Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    LACP not working

    Scheduled Pinned Locked Moved General pfSense Questions
    113 Posts 2 Posters 25.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S
      stephenw10 Netgate Administrator
      last edited by

      Well if you have an internal loop in the switches like that guy had and no STP it would cartainly do it!

      Do you mean you have opened a support ticket with us? Do you have the ticket number? I can add notes there so whoever works it knows what to look for.

      Steve

      C 1 Reply Last reply Reply Quote 0
      • C
        cyberbot @stephenw10
        last edited by cyberbot

        @stephenw10 said in LACP not working:

        Well if you have an internal loop in the switches like that guy had and no STP it would cartainly do it!

        Do you mean you have opened a support ticket with us? Do you have the ticket number? I can add notes there so whoever works it knows what to look for.

        Steve

        do you mean I don't have spanning tree enabled on the switches or the other way around to disable spanning tree?

        I believe its already enabled on the LACP, I see also MAC- learning is enabled, we have two pfsense boxes connected to the switch one is on and one is off, both boxes run the same configuration in case first one goes down we fired up the second one, maybe the Mac-learning causing this?

        GigabitEthernet1/1/2 is up, line protocol is down (LACP-BLOCKED)
          Port down (LACP-BLOCKED) for 1 day(s) 14 hour(s) 28 minute(s) 40 second(s)
          Hardware is GigabitEthernet, address is 609c.9f4b.808d (bia 609c.9f4b.808d)
          Configured speed auto, actual 1Gbit, configured duplex fdx, actual fdx
          Configured mdi mode AUTO, actual MDIX
          EEE Feature Disabled
          Member of 7 L2 VLANs, port is tagged, port state is BLOCKING
          BPDU guard is Disabled, ROOT protect is Disabled, Designated protect is Disabled
          Link Error Dampening is Enabled
          STP configured to ON, priority is level0, mac-learning is enabled
          Openflow is Disabled, Openflow Hybrid mode is Disabled,  Flow Control is config enabled, oper enabled, negotiation disabled
          Mirror disabled, Monitor disabled
          Mac-notification is disabled
          Member of active trunk ports 1/1/2,2/1/2, primary port is 1/1/2
          Member of configured trunk ports 1/1/2,2/1/2, primary port is 1/1/2
          Port name is LAN1
          IPG MII 96 bits-time, IPG GMII 96 bits-time
          MTU 10200 bytes, encapsulation ethernet
          300 second input rate: 0 bits/sec, 0 packets/sec, 0.00% utilization
          300 second output rate: 928 bits/sec, 0 packets/sec, 0.00% utilization
          15187 packets input, 1943872 bytes, 0 no buffer
          Received 1 broadcasts, 15186 multicasts, 0 unicasts
          0 input errors, 0 CRC, 0 frame, 0 ignored
          0 runts, 0 giants
          154231 packets output, 19755504 bytes, 0 underruns
          Transmitted 214 broadcasts, 153930 multicasts, 86 unicasts
          0 output errors, 0 collisions
          Relay Agent Information option: Disabled
        
        1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by

          I don't think you have an STP problem since I would expect to see that logged very clearly.

          If you are getting support from us it will be highly beneficial if I can add notes to any ticket you have open.

          Steve

          C 1 Reply Last reply Reply Quote 0
          • C
            cyberbot @stephenw10
            last edited by cyberbot

            @stephenw10 said in LACP not working:

            I don't think you have an STP problem since I would expect to see that logged very clearly.

            If you are getting support from us it will be highly beneficial if I can add notes to any ticket you have open.

            Steve

            Hi Steve than you, we are having a local support as we are from Europe.
            that company is having engineer available to investigate with us.
            are you guys active in Europe?

            I don't think its a spanning tree either I've disabled the MAC-learning on the lag but still shows this.

            Dec  1 01:58:16:I:System: dynamic lag interface 2/1/2's peer info (priority=5,id=d067.e5e6.fe1a,key=0) mis-matches with lag's peer info (priority=32768,id=d067.e5e6.fe1a,key=363), set to mismatch Error
            Dec  1 01:58:16:I:System: dynamic lag interface 1/1/2's peer info (priority=6,id=d067.e5e6.fe1a,key=0) mis-matches with lag's peer info (priority=32768,id=d067.e5e6.fe1a,key=363), set to mismatch Error
            Dec  1 01:58:16:I:System: Logical link on dynamic lag interface ethernet 2/1/2 is down.
            
            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              Ok. You can purchase support from us but not on-site.

              It's showing the peer as having a different ID/MAC address now. Did you swap the ports in use in pfSense? Different priorities there also, 5&6 vs 3&4 previously. Something has changed there.

              Also there is no-where in Europe it's 2am yet, what timezone is that switch set to?

