoconnect for the Bond and Its Ports

Again, this is important so that the Ethernet adapters become active bond members.

nmcli con mod bond34 connection.autoconnect yes
nmcli con mod bond34 connection.autoconnect-ports 1

nmcli con mod bond34-p1 connection.autoconnect yes
nmcli con mod bond34-p2 connection.autoconnect yes

Create VLAN 330 on bond34

nmcli con add type vlan con-name bond34.330 ifname bond34.330 \
  vlan.parent bond34 \
  vlan.id 330 \
  ipv4.method disabled \
  ipv6.method ignore

Create VLAN 380 on bond34

nmcli con add type vlan con-name bond34.380 ifname bond34.380 \
  vlan.parent bond34 \
  vlan.id 380 \
  ipv4.method disabled \
  ipv6.method ignore

Bring Up the Connections

nmcli con up bond12
nmcli con up bond12-p1
nmcli con up bond12-p2
nmcli con up bond12.129

nmcli con up bond34
nmcli con up bond34-p1
nmcli con up bond34-p2
nmcli con up bond34.330
nmcli con up bond34.380

If a port does not become active, check the port profile directly:

nmcli con show bond12-p1
nmcli con show bond12-p2
nmcli con show bond34-p1
nmcli con show bond34-p2

If required, set autoconnect again:

nmcli con mod bond12-p1 connection.autoconnect yes
nmcli con mod bond12-p2 connection.autoconnect yes
nmcli con mod bond34-p1 connection.autoconnect yes
nmcli con mod bond34-p2 connection.autoconnect yes

Example: Configure IP Addresses on VLAN Interfaces

VLAN 129 with Default Gateway

nmcli con mod bond12.129 \
  ipv4.method manual \
  ipv4.addresses 10.129.0.10/24 \
  ipv4.gateway 10.129.0.1 \
  ipv4.dns 10.129.0.53 \
  ipv6.method ignore

nmcli con up bond12.129

VLAN 330 without Default Gateway

nmcli con mod bond34.330 \
  ipv4.method manual \
  ipv4.addresses 10.330.0.10/24 \
  ipv4.never-default yes \
  ipv6.method ignore

nmcli con up bond34.330

VLAN 380 without Default Gateway

nmcli con mod bond34.380 \
  ipv4.method manual \
  ipv4.addresses 10.380.0.10/24 \
  ipv4.never-default yes \
  ipv6.method ignore

nmcli con up bond34.380

Important:

Do not blindly configure a default gateway on multiple VLAN interfaces.

Usually, only the management or default network gets a gateway. Additional VLANs either do not get a gateway or only use specific static routes.

Verification

Show Active Connections

nmcli con show --active

Show Devices

nmcli dev status

Check IP Addresses

ip -br addr

Check Routing

ip route

Check Bond Status

cat /proc/net/bonding/bond12
cat /proc/net/bonding/bond34

Important parts to look for:

Bonding Mode: IEEE 802.3ad Dynamic link aggregation
MII Status: up
Slave Interface: ens1f0
Slave Interface: ens1f1

For bond34, it should look similar:

Bonding Mode: IEEE 802.3ad Dynamic link aggregation
MII Status: up
Slave Interface: ens2f0
Slave Interface: ens2f1

Check VLAN Interfaces

ip -d link show bond12.129
ip -d link show bond34.330
ip -d link show bond34.380

Check Link Status of Physical Adapters

ethtool ens1f0 | egrep "Speed|Duplex|Link detected"
ethtool ens1f1 | egrep "Speed|Duplex|Link detected"
ethtool ens2f0 | egrep "Speed|Duplex|Link detected"
ethtool ens2f1 | egrep "Speed|Duplex|Link detected"

Fallback for Older RHEL Versions

On older RHEL versions, port-type and controller may not work.

In that case, create the bond ports using master and slave-type.

Example for bond12

nmcli con add type ethernet con-name bond12-p1 ifname ens1f0 \
  master bond12 slave-type bond

nmcli con add type ethernet con-name bond12-p2 ifname ens1f1 \
  master bond12 slave-type bond

nmcli con mod bond12 connection.autoconnect-slaves 1

nmcli con mod bond12-p1 connection.autoconnect yes
nmcli con mod bond12-p2 connection.autoconnect yes

Example for bond34

nmcli con add type ethernet con-name bond34-p1 ifname ens2f0 \
  master bond34 slave-type bond

nmcli con add type ethernet con-name bond34-p2 ifname ens2f1 \
  master bond34 slave-type bond

nmcli con mod bond34 connection.autoconnect-slaves 1

nmcli con mod bond34-p1 connection.autoconnect yes
nmcli con mod bond34-p2 connection.autoconnect yes

Common Issues

Bond Exists, but Ports Are Not Active

Check:

nmcli con show --active
cat /proc/net/bonding/bond12
cat /proc/net/bonding/bond34

Fix:

nmcli con mod bond12 connection.autoconnect yes
nmcli con mod bond12 connection.autoconnect-ports 1
nmcli con mod bond12-p1 connection.autoconnect yes
nmcli con mod bond12-p2 connection.autoconnect yes

nmcli con mod bond34 connection.autoconnect yes
nmcli con mod bond34 connection.autoconnect-ports 1
nmcli con mod bond34-p1 connection.autoconnect yes
nmcli con mod bond34-p2 connection.autoconnect yes

Then bring the connections up again:

nmcli con up bond12
nmcli con up bond12-p1
nmcli con up bond12-p2

nmcli con up bond34
nmcli con up bond34-p1
nmcli con up bond34-p2

VLAN Exists, but There Is No Communication

Check:

ip -d link show bond12.129
ip -d link show bond34.330
ip -d link show bond34.380

Also verify:

  • Is the VLAN tagged on the switch side?
  • Is the LACP port channel active on the switch?
  • Are the VLAN IDs correct?
  • Is the IP address configured on the VLAN interface and not on the bond?
  • Is there only one correct default gateway?

LACP Does Not Come Up

Check:

cat /proc/net/bonding/bond12
cat /proc/net/bonding/bond34

Important points:

  • The switch side must use LACP
  • Do not use a static EtherChannel if Linux is configured with 802.3ad
  • Both ports of one bond must be in the same switch port channel
  • VLAN tagging must be configured on the port channel, not only on the individual switch ports

Summary

The basic logic is:

Physical NICs → LACP Bond → VLAN Interface → IP Address

For example:

ens1f0 + ens1f1 → bond12 → bond12.129 → IP address
ens2f0 + ens2f1 → bond34 → bond34.330 / bond34.380 → IP address

The bonds themselves stay without IP configuration.

The VLAN interfaces receive the IP configuration.

The bond port profiles must have autoconnect yes, otherwise they may not reliably become active.