Skip to content

802.1Q VLAN Trunks & 802.3ad LACP Bonding: High Availability & Network Segmentation

Created: 2026-11-08  ·  Last updated: 2026-11-08  ·  Nejat Hakan

Executive Summary: In production hypervisors, database clusters, and storage nodes, relying on a single network interface or switch port introduces an unacceptable single point of failure (SPOF). Production Linux architecture combines two foundational Layer-2 technologies: IEEE 802.3ad Dynamic Link Aggregation (LACP) to bond multiple physical NICs into a redundant, load-balanced trunk, and IEEE 802.1Q VLAN tagging to multiplex multiple isolated security zones (Management, DMZ, Storage) across that single bonded pipeline.

  • IEEE 802.3ad LACP

    Bond multiple physical NICs into an active-active team with automated millisecond failover and switch-side partner negotiation.

  • Transmit Hash Policies

    Optimize bandwidth distribution across member links: configure layer3+4 hashing to balance parallel TCP/UDP sessions effectively.

  • 802.1Q VLAN Tagging

    Inject 4-byte 802.1Q headers to partition a single physical trunk into up to 4094 isolated Layer-2 broadcast domains.

  • systemd-networkd Config

    Deploy clean, declarative NetDev and Network configuration templates for bonded interfaces and tagged VLAN sub-interfaces.

Linux supports several bonding modes, but enterprise data centers standardize almost exclusively on Mode 4: IEEE 802.3ad (Dynamic Link Aggregation Control Protocol - LACP):

%%{init: {'flowchart': {'wrappingWidth': 600, 'subGraphTitleMargin': {'top': 15, 'bottom': 15}}}}%%
flowchart TB
    subgraph PhysicalLayer["Physical Layer (Hardware Redundancy)"]
        NIC1["eno1 (10GbE SFP+ Link 1)"]
        NIC2["eno2 (10GbE SFP+ Link 2)"]
        BOND["bond0: 802.3ad LACP Master Interface<br/>Combined Throughput: 20 Gbps"]
        NIC1 --> BOND
        NIC2 --> BOND
    end

    subgraph SwitchSide["Data Center Switch Fabric"]
        SW["ToR Enterprise Switch (LACP Port-Channel)"]
        NIC1 <-->|"LACPDU Control Frames"| SW
        NIC2 <-->|"LACPDU Control Frames"| SW
    end

Why Mode 4 (802.3ad) Outperforms Mode 0 and Mode 1

  • Mode 1 (active-backup): Simple failover, but 50% of your expensive 10GbE/25GbE bandwidth sits permanently idle.
  • Mode 0 (balance-rr): Round-robin packet spraying. Causes severe out-of-order packet delivery, triggering TCP retransmissions and performance collapse.
  • Mode 4 (802.3ad LACP): Both links carry active traffic simultaneously (Active-Active). Member interfaces periodically exchange Link Aggregation Control Protocol Data Units (LACPDUs) with the switch. If a cable is cut or a switch port fails, the kernel removes the dead member link within 100 milliseconds without dropping established TCP sessions.

2. Transmit Hash Policies (xmit_hash_policy)

A common misconception is that bonding two 10GbE NICs creates a single 20Gbps TCP connection. It does not. Standard Ethernet switches enforce that all packets belonging to a single TCP stream follow the same physical wire to prevent out-of-order packet delivery.

The kernel chooses the egress slave interface using a mathematical hash function configured via xmit_hash_policy:

Policy Mathematical Hash Inputs Real-World Performance & Evaluation
layer2 (Default) Source MAC ⊕ Destination MAC Inefficient for Routers: All traffic routed to the same upstream default gateway shares the exact same destination MAC, starving one link while overloading the other.
layer2+3 (Source MAC ⊕ Dst MAC) ⊕ (Src IP ⊕ Dst IP) Good Balance: Spreads traffic across different target IP addresses.
layer3+4 (Src IP ⊕ Dst IP) ⊕ (Src Port ⊕ Dst Port) Optimal Enterprise Standard: Uses TCP/UDP port numbers. Even traffic to the same destination server is distributed evenly across both physical links across parallel connections.

3. Multiplexing Security Zones: 802.1Q Tagged VLANs

Once bond0 aggregates our physical hardware, we divide it logically using IEEE 802.1Q VLAN Tagging. The kernel inserts a 4-byte tag (including a 12-bit VLAN ID from 1 to 4094) directly into the Ethernet frame header:

Standard Ethernet Frame:   [ Dest MAC | Src MAC | EtherType | Payload | FCS ]
802.1Q Tagged Frame:       [ Dest MAC | Src MAC | 0x8100 | VLAN ID | EtherType | Payload | FCS ]

%%{init: {'flowchart': {'wrappingWidth': 600}}}%%
flowchart TB
    BOND["bond0 (High-Availability Trunk)"]
    V10["bond0.10 (VLAN 10)<br/>Management: 10.10.10.50/24<br/>(SSH, Metrics, Backups)"]
    V20["bond0.20 (VLAN 20)<br/>DMZ: 10.10.20.1/24<br/>(Bridged to VMs & Containers)"]
    V30["bond0.30 (VLAN 30)<br/>Storage: 10.10.30.50/24<br/>(Jumbo Frames MTU 9000, NVMe/NFS)"]

    BOND --> V10
    BOND --> V20
    BOND --> V30

4. Production Declarative Setup with systemd-networkd

In Debian Linux, configure LACP bonding and VLAN sub-interfaces declaratively in /etc/systemd/network/:

Step 1: Define the LACP Bond Virtual Device (10-bond0.netdev)

# File: /etc/systemd/network/10-bond0.netdev
[NetDev]
Name=bond0
Kind=bond

[Bond]
Mode=802.3ad
TransmitHashPolicy=layer3+4
MIIMonitorSec=100ms
LACPTransmitRate=fast
UpDelaySec=200ms
DownDelaySec=200ms

Step 2: Define VLAN Virtual Devices

# File: /etc/systemd/network/20-vlan10.netdev
[NetDev]
Name=bond0.10
Kind=vlan

[VLAN]
Id=10

# File: /etc/systemd/network/20-vlan30.netdev
[NetDev]
Name=bond0.30
Kind=vlan

[VLAN]
Id=30

Step 3: Enslave Physical Interfaces to bond0

# File: /etc/systemd/network/30-eno1.network
[Match]
Name=eno1

[Network]
Bond=bond0

# File: /etc/systemd/network/30-eno2.network
[Match]
Name=eno2

[Network]
Bond=bond0

Step 4: Configure the bond0 Trunk Interface

# File: /etc/systemd/network/40-bond0.network
[Match]
Name=bond0

[Network]
# Attach tagged VLAN interfaces to the trunk
VLAN=bond0.10
VLAN=bond0.30
BindCarrier=eno1 eno2
LinkLocalAddressing=no

Step 5: Assign IPs and Jumbo Frames to VLAN Interfaces

# File: /etc/systemd/network/50-bond0.10-mgmt.network
[Match]
Name=bond0.10

[Network]
Address=10.10.10.50/24
Gateway=10.10.10.1
DNS=10.10.10.1

# File: /etc/systemd/network/50-bond0.30-storage.network
[Match]
Name=bond0.30

[Network]
Address=10.10.30.50/24

[Link]
# Jumbo Frames for high-throughput Ceph/NFS storage networks
MTUBytes=9000

Activate the configuration:

sudo networkctl reload
networkctl status bond0

5. Live Runtime Inspection with iproute2

Inspect the live aggregation state and switch negotiation details in /proc/net/bonding/bond0:

cat /proc/net/bonding/bond0

Key fields to verify: * Bonding Mode: IEEE 802.3ad Dynamic link aggregation * Transmit Hash Policy: layer3+4 (1) * MII Status: up * Partner Mac Address: Must display your switch's MAC address (if it shows 00:00:00:00:00:00, LACP is misconfigured on the switch port-channel!). * Aggregator ID: Must be identical for both member interfaces.

# Verify compact status of VLAN sub-interfaces
ip -br link show type vlan

6. Next Steps

With redundant physical uplinks and VLAN segmentation secured, delve into Linux network virtualization:

  • Network Namespaces (ip netns), veth & Bridges

    Explore virtual patch cables, kernel network namespaces, and Layer-2 Linux bridges that form the foundation of containers and VMs.

    Namespaces & Bridges Guide