Knowledge Base Active/Passive LACP between TL-SG3428 and Synology NAS (DS1815+) not working while Static LAG does
This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
Hello folks,
today I tried to setup Link Aggregation Control Protocol (LACP) between my TL-SG3428 switch (running FW 2.0.11) and an old synology ds1815+ nas (also running old DSM 6.2.3) via Omada software controller 5.12.7.
I therefore followed these two guides: https://community.tp-link.com/en/business/forum/topic/609710 (primarily) and https://www.tp-link.com/de/support/faq/3689/ (for general reference)
My settings are equivalent (i.e. equal apart from concrete ips, subnet and ports) to the first link above except the LAG ID being 2 as I have also another LAG definded as an uplink to another omada switch (which is perfectly working).
Configurations look like this:
The problem I am facing is that even both devices (switch + nas) are showing the lacp connection as being successfully established, nothing goes over this LAG.. No ping, no dhcp etc.
However if I completely remove the LAG again and setup both devices' configurations as "Static LAG" everything is working, I can access the nas etc.
I know this could be an error on either side but as the connection is showing as active on both devides it seems like a potential problem with the "profile" as e.g. disucced in a (non-omada) setting here: www . synology-forum . de/threads/link-aggregation-ds214-tplink-switch-tl-sg3210.46795/post-375396 [a german thread!]
Since the configuration per se is not particularly complicated and is instead relatively straight forward, I'm afraid I don't really know what to do to get the aggegation with "active lacp" working.
I would be very happy about any help!
What I should also add is that I am not a complete noob when it comes to networking. So I of course ensured that the firewall is off, ips are in the correct subnet etc. I am also not using any vlans or acls in this small network that would block anything. As said as soon as I setup the bond as "static lag" instead of "active lacp" or "passive lacp" on both the nas and switch with all other settings being equal, everything works like a charm.
Thank you very much for your quick replies and sorry for my late reply (I was also on the road for some days and wanted to rule some parts out etc. before replying)
As @KJK already posted, there isn't much to configure on the synology side apart from the screenshot I already attatched. In there I have tried to use "IEEE 802.3ad" which fails and "Balance XOR" (which is static LA) which does (or at least seemed to) work. I therefore left the static configuration for some days.. However, I noted that the virus scanner "ESET Antivirus", which is installed on one of my windows client machines, regularly posted warnings that the bond ip (192.168.221.35) sends malicious packages. Which now lets me suppose what @KJK already suggested: There might also/already be something wrong with the LAG configuration itself.
To rule some more stuff out I upgraded the synology nas to a more recent firmware version (DSM 7.1.1-42962 Update 6) which - as suspected - did not fix the situation. :'(
I therefore tried what you two reccommended with the following results:
Port Mirroring & Wireshark
As I have done port mirroring for debugging quite often already I had thought about doing this but as I expected that the LACP packages might not be transferred over the mirror I did not try it in advance - sorry for that.
However as I set it up and hooked everything up I could see nothing on the line (except from the packages coming from the client itself on which wireshark is running). This is also somewhat strange as the LED lights corresponding to the bond are flashing very frequently while the mirroring port is only flashing very rarely..
=> So as I said: I was not able to see anything here... :/
Checking Status and Configuration via SSH
Before diving into the output, I'll first give you some background info about the ports/ips:
- TL-SG3428:
- IP: 192.168.221.162
- Port 1-4:
- Passive LACP
- Connected to other switch in my network (which has active LACP on its side - everything is wokring like a charm here)
- Port 8:
- Without any special configuration
- Connected to synology nas management port eth3 (see below)
- Port 9-11:
- Active LACP
- Connected to synology nas bond0 (see below)
- Synology NAS:
- Port eth0-eth2 = bond0:
- IP: 192.168.221.35
- LACP enabled (as said above; without knowing any further details :/ )
- Port eth3:
- IP: 192.168.221.21
- Management port (to access web management interface, ssh, ...)
- Port eth0-eth2 = bond0:
As @KJK suggested I was looking at both sides' configurations and status using cli. I therefore checked the TL-SG3428 CLI Manual for anything that had to do with LAG/LACP (which was not much to admit) but at least provided some more details:
TL-SG3428#show lacp internal Flags: S - Device is requesting Slow LACPDUs F - Device is requesting Fast LACPDUs A - Device is in active mode P - Device is in passive mode Channel group 1 LACP port Admin Oper Port Port Port Flags State Priority Key Key Number State Gi1/0/1 SP Up 32768 0x1 0xf93 0x1 0x3c Gi1/0/2 SP Up 32768 0x1 0xf93 0x2 0x3c Gi1/0/3 SP Up 32768 0x1 0xf93 0x3 0x3c Gi1/0/4 SP Up 32768 0x1 0xf93 0x4 0x3c Channel group 2 LACP port Admin Oper Port Port Port Flags State Priority Key Key Number State Gi1/0/9 SA Up 32768 0x2 0x1d3 0x9 0x5 Gi1/0/10 SA Up 32768 0x2 0x1d3 0xa 0x5 Gi1/0/11 SA Up 32768 0x2 0x1d3 0xb 0x5
And on the nas I checked the synology cli manual as well as some other linux commands:
root@DS1815plus:~# synonet --show
System network interface list:
Host Name: DS1815plus
Network interface: bond0
Manual IP
IP: 192.168.221.35
Mask: 255.255.255.0
Gateway: 192.168.221.250
DNS: 192.168.221.250
MTU Setting: 1500
-1, unknown duplex, active mtu 1500
RX bytes: 718241
TX bytes: 27458
Host Name: DS1815plus
Network interface: eth3
Manual IP
IP: 192.168.221.21
Mask: 255.255.255.0
Gateway: 192.168.221.250
DNS: 192.168.221.250
MTU Setting: 1500
1000, full duplex, active mtu 1500
RX bytes: 414357843244
TX bytes: 1354786323123
root@DS1815plus:~# synonet --check 192.168.221.35
OK! Valid network interface parameters.
root@DS1815plus:~# synonet --la_get bond0
[bond0]
Mode: 802.3ad
Error Setted: false
Slaves: eth0 eth1 eth2
root@DS1815plus:~# synonet --la_exist
bonding is exist
root@DS1815plus:~# ifconfig
bond0 Link encap:Ethernet HWaddr XX:XX:XX:XX:XX:XX
inet addr:192.168.221.35 Bcast:192.168.221.255 Mask:255.255.255.0
UP BROADCAST RUNNING MASTER MULTICAST MTU:1500 Metric:1
RX packets:7391 errors:0 dropped:0 overruns:0 frame:0
TX packets:304 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:941069 (919.0 KiB) TX bytes:34898 (34.0 KiB)
[...]
eth0 Link encap:Ethernet HWaddr XX:XX:XX:XX:XX:XX
UP BROADCAST RUNNING SLAVE MULTICAST MTU:1500 Metric:1
RX packets:2401 errors:0 dropped:0 overruns:0 frame:0
TX packets:106 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:299434 (292.4 KiB) TX bytes:11870 (11.5 KiB)
eth1 Link encap:Ethernet HWaddr XX:XX:XX:XX:XX:XX
UP BROADCAST RUNNING SLAVE MULTICAST MTU:1500 Metric:1
RX packets:2605 errors:0 dropped:0 overruns:0 frame:0
TX packets:116 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:343659 (335.6 KiB) TX bytes:12860 (12.5 KiB)
eth2 Link encap:Ethernet HWaddr XX:XX:XX:XX:XX:XX
UP BROADCAST RUNNING SLAVE MULTICAST MTU:1500 Metric:1
RX packets:2385 errors:0 dropped:0 overruns:0 frame:0
TX packets:82 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:297976 (290.9 KiB) TX bytes:10168 (9.9 KiB)
eth3 Link encap:Ethernet HWaddr XX:XX:XX:XX:XX:XX
inet addr:192.168.221.21 Bcast:192.168.221.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:678574299 errors:1 dropped:374 overruns:374 frame:1
TX packets:918066788 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:415215767429 (386.6 GiB) TX bytes:1355069732058 (1.2 TiB)
So the only thing I noted was that the "port state" and "oper mode" was different - but which seems to have something to do with the link speed and ative/passive only. And also that the nas is not sure about the connection speed of the bond (also manually setting it to 1000 Full Duplex did not change the cli output).
Having said that it is obviously still not working even though both devices show the link as active+working:
I would be happy about any further hints!
Thank you very much guys!
Hi @ThomFri
Thanks for posting in our business forum.
Use etherchannel and view the identifier value. Then hexadecimal to binary. If you see 111, that means a linkup. If no, 000 means it is not linking up. That's a failure in the negotiation.
How did you mirror it? You should see the LACP sending from the switch ports. Our switch is based on layer 2 and layer 3, using LACP as the filter you should see the LACPDU from the switch every 30 seconds if it is active LACP.
And for a bad link between the LAG, that might be a problem with the hash algorithm. What's the hash algorithm?
Let's make sure the LACP is sending the sync packet first.
Thanks again for your contributions and suggestions! What I have tried and found out:
Link Speeds
- As soon as I deleted the lacp config (on both sides) all links immediatley show speed 1000/Full Duplux as they should.
- (To rule some more failures out I also replaced the ethernet cables at this point)
- Set speed 1000/Full Duplux on all respective ports manually
- Recreated the the LAG with "Passive LACP" (see below) and also set the speed for the LAG to manual -> 1000/Full Duplex
=> No changes; same cli outputs; issue remains
Etherchannel CLI
- When first running show etherchannel detail I noticed that the synology nas (obviously) is the active partner here, as the Flags column was showing SA, which is why I re-setup the LAG as "Passive LACP" on the switch [after in fact googling that, I also found posts in cisco forums where the issue was solely resolved by setting lacp in passive mode - which was however not the solution in my case and as I also said above, the post by @NinjaMonkey (https://community.tp-link.com/en/business/forum/topic/609710) also uses active lacp and everything seems to work in that case as well]
- After changing to passive lcap the outputs look like this (the nas-switch-lag is in yellow):
TL-SG3428#show etherchannel detail Group: 1 ---------- Group state = L2 Ports: 4 MaxPorts = 16 Protocol: LACP Ports in the group: ------------------- Flags: S - Device is sending Slow LACPDUs F - Device is sending fast LACPDUs. A - Device is in active mode. P - Device is in passive mode. Local information: LACP port Admin Oper Port Port Port Flags State Priority Key Key Number State Gi1/0/1 SP Up 32768 0x1 0xf93 0x1 0x3c Gi1/0/2 SP Up 32768 0x1 0xf93 0x2 0x3c Gi1/0/3 SP Up 32768 0x1 0xf93 0x3 0x3c Gi1/0/4 SP Up 32768 0x1 0xf93 0x4 0x3c Partner's information: LACP port Oper Port Port Port Flags Priority Dev ID Key Number State Gi1/0/1 SA 32768 2887.baf3.b4c9 0xc40 0x15 0x3d Gi1/0/2 SA 32768 2887.baf3.b4c9 0xc40 0x16 0x3d Gi1/0/3 SA 32768 2887.baf3.b4c9 0xc40 0x17 0x3d Gi1/0/4 SA 32768 2887.baf3.b4c9 0xc40 0x18 0x3d Group: 2 ---------- Group state = L2 Ports: 3 MaxPorts = 16 Protocol: LACP Ports in the group: ------------------- Flags: S - Device is sending Slow LACPDUs F - Device is sending fast LACPDUs. A - Device is in active mode. P - Device is in passive mode. Local information: LACP port Admin Oper Port Port Port Flags State Priority Key Key Number State Gi1/0/9 SP Up 32768 0x2 0x615 0x9 0x4 Gi1/0/10 SP Up 32768 0x2 0x615 0xa 0x4 Gi1/0/11 SP Up 32768 0x2 0x615 0xb 0x4 Partner's information: LACP port Oper Port Port Port Flags Priority Dev ID Key Number State Gi1/0/9 FA 255 0011.3240.d557 0x11 0x1 0xf Gi1/0/10 FA 255 0011.3240.d557 0x11 0x2 0xf Gi1/0/11 FA 255 0011.3240.d557 0x11 0x3 0xf TL-SG3428#show etherchannel summary Flags: D - down P - bundled in port-channel U - in use I - stand-alone H - hot-standby(LACP only) s - suspended R - layer3 S - layer2 f - failed to allocate aggregator u - unsuitable for bundling w - waiting to be aggregated d - default port Group Port-channel Protocol Ports ------+-------------+---------+------------------------------------------------- 1 Po1(S) LACP Gi1/0/1(P) Gi1/0/2(P) Gi1/0/3(P) Gi1/0/4(P) 2 Po2(S) LACP Gi1/0/9(s) Gi1/0/10(s) Gi1/0/11(s) - This is (at least if I hopefully got that right) what @KJK meant: The link stays at Port State 0x5 (or 0x4 now with passive) and the links are flagged as "suspended".
- I therefore hit up google and looked for stuff like "lacp suspended synology" etc. which also did not really lead to primising results.. most of them are cisco forum posts where either only one link was in "suspended" mode or where setting lacp to passive did the trick.
=> Also no success here
Wireshark & Searching the LACP Packages
- My mirroring config looks like this:
- As I had lots of noice without a filter last time and using a filter based in source/destination mac/ip lead to an empty list, I googled and found this manual here: https://wiki.wireshark.org/LinkAggregationControlProtocol.md - which I then followed
- I also tried unplugging and connecting all/some links but, however with the same result: An empty wireshark capture..
Hashing Algorithm...
... is set to default, i.e. "SRC MAC + DST MAC"
Thanks a lot again guys and I hope I didn't miss anything! I will also try a different switch that I have as a backup in my environment later today/tomorrow to rule out any misconfig, bug etc. on that part as well