              Steve

              C 1 Reply Last reply Reply Quote 0
              • C
                cyberbot @stephenw10
                last edited by cyberbot

                @stephenw10 said in LACP not working:

                Ok. You can purchase support from us but not on-site.

                It's showing the peer as having a different ID/MAC address now. Did you swap the ports in use in pfSense? Different priorities there also, 5&6 vs 3&4 previously. Something has changed there.

                Also there is no-where in Europe it's 2am yet, what timezone is that switch set to?

                Steve

                the switch is in Europe +1. do you think the time is the cause?
                we are based in Germany. do you think different on the time would cause this?

                I see it one day ahead than the normal time. 1 Dec
                there is nothing changed on the switch or cables are still the same as before.

                Wednesday they arranged a engineer who will come on site to check and assist. if he cannot help I can reach out for you guys, but time different is going to be difficult.

                1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by

                  I doubt the clock offset would cause a problem for lagg. It does show the switch is either not configured for ntp though or unable to reach it. Or just set the wrong timezone, and not UTC.

                  Previously the switch logs were showing this:

                  lag's peer info (priority=32768,id=e839.3511.faab,key=715)

                  That's the expected ID, it matches the MAC address of lagg0 in pfSense.
                  So what is this new ID? Is that a MAC you recognise?

                  It throws doubt on what is physically connected to what.

                  Steve

                  C 1 Reply Last reply Reply Quote 0
                  • C
                    cyberbot @stephenw10
                    last edited by cyberbot

                    @stephenw10 said in LACP not working:

                    I doubt the clock offset would cause a problem for lagg. It does show the switch is either not configured for ntp though or unable to reach it. Or just set the wrong timezone, and not UTC.

                    Previously the switch logs were showing this:

                    lag's peer info (priority=32768,id=e839.3511.faab,key=715)

                    That's the expected ID, it matches the MAC address of lagg0 in pfSense.
                    So what is this new ID? Is that a MAC you recognise?

                    It throws doubt on what is physically connected to what.

                    Steve

                    this possibly because I connected last time two different cables. to test.
                    have port em2 em 3 connected to port 8 on each switch and ebc1 and etc 2 on port 2 on each switch.
                    maybe that why? the currenty lag is running on the port 2 on each switch. I can disable that lacp and try port 8 lacp.
                    I have tried on a different port group 8 on each switch and this error shows up.
                    so appear I have to configure priority on the lag, but don't know where and how. never seen it before.

                    Nov 30 23:43:40:I:System: dynamic lag interface 1/1/8's peer info (priority=3,id=e839.3511.faab,key=0) mis-matches with lag's peer info (priority=32768,id=e839.3511.faab,key=363), set to mismatch Error
                    
                    1 Reply Last reply Reply Quote 0
                    • stephenw10S
                      stephenw10 Netgate Administrator
                      last edited by

                      Seems more like you have to omit the priority in the switch/port to have it match what looks like the default value pfSense is sending. But it's not something I've had to do before.

                      Steve

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        In fact there is no way to set a priority in pfSense:

                        https://www.freebsd.org/cgi/man.cgi?lagg(4)#BUGS

                             There is no way to	configure LACP administrative variables, including
                             system and	port priorities.  The current implementation always performs
                             active-mode LACP and uses 0x8000 as system	and port priorities.
                        

                        So that must be in the switch config somewhere. It looks like it's set to 0 in the output you have posted but there must be somewhere else it's pulling in that value.

                        Steve

                        C 1 Reply Last reply Reply Quote 0
                        • C
                          cyberbot @stephenw10
                          last edited by

                          @stephenw10 said in LACP not working:

                          In fact there is no way to set a priority in pfSense:

                          https://www.freebsd.org/cgi/man.cgi?lagg(4)#BUGS

                               There is no way to	configure LACP administrative variables, including
                               system and	port priorities.  The current implementation always performs
                               active-mode LACP and uses 0x8000 as system	and port priorities.
                          

                          So that must be in the switch config somewhere. It looks like it's set to 0 in the output you have posted but there must be somewhere else it's pulling in that value.

                          Steve

                          Hi Steve,
                          today we had a call with pfsense engineer, however the issue appear the switch still.

                          the pfsense is sending LACP and binding the ports nicely.
                          but the switch is still blocking the ports and we cannot see any log neither on the switch or the firewall.
                          the issue still remains unresolved unfortunately.

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            Yes, it looks like a switch issue to me too.

                            Have you been able to test a lagg to a single switch?

                            Check the full switch config from both switches. It must be pulling in the port priority from somewhere.

                            Steve

                            C 1 Reply Last reply Reply Quote 0
                            • C
                              cyberbot @stephenw10
                              last edited by

                              @stephenw10 said in LACP not working:

                              Yes, it looks like a switch issue to me too.

                              Have you been able to test a lagg to a single switch?

                              Check the full switch config from both switches. It must be pulling in the port priority from somewhere.

                              Steve

                              Hi Steve,
                              the priority we were able to fix it, with specifying the priority and the error of the flapping were gone, but the switch was still blocking the interfaces LAG

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                No longer logging the mismatch in the switch?

                                C 1 Reply Last reply Reply Quote 0
                                • C
                                  cyberbot @stephenw10
                                  last edited by

                                  @stephenw10 said in LACP not working:

                                  No longer logging the mismatch in the switch?

                                  no, not on the switch and no flapping on the firewall,
                                  but when we do show lag it still shows blocked LAG.

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    Can we see the current output from both sides?

                                    C 1 Reply Last reply Reply Quote 0
                                    • C
                                      cyberbot @stephenw10
                                      last edited by

                                      @stephenw10

                                      yes of course only there is no log now, nothing happening at all.

                                      1 Reply Last reply Reply Quote 0
                                      • C
                                        cyberbot
                                        last edited by

                                        when I do show log on the switch nothing really happens about the LACP or errors neither on the pfsense

                                        1 Reply Last reply Reply Quote 0
                                        • stephenw10S
                                          stephenw10 Netgate Administrator
                                          last edited by stephenw10

                                          Ok but can we see ifconfig -vvv lagg0 from pfSense and show lag from the switch. The complete output from each.

                                          Steve

                                          C 1 Reply Last reply Reply Quote 0
                                          • C
                                            cyberbot @stephenw10
                                            last edited by cyberbot

                                            @stephenw10 said in LACP not working:

                                            Ok but can we see ifconfig -vvv lagg0 from pfSense and show lag from the switch. The complete output from each.

                                            Steve

                                            Hi Steve,
                                            see below, the engineer still confirm the switch is the cause.

                                            lagg0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
                                                    options=800008<VLAN_MTU>
                                                    ether e8:39:35:11:fa:ab
                                                    inet6 fe80::ea39:35ff:fe11:faab%lagg0 prefixlen 64 scopeid 0xb
                                                    inet 192.168.73.1 netmask 0xffffff00 broadcast 192.168.73.255
                                                    laggproto lacp lagghash l2,l3,l4
                                                    lagg options:
                                                            flags=90<LACP_STRICT>
                                                            flowid_shift: 16
                                                    lagg statistics:
                                                            active ports: 2
                                                            flapping: 64
                                                    lag id: [(8000,E8-39-35-11-FA-AB,016B,0000,0000),
                                                             (0001,60-9C-9F-4B-80-8C,4E21,0000,0000)]
                                                    laggport: em2 flags=1c<ACTIVE,COLLECTING,DISTRIBUTING> state=3f<ACTIVITY,TIMEOUT,AGGREGATION,SYNC,COLLECTING,DISTRIBUTING>
                                                            [(8000,E8-39-35-11-FA-AB,016B,8000,0003),
                                                             (0001,60-9C-9F-4B-80-8C,4E21,0001,0002)]
                                                    laggport: em3 flags=1c<ACTIVE,COLLECTING,DISTRIBUTING> state=3f<ACTIVITY,TIMEOUT,AGGREGATION,SYNC,COLLECTING,DISTRIBUTING>
                                                            [(8000,E8-39-35-11-FA-AB,016B,8000,0004),
                                                             (0001,60-9C-9F-4B-80-8C,4E21,0001,0102)]
                                                    groups: lagg
                                                    media: Ethernet autoselect
                                                    status: active
                                                    nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                                            
                                            === LAG "LAN" ID 1 (dynamic Deployed) ===
                                            LAG Configuration:
                                               Ports:         e 1/1/2 e 2/1/2
                                               Port Count:    2
                                               Primary Port:  1/1/2
                                               Trunk Type:    hash-based
                                               LACP Key:      20001
                                            Deployment: HW Trunk ID 1
                                            Port       Link    State   Dupl Speed Trunk Tag Pvid Pri MAC             Name
                                            1/1/2      Up      Blocked Full 1G    1     Yes N/A  0   609c.9f4b.105d  LAN1
                                            2/1/2      Up      Blocked Full 1G    1     Yes N/A  0   609c.9f4b.105d LAN2
                                            
                                            Port       [Sys P] [Port P] [ Key ] [Act][Tio][Agg][Syn][Col][Dis][Def][Exp][Ope]
                                            1/1/2           1        1   20001   Yes   S   Agg  Syn  Col  Dis  Def  No   Err
                                            2/1/2           1        1   20001   Yes   S   Agg  Syn  Col  Dis  Def  No   Err
                                            
                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.