Set up and test a Sophos Firewall LAG with LACP

A Link Aggregation Group (LAG) bundles two to four physical ports into one logical interface. Active-Backup provides redundancy with one active link. 802.3ad (LACP) uses multiple links in parallel and increases aggregate bandwidth across multiple connections.

LACP does not normally make a single TCP or UDP connection faster: the hash keeps a flow on one member link. Additional capacity is only available when multiple connections are hashed differently.

Prepare the mode and migration

Active-Backup or 802.3ad

Active-Backup is the straightforward redundancy mode. Only one member transmits traffic; another takes over if it fails. The switch does not need an LACP port channel for this. However, both switch ports must use the same VLANs or access configuration, be in the same Layer 2 network, and accept the MAC move during failover.

802.3ad (LACP) uses all active links for load distribution and failover. The following requirements apply:

• LACP is enabled on the firewall and the switch.
• All members have the same interface type, speed, and full-duplex setting.
• The switch ports belong to the same logical LACP peer and port channