4.3 Link Aggregation (LACP)

The previous sections covered redundancy for ring topologies. LACP addresses a different issue: bandwidth, not recovery from outages. A single 1 Gbps uplink between a cell ring and the plant distribution switch becomes a bottleneck when multiple PLCs and HMIs generate traffic simultaneously. Link aggregation combines multiple physical links into 1 logical link without replacing any hardware.

Why Link Aggregation Exists

A single 1 Gbps uplink between a distribution switch and a core switch becomes a bottleneck when multiple cells generate traffic simultaneously. Upgrading to 10 Gbps requires new hardware on both ends. Link aggregation offers an alternative: combine multiple existing 1 Gbps links into a single logical 2 or 3 Gbps link without replacing any hardware.

Link aggregation also delivers redundancy. When 1 physical link becomes inoperable, traffic continues on the remaining links. The failover is immediate and transparent to the application.

LACP (Link Aggregation Control Protocol) (IEEE 802.3ad) is the standard protocol for negotiating link aggregation between 2 devices. LACP sends LACPDUs (LACP Data Units) to advertise capabilities and agree on which links to bundle. Understanding how traffic distributes across the links is essential for setting realistic expectations.

How Traffic Distribution Works

Traffic distributes across member links using a hash of frame attributes. The hash places frames from the same flow on the same physical link, preserving frame ordering.

A single flow uses 1 physical link at a time. Bandwidth multiplication occurs only when multiple flows distribute across links. When the hash produces the same result for traffic from multiple PLCs to the same SCADA server, the traffic goes to 1 link. This is the most common misconception about link aggregation: link aggregation does not multiply bandwidth for a single flow. Link aggregation multiplies bandwidth across multiple flows. The LACP mode controls how the aggregation is negotiated and maintained.

LACP Modes

Mode	Behavior
Active	Initiates LACP negotiation. Sends LACPDUs.
Passive	Responds to LACP negotiation. Does not initiate.
On (static)	Forces aggregation without LACP. No automatic detection of inoperable links.

Use Active mode on both sides, or Active on 1 side and Passive on the other. Do not use static On mode. Static On mode has no automatic detection of inoperable links. When 1 link becomes silently inoperable, the switch continues sending traffic to the inoperable link.

Hirschmann HiOS:

Switching → L2-Redundancy → Link Aggregation
Add LAG interface → assign member ports → set LACP mode: Active

Requirements: assign the same speed, duplex, and VLAN configuration to member ports. Maximum 8 ports per LAG (varies by switch model).

Note

LAG is separate from MRP. MRP ring ports are individual physical links. Use LAG and MRP for different parts of the network.

A LAG with 1 inoperable member link still passes traffic on the remaining links — but at reduced bandwidth. Monitoring member port status catches this condition before congestion occurs.

Monitoring LAG Member Port Status

The following script checks the status of LAG member ports and alerts when a member is down:

# pip install netmiko
from netmiko import ConnectHandler
import re

def get_lag_status(host: str) -> list[dict]:
    conn = ConnectHandler(device_type="hirschmann_ssh", host=host,
                          username="admin", password="private")
    output = conn.send_command("show link-aggregation")
    conn.disconnect()
    members = []
    for line in output.splitlines():
        m = re.match(r"(lag\d+)\s+(\d+/\d+)\s+(up|down)\s+(\S+)", line, re.I)
        if m:
            members.append({"lag": m.group(1), "port": m.group(2),
                             "status": m.group(3), "speed": m.group(4)})
    return members

host = "192.168.1.100"
members = get_lag_status(host)
down = [m for m in members if m["status"] == "down"]
if down:
    print(f"LAG member ports DOWN on {host}:")
    for m in down:
        print(f"  {m['lag']} member {m['port']} is DOWN")
else:
    print(f"All LAG member ports UP on {host}")

An inoperable LAG member reduces available bandwidth without interrupting traffic. When the remaining members are near capacity, congestion occurs. Replace the inoperable cable or SFP before the remaining members become overloaded.

Key Takeaways

LAG multiplies bandwidth across flows

A single flow uses 1 physical link. Bandwidth multiplication requires multiple flows distributed across links by the hash algorithm.

Use Active LACP mode

Active mode detects inoperable links automatically. Static On mode does not detect inoperable links. A silently inoperable link in a static LAG continues to receive traffic that is never delivered.

What Comes Next

Part 1 covered the foundations: how frames are built, how switches forward frames, how VLANs segment frames, how IP routes packets, and how redundancy protocols recover from outages. Part 2 covers the services that run on top of this foundation — DHCP, DNS, NTP, NAT, firewalls, wireless, and cloud networking.

References

• IEEE 802.1AX-2020 — Link Aggregation (formerly IEEE 802.3ad)
• Hirschmann. (2023). User Manual — HiOS: Link Aggregation. Belden/Hirschmann.