Posted inLinux

Configure Linux Network Bonding and LACP with NetworkManager and Netplan

Linux tutorial - IT technology blog
Linux tutorial - IT technology blog

Approach Comparison: Netplan vs. NetworkManager for Linux Network Bonding

Running critical production workloads on a single network interface card (NIC) is a huge operational risk. A loose patch cable, failed SFP+ transceiver, or bad switch port will take your entire host offline. Network bonding fixes this single point of failure. By aggregating multiple physical NICs into one logical interface, you get seamless failover and higher aggregate throughput.

Modern enterprise Linux distros handle networking through two primary tools: Netplan (default on Ubuntu 20.04/22.04/24.04 and Debian 12) and NetworkManager / nmcli (standard across RHEL 8/9, AlmaLinux, Rocky Linux, and Fedora).

Netplan vs. NetworkManager Architecture

  • Netplan (Declarative YAML): Netplan parses YAML files in /etc/netplan/ and generates back-end state files for either systemd-networkd or NetworkManager. It fits cleanly into automated deployment pipelines with cloud-init, Ansible, or Terraform where configurations live in Git.
  • NetworkManager (Dynamic Daemon & CLI): NetworkManager uses nmcli to configure connections dynamically at runtime. It stores connection profiles in /etc/NetworkManager/system-connections/ and applies changes on the fly without bouncing the network stack.

Bonding Modes: LACP (Mode 4) vs. Active-Backup (Mode 1)

Pick your bonding mode based on your upstream network switch capabilities:

  • Mode 4 (802.3ad Dynamic Link Aggregation / LACP): Groups multiple interfaces into a shared pipe. Outbound traffic is balanced across active links via transmit hash policies (such as Layer 3+4 IP and port hashing). This mode requires an upstream switch configured with an active LACP port-channel (LAG).
  • Mode 1 (Active-Backup): Keeps only one slave NIC active at a time. The standby slave takes over within milliseconds only if the active link drops carrier signal. No special switch configuration is required.

Pros and Cons of Configuration Methods & Modes

Netplan

Pros:

  • Clean declarative YAML makes peer reviews and GitOps auditing straightforward.
  • The netplan try command includes an automated 120-second rollback timer to prevent remote lockouts.
  • Pre-installed and tightly integrated across the Ubuntu ecosystem.

Cons:

  • Strict indentation rules mean a single tab or extra space breaks parsing.
  • Acts as a renderer wrapper rather than a standalone network service.

NetworkManager (nmcli)

Pros:

  • Tab-completion in nmcli speeds up manual configurations during emergency triage.
  • Applies profile changes instantly to active interfaces.
  • Consistent command syntax across enterprise RHEL, AlmaLinux, and Rocky Linux systems.

Cons:

  • Harder to template cleanly in automation compared to flat YAML manifests.
  • Stale connection profiles and UUID mismatches can accumulate after rapid test runs.

LACP (Mode 4) vs. Active-Backup (Mode 1) Trade-offs

Feature LACP (Mode 4 / 802.3ad) Active-Backup (Mode 1)
Switch Requirement Managed switch with an active 802.3ad Port-Channel / LAG Works on unmanaged switches or separate standalone switches
Usable Bandwidth Full aggregate link capacity (e.g., dual 10GbE delivers up to ~20 Gbps across concurrent streams) Capped at a single interface speed (e.g., 10 Gbps maximum)
Failover Speed Sub-second detection (<1000ms with fast 1s LACPDUs) Typically 100ms–300ms using link MII polling intervals

Recommended Setup

For bare-metal database nodes, hypervisors, and storage servers plugged into managed switches, configure Mode 4 (802.3ad) LACP with the layer3+4 transmit hash policy. By hashing source/destination IP addresses and TCP/UDP port numbers, Linux spreads traffic evenly across all physical links.

Before proceeding, verify you have:

  1. Two physical interfaces ready (e.g., dual 1GbE enp3s0 / enp3s1 or dual 10GbE SFP+ ens1f0 / ens1f1).
  2. Upstream switch ports assigned to an active LACP trunk group (e.g., channel-group 1 mode active on Cisco IOS).
  3. Out-of-band management access (IPMI, iDRAC, or serial console) as a safety net.

On a 2-node PostgreSQL replication cluster running Ubuntu 22.04 LTS on Dell PowerEdge servers with dual 10GbE Intel X520 NICs, this LACP configuration scaled multi-threaded database snapshot transfers from 114 MB/s (saturating a single link) to 218 MB/s across the bond.

Implementation Guide

Step 1: Check Physical Interfaces and Load Kernel Module

List available network interfaces on your system:

ip link show

Load the Linux bonding module and ensure it persists across reboots:

sudo modprobe bonding
echo "bonding" | sudo tee /etc/modules-load.d/bonding.conf

Step 2A: Configure LACP Bonding with Netplan (Ubuntu / Debian)

Locate your primary Netplan configuration file under /etc/netplan/ (usually 01-netcfg.yaml or 50-cloud-init.yaml). Always back it up first:

sudo cp /etc/netplan/01-netcfg.yaml /etc/netplan/01-netcfg.yaml.bak

Open the file and declare the bond master interface bond0 along with slave members enp3s0 and enp3s1:

network:
  version: 2
  renderer: networkd
  ethernets:
    enp3s0:
      dhcp4: no
    enp3s1:
      dhcp4: no
  bonds:
    bond0:
      interfaces:
        - enp3s0
        - enp3s1
      addresses:
        - 192.168.1.50/24
      routes:
        - to: default
          via: 192.168.1.1
      nameservers:
        addresses:
          - 1.1.1.1
          - 8.8.8.8
      parameters:
        mode: 802.3ad
        lacp-rate: fast
        mii-monitor-interval: 100
        transmit-hash-policy: layer3+4

Validate the syntax safely. If the change breaks your connection and you do not press Enter within 120 seconds, Netplan automatically restores the old configuration:

sudo netplan try

Once verified, commit the changes permanently:

sudo netplan apply

Step 2B: Configure LACP Bonding with NetworkManager (RHEL / AlmaLinux / Rocky)

Execute the following nmcli commands to build the bond master and attach slave interfaces:

# 1. Create the bond master profile
sudo nmcli connection add type bond con-name bond0 ifname bond0 \
  bond.options "mode=802.3ad,lacp_rate=fast,miimon=100,xmit_hash_policy=layer3+4" \
  ipv4.addresses 192.168.1.50/24 ipv4.gateway 192.168.1.1 \
  ipv4.dns "1.1.1.1 8.8.8.8" ipv4.method manual

# 2. Assign the physical slave interfaces to the bond master
sudo nmcli connection add type ethernet con-name bond0-slave1 ifname enp3s0 master bond0
sudo nmcli connection add type ethernet con-name bond0-slave2 ifname enp3s1 master bond0

# 3. Activate the slave links and the master bond
sudo nmcli connection up bond0-slave1
sudo nmcli connection up bond0-slave2
sudo nmcli connection up bond0

Step 3: Verify Bond Status and LACP Aggregation

Inspect the live status reported by the kernel bonding driver:

cat /proc/net/bonding/bond0

Look for active aggregator IDs and healthy link speeds across all ports:

Ethernet Channel Bonding Driver: v5.15.0-generic

Bonding Mode: IEEE 802.3ad Dynamic link aggregation
Transmit Hash Policy: layer3+4 (1)
MII Status: up
MII Polling Interval (ms): 100
Up Delay (ms): 0
Down Delay (ms): 0

802.3ad info
LACP rate: fast
Min links: 0
Aggregator ID: 1
Number of ports: 2

Slave Interface: enp3s0
MII Status: up
Speed: 1000 Mbps
Duplex: full
Link Failure Count: 0
Aggregator ID: 1

Slave Interface: enp3s1
MII Status: up
Speed: 1000 Mbps
Duplex: full
Link Failure Count: 0
Aggregator ID: 1

Step 4: Execute a Live Failover Drill

Start a high-frequency ICMP ping stream to your gateway from an external machine or a separate terminal:

ping -i 0.2 192.168.1.1

Simulate an interface failure by forcing one physical port down:

sudo ip link set enp3s0 down

Recheck /proc/net/bonding/bond0. You will see enp3s0 transition to MII Status: down. The ping test will continue running over enp3s1 with zero dropped packets. Re-enable the interface:

sudo ip link set enp3s0 up

LACP will renegotiate states and re-enroll enp3s0 into the active aggregator within 1 to 3 seconds.

Share:
Tags: