Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    LACP not working

    Scheduled Pinned Locked Moved General pfSense Questions
    113 Posts 2 Posters 24.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      cyberbot @stephenw10
      last edited by cyberbot

      @stephenw10 said in LACP not working:

      The switch should be in active mode by default too so strict LACP should still allow the interface to come up. It is possible to set it to passive mode but I don't think yours is.

      do I have to do something to force the LAGG to come online ?
      this the LAG config on the switch.

      1/1/1      Up      Blocked Full 1G    1     No  141  0   609c.9f4b.808c  WAN1
      2/1/1      Up      Blocked Full 1G    1     No  141  0   609c.9f4b.808c  WAN2
      

      and log on the switch

      Nov 27 05:19:39:I:System: dynamic lag interface 1/1/1's peer info (priority=4,id=e839.3511.faab,key=0) mis-matches with lag's peer info (priority=32768,id=e839.3511.faab,key=715), set to mismatch Error
      Nov 27 05:19:38:I:System: Logical link on dynamic lag interface ethernet 1/1/1 is up.
      Nov 27 05:19:38:I:Trunk: Group (1/1/1, 2/1/1) created by 802.3ad link-aggregation module.
      Nov 27 05:19:35:I:System: Logical link on dynamic lag interface ethernet 1/1/1 is down.
      Nov 27 05:19:32:I:System: dynamic lag interface 2/1/1's peer info (priority=3,id=e839.3511.faab,key=0) mis-matches with lag's peer info (priority=32768,id=e839.3511.faab,key=715), set to mismatch Error
      Nov 27 05:19:32:I:System: Logical link on dynamic lag interface ethernet 1/1/1 is down.
      Nov 27 05:19:32:I:Trunk: Group (1/1/1, 2/1/1) removed by 802.3ad link-aggregation module.
      Nov 27 05:19:32:I:System: Logical link on dynamic lag interface ethernet 2/1/1 is down.
      Nov 27 05:19:32:I:System: Logical link on dynamic lag interface ethernet 1/1/1 is down.
      Nov 27 05:19:32:I:System: dynamic lag interface 1/1/1's peer info (priority=4,id=e839.3511.faab,key=0) mis-matches with lag's peer info (priority=32768,id=e839.3511.faab,key=715), set to mismatch Error
      Nov 27 05:19:31:I:System: Logical link on dynamic lag interface ethernet 1/1/1 is up.
      Nov 27 05:19:31:I:Trunk: Group (1/1/1, 2/1/1) created by 802.3ad link-aggregation module.
      Nov 27 05:19:28:I:System: Logical link on dynamic lag interface ethernet 1/1/1 is down.
      Nov 27 05:19:25:I:System: dynamic lag interface 2/1/1's peer info (priority=3,id=e839.3511.faab,key=0) mis-matches with lag's peer info (priority=32768,id=e839.3511.faab,key=715), set to mismatch Error
      Nov 27 05:19:25:I:System: Logical link on dynamic lag interface ethernet 1/1/1 is down.
      Nov 27 05:19:25:I:Trunk: Group (1/1/1, 2/1/1) removed by 802.3ad link-aggregation module.
      Nov 27 05:19:25:I:System: Logical link on dynamic lag interface ethernet 2/1/1 is down.
      Nov 27 05:19:25:I:System: Logical link on dynamic lag interface ethernet 1/1/1 is down.
      

      I come some forum which they said to run those commands

      > sysctl net.link.lagg.default_use_flowid=0 
      > sysctl net.link.lagg.0.use_flowid=0 
      > sysctl net.link.lagg.1.use_flowid=0
      

      can you advies wither to do this won't crash a production firewall.

      thank you

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        Reviewing this there seem to be some differences in your early replies here.
        The lagg has a different MAC and seems to be connected to the same switch...

        Are you 100% confident on these are connected to the correct ports?

        Those values are defaults as far as I know so that should make no difference.
        What I have here:

        [2.4.5-RELEASE][admin@7100.stevew.lan]/root: sysctl net.link.lagg
        net.link.lagg.default_flowid_shift: 16
        net.link.lagg.default_use_flowid: 0
        net.link.lagg.failover_rx_all: 0
        net.link.lagg.lacp.default_strict_mode: 1
        net.link.lagg.lacp.debug: 0
        

        Steve

        1 Reply Last reply Reply Quote 0
        • C
          cyberbot
          last edited by cyberbot

          @cyberbot said in LACP not working:

          1/1/1 Up Blocked Full 1G 1 No 141 0 609c.9f4b.808c WAN1
          2/1/1 Up Blocked Full 1G 1 No 141 0 609c.9f4b.808c WAN2

          Hi Steve,
          when I google the error it comes back with wrong ports, but I am very confident that are connected to the correct ports
          as showen here

          1/1/1      Up      Blocked Full 1G    1     No  141  0   609c.9f4b.808c  WAN1
          2/1/1      Up      Blocked Full 1G    1     No  141  0   609c.9f4b.808c  WAN2
          

          port 1 of Switch 1 and Port 1 of Switch 2 are the LACP.
          I can see them when I do show interface brief

          now somehow port 1 just went into forward.

          === LAG "WAN" ID 1 (dynamic Deployed) ===
          LAG Configuration:
             Ports:         e 1/1/1 e 2/1/1
             Port Count:    2
             Primary Port:  1/1/1
             Trunk Type:    hash-based
             LACP Key:      20001
          Deployment: HW Trunk ID 1
          Port       Link    State   Dupl Speed Trunk Tag Pvid Pri MAC             Name
          1/1/1      Up      Forward Full 1G    1     No  141  0   609c.9f4b.808c  WAN1
          2/1/1      Up      Blocked Full 1G    1     No  141  0   609c.9f4b.808c  WAN2
          
          Port       [Sys P] [Port P] [ Key ] [Act][Tio][Agg][Syn][Col][Dis][Def][Exp][Ope]
          1/1/1           1        1   20001   Yes   L   Agg  Syn  Col  Dis  No   No   Ope
          2/1/1           1        1   20001   Yes   S   Agg  Syn  Col  Dis  No   No   Ina
          
          
           Partner Info and PDU Statistics
          Port          Partner         Partner     LACP      LACP
                       System ID         Key     Rx Count  Tx Count
          1/1/1    32768-e839.3511.faab      715        4         8
          2/1/1    32768-e839.3511.faab      715        5         9
          
          
          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by stephenw10

            Port 1 is set as Long timeouts, that same as pfSense. Port 2 is set to Short and it still blocked.

            That definitely looks like the problem. If you have not yet, redeploy it to take the Long setting. I assume Switch 1 may have rebooted or something.

            Steve

            C 1 Reply Last reply Reply Quote 0
            • C
              cyberbot @stephenw10
              last edited by

              @stephenw10 said in LACP not working:

              Port 1 is set as Long timeouts, that same as pfSense. Port 2 is set to Short and it still blocked.

              That definitely looks like the problem. If you have not yet, redeploy it to take the Long setting. I assume Switch 1 may have rebooted or something.

              Steve

              Thank you Steve for your answers.
              do i have to do this on the port or LAG?

              device(config)# lag blue dynamic id 1
              device(config-lag-blue)# lacp-timeout short
              LAG blue un-deployed successfully!
              LAG blue deployed successfully!
              device(config-lag-blue)#
              

              this hwat i do and it still shows the diferrences on the TIO.

              1 Reply Last reply Reply Quote 0
              • C
                cyberbot
                last edited by cyberbot

                i have managed to set the long TIO on the LAG, but unfortunately it still shows blocked

                LAG.PNG

                and switch log

                Nov 27 23:17:46:I:System: dynamic lag interface 1/1/1's peer info (priority=4,id=e839.3511.faab,key=0) mis-matches with lag's peer info (priority=32768,id=e839.3511.faab,key=715), set to mismatch Error
                Nov 27 23:17:45:I:System: Logical link on dynamic lag interface ethernet 1/1/1 is up.
                
                1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by

                  Ok this is what my lacp config section looks like in the switch from show running:

                  lag lacp1 dynamic id 2047
                   ports ethernet 1/2/1 ethernet 1/2/3 
                   primary-port 1/2/1
                   lacp-timeout long 
                   deploy
                  

                  Very simple.
                  You must have something else in there to generate that mis-match error.

                  Steve

                  C 1 Reply Last reply Reply Quote 0
                  • C
                    cyberbot @stephenw10
                    last edited by

                    @stephenw10 said in LACP not working:

                    running

                    this what show running show

                    !
                    lag WAN dynamic id 1
                     ports ethernet 1/1/1 ethernet 2/1/1
                     primary-port 1/1/1
                     lacp-timeout long
                     deploy
                     port-name WAN1 ethernet 1/1/1
                     port-name WAN2 ethernet 2/1/1
                    !
                    lag wan dynamic id 5
                     lacp-timeout long
                    !
                    !
                    !
                    
                    1 Reply Last reply Reply Quote 0
                    • stephenw10S
                      stephenw10 Netgate Administrator
                      last edited by

                      Hmm, well hard to see how that could be affecting anything.

                      No idea where you switch is getting those priority 3 and 4 valuss from then.

                      Did you test a lagg to two ports on the same switch?

                      Just test the ports without a lagg at all?

                      Steve

                      C 1 Reply Last reply Reply Quote 0
                      • C
                        cyberbot @stephenw10
                        last edited by

                        @stephenw10 said in LACP not working:

                        Hmm, well hard to see how that could be affecting anything.

                        No idea where you switch is getting those priority 3 and 4 valuss from then.

                        Did you test a lagg to two ports on the same switch?

                        Just test the ports without a lagg at all?

                        Steve

                        I havent test it yet with same switch,
                        do you mean create a LAGG with LACP on the same switch?
                        I have to drive 1hr to get to the switch :)

                        on both switches I have a LACP LAGG already working with Synology port 5 and 6 on switch 1 and port 5 and 6 on switch two.

                        1 Reply Last reply Reply Quote 0
                        • stephenw10S
                          stephenw10 Netgate Administrator
                          last edited by

                          Like both cross-chassis?

                          Maybe check the port settings in the running config then. Something is generating that mismatch. The incoming 'lag's peer info' looks normal, similar to what I see. There is almost nothing to set in pfSense anyway beyond the strict setting, which should work anyway since the switch is using active lacp.

                          My Brocade knowledge is exhausted it this point though. 😕

                          Steve

                          C 1 Reply Last reply Reply Quote 0
                          • C
                            cyberbot @stephenw10
                            last edited by cyberbot

                            @stephenw10 said in LACP not working:

                            Like both cross-chassis?

                            Maybe check the port settings in the running config then. Something is generating that mismatch. The incoming 'lag's peer info' looks normal, similar to what I see. There is almost nothing to set in pfSense anyway beyond the strict setting, which should work anyway since the switch is using active lacp.

                            My Brocade knowledge is exhausted it this point though. 😕

                            Steve

                            i appreaciate it Steve,

                            we have called for pfsense help monday they will check this wit hus.
                            ill report back the finding.

                            one thing i have noticed two LAGS are sharing the same MAC Address.
                            is this normal ?

                            === LAG "NAS" ID 11 (dynamic Deployed) ===
                            LAG Configuration:
                               Ports:         e 1/1/11 to 1/1/12 e 2/1/11 to 2/1/12
                               Port Count:    4
                               Primary Port:  1/1/11
                               Trunk Type:    hash-based
                               LACP Key:      20011
                            Deployment: HW Trunk ID 3
                            Port       Link    State   Dupl Speed Trunk Tag Pvid Pri MAC             Name
                            1/1/11     Up      Forward Full 1G    11    Yes 141  0   609c.9f4b.808c
                            1/1/12     Up      Forward Full 1G    11    Yes 141  0   609c.9f4b.808c
                            2/1/11     Up      Forward Full 1G    11    Yes 141  0   609c.9f4b.808c
                            2/1/12     Up      Forward Full 1G    11    Yes 141  0   609c.9f4b.808c
                            
                            === LAG "WAN" ID 1 (dynamic Deployed) ===
                            LAG Configuration:
                               Ports:         e 1/1/1 e 2/1/1
                               Port Count:    2
                               Primary Port:  1/1/1
                               Trunk Type:    hash-based
                               LACP Key:      20001
                               LACP Timeout:  long
                            Deployment: HW Trunk ID 1
                            Port       Link    State   Dupl Speed Trunk Tag Pvid Pri MAC             Name
                            1/1/1      Down    None    None None  1     No  141  0   609c.9f4b.808c  WAN1
                            2/1/1      Down    None    None None  1     No  141  0   609c.9f4b.808c  WAN2
                            
                            1 Reply Last reply Reply Quote 0
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              That's the switch side MAC address so it could be the same. I would not expect that to be an issue on a separate link / layer 2 segment.

                              Steve

                              C 1 Reply Last reply Reply Quote 0
                              • C
                                cyberbot @stephenw10
                                last edited by cyberbot

                                @stephenw10 said in LACP not working:

                                That's the switch side MAC address so it could be the same. I would not expect that to be an issue on a separate link / layer 2 segment.

                                Steve

                                tomorrow we are having pfsense support team to check this for us, ill report back with the finding.
                                today been doing some reading and found Port flap dampening configuration on the switch can cause such behaviour,
                                does it ring a bell?
                                after doing some research I come across this
                                https://forum.netgate.com/topic/137927/interface-stopped-destributing-possable-flapping/7

                                1 Reply Last reply Reply Quote 0
                                • stephenw10S
                                  stephenw10 Netgate Administrator
                                  last edited by

                                  Well if you have an internal loop in the switches like that guy had and no STP it would cartainly do it!

                                  Do you mean you have opened a support ticket with us? Do you have the ticket number? I can add notes there so whoever works it knows what to look for.

                                  Steve

                                  C 1 Reply Last reply Reply Quote 0
                                  • C
                                    cyberbot @stephenw10
                                    last edited by cyberbot

                                    @stephenw10 said in LACP not working:

                                    Well if you have an internal loop in the switches like that guy had and no STP it would cartainly do it!

                                    Do you mean you have opened a support ticket with us? Do you have the ticket number? I can add notes there so whoever works it knows what to look for.

                                    Steve

                                    do you mean I don't have spanning tree enabled on the switches or the other way around to disable spanning tree?

                                    I believe its already enabled on the LACP, I see also MAC- learning is enabled, we have two pfsense boxes connected to the switch one is on and one is off, both boxes run the same configuration in case first one goes down we fired up the second one, maybe the Mac-learning causing this?

                                    GigabitEthernet1/1/2 is up, line protocol is down (LACP-BLOCKED)
                                      Port down (LACP-BLOCKED) for 1 day(s) 14 hour(s) 28 minute(s) 40 second(s)
                                      Hardware is GigabitEthernet, address is 609c.9f4b.808d (bia 609c.9f4b.808d)
                                      Configured speed auto, actual 1Gbit, configured duplex fdx, actual fdx
                                      Configured mdi mode AUTO, actual MDIX
                                      EEE Feature Disabled
                                      Member of 7 L2 VLANs, port is tagged, port state is BLOCKING
                                      BPDU guard is Disabled, ROOT protect is Disabled, Designated protect is Disabled
                                      Link Error Dampening is Enabled
                                      STP configured to ON, priority is level0, mac-learning is enabled
                                      Openflow is Disabled, Openflow Hybrid mode is Disabled,  Flow Control is config enabled, oper enabled, negotiation disabled
                                      Mirror disabled, Monitor disabled
                                      Mac-notification is disabled
                                      Member of active trunk ports 1/1/2,2/1/2, primary port is 1/1/2
                                      Member of configured trunk ports 1/1/2,2/1/2, primary port is 1/1/2
                                      Port name is LAN1
                                      IPG MII 96 bits-time, IPG GMII 96 bits-time
                                      MTU 10200 bytes, encapsulation ethernet
                                      300 second input rate: 0 bits/sec, 0 packets/sec, 0.00% utilization
                                      300 second output rate: 928 bits/sec, 0 packets/sec, 0.00% utilization
                                      15187 packets input, 1943872 bytes, 0 no buffer
                                      Received 1 broadcasts, 15186 multicasts, 0 unicasts
                                      0 input errors, 0 CRC, 0 frame, 0 ignored
                                      0 runts, 0 giants
                                      154231 packets output, 19755504 bytes, 0 underruns
                                      Transmitted 214 broadcasts, 153930 multicasts, 86 unicasts
                                      0 output errors, 0 collisions
                                      Relay Agent Information option: Disabled
                                    
                                    1 Reply Last reply Reply Quote 0
                                    • stephenw10S
                                      stephenw10 Netgate Administrator
                                      last edited by

                                      I don't think you have an STP problem since I would expect to see that logged very clearly.

                                      If you are getting support from us it will be highly beneficial if I can add notes to any ticket you have open.

                                      Steve

                                      C 1 Reply Last reply Reply Quote 0
                                      • C
                                        cyberbot @stephenw10
                                        last edited by cyberbot

                                        @stephenw10 said in LACP not working:

                                        I don't think you have an STP problem since I would expect to see that logged very clearly.

                                        If you are getting support from us it will be highly beneficial if I can add notes to any ticket you have open.

                                        Steve

                                        Hi Steve than you, we are having a local support as we are from Europe.
                                        that company is having engineer available to investigate with us.
                                        are you guys active in Europe?

                                        I don't think its a spanning tree either I've disabled the MAC-learning on the lag but still shows this.

                                        Dec  1 01:58:16:I:System: dynamic lag interface 2/1/2's peer info (priority=5,id=d067.e5e6.fe1a,key=0) mis-matches with lag's peer info (priority=32768,id=d067.e5e6.fe1a,key=363), set to mismatch Error
                                        Dec  1 01:58:16:I:System: dynamic lag interface 1/1/2's peer info (priority=6,id=d067.e5e6.fe1a,key=0) mis-matches with lag's peer info (priority=32768,id=d067.e5e6.fe1a,key=363), set to mismatch Error
                                        Dec  1 01:58:16:I:System: Logical link on dynamic lag interface ethernet 2/1/2 is down.
                                        
                                        1 Reply Last reply Reply Quote 0
                                        • stephenw10S
                                          stephenw10 Netgate Administrator
                                          last edited by

                                          Ok. You can purchase support from us but not on-site.

                                          It's showing the peer as having a different ID/MAC address now. Did you swap the ports in use in pfSense? Different priorities there also, 5&6 vs 3&4 previously. Something has changed there.

                                          Also there is no-where in Europe it's 2am yet, what timezone is that switch set to?

                                          Steve

                                          C 1 Reply Last reply Reply Quote 0
                                          • C
                                            cyberbot @stephenw10
                                            last edited by cyberbot

                                            @stephenw10 said in LACP not working:

                                            Ok. You can purchase support from us but not on-site.

                                            It's showing the peer as having a different ID/MAC address now. Did you swap the ports in use in pfSense? Different priorities there also, 5&6 vs 3&4 previously. Something has changed there.

                                            Also there is no-where in Europe it's 2am yet, what timezone is that switch set to?

                                            Steve

                                            the switch is in Europe +1. do you think the time is the cause?
                                            we are based in Germany. do you think different on the time would cause this?

                                            I see it one day ahead than the normal time. 1 Dec
                                            there is nothing changed on the switch or cables are still the same as before.

                                            Wednesday they arranged a engineer who will come on site to check and assist. if he cannot help I can reach out for you guys, but time different is going to be difficult.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.