4.3 Link Aggregation (LACP)

The previous sections covered redundancy for ring topologies. LACP addresses a different problem: not failure recovery, but bandwidth. A single 1 Gbps uplink between a cell ring and the plant distribution switch becomes a bottleneck when multiple PLCs and HMIs generate traffic simultaneously. Link aggregation combines multiple physical links into one logical link without replacing any hardware.

Why Link Aggregation Exists

A single 1 Gbps uplink between a distribution switch and a core switch becomes a bottleneck when multiple cells generate traffic simultaneously. Upgrading to 10 Gbps requires new hardware on both ends. Link aggregation provides an alternative: combine multiple existing 1 Gbps links into a single logical 2 or 3 Gbps link without replacing any hardware.

Link aggregation also provides redundancy. If one physical link fails, traffic continues on the remaining links. The failover is immediate and transparent to the application.

LACP (Link Aggregation Control Protocol) (IEEE 802.3ad) is the standard protocol for negotiating link aggregation between two devices. It sends LACPDUs (LACP Data Units) to advertise capabilities and agree on which links to bundle. Understanding how traffic is distributed across the links is essential for setting realistic expectations.

How Traffic Distribution Works

Traffic is distributed across member links using a hash of frame attributes. The hash ensures that all frames in the same flow use the same physical link, preserving frame ordering.

A single flow always uses one physical link. Bandwidth multiplication occurs only when multiple flows are distributed across links. If all PLCs communicate with the same SCADA server and the hash produces the same result for all of them, all traffic goes to one link. This is the most common misconception about link aggregation: it does not multiply bandwidth for a single flow. It multiplies bandwidth across multiple flows. The LACP mode controls how the aggregation is negotiated and maintained.

LACP Modes

Mode	Behavior
Active	Initiates LACP negotiation; sends LACPDUs
Passive	Responds to LACP negotiation; does not initiate
On (static)	Forces aggregation without LACP; no automatic failure detection

Use Active mode on both sides, or Active on one side and Passive on the other. Do not use static On mode. It provides no automatic failure detection. If one link fails silently, the switch continues sending traffic to it.

Hirschmann HiOS:

Switching → L2-Redundancy → Link Aggregation
Add LAG interface → assign member ports → set LACP mode: Active

Requirements: all member ports must have the same speed, duplex, and VLAN configuration. Maximum 8 ports per LAG (varies by switch model).

Note

LAG is not used on MRP ring ports. MRP ring ports are individual physical links. LAG and MRP are separate redundancy mechanisms for different parts of the network.

A LAG with one failed member link still passes traffic on the remaining links — but at reduced bandwidth. Monitoring member port status catches this before it causes congestion.

Monitoring LAG Member Port Status

The following script checks the status of all LAG member ports and alerts when a member is down:

# pip install netmiko
from netmiko import ConnectHandler
import re

def get_lag_status(host: str) -> list[dict]:
    conn = ConnectHandler(device_type="hirschmann_ssh", host=host,
                          username="admin", password="private")
    output = conn.send_command("show link-aggregation")
    conn.disconnect()
    members = []
    for line in output.splitlines():
        m = re.match(r"(lag\d+)\s+(\d+/\d+)\s+(up|down)\s+(\S+)", line, re.I)
        if m:
            members.append({"lag": m.group(1), "port": m.group(2),
                             "status": m.group(3), "speed": m.group(4)})
    return members

host = "192.168.1.100"
members = get_lag_status(host)
down = [m for m in members if m["status"] == "down"]
if down:
    print(f"LAG member ports DOWN on {host}:")
    for m in down:
        print(f"  {m['lag']} member {m['port']} is DOWN")
else:
    print(f"All LAG member ports UP on {host}")

A failed LAG member reduces available bandwidth without interrupting traffic. If the remaining members are near capacity, this can cause congestion. Replace the failed cable or SFP before the remaining members become overloaded.

Key Takeaways

LAG multiplies bandwidth across flows, not within a flow

A single flow always uses one physical link. Bandwidth multiplication requires multiple flows distributed across links by the hash algorithm.

Use Active LACP mode

Active mode detects link failures automatically. Static On mode does not. A silently failed link in a static LAG continues to receive traffic that is never delivered.

What Comes Next

Part 1 covered the foundations: how frames are built, how switches forward them, how VLANs segment them, how IP routes them, and how redundancy protocols recover from failures. Part 2 covers the services that run on top of this foundation — DHCP, DNS, NTP, NAT, firewalls, wireless, and cloud networking.

References

• IEEE 802.1AX-2020 — Link Aggregation (formerly IEEE 802.3ad)
• Hirschmann. (2023). User Manual — HiOS: Link Aggregation. Belden/Hirschmann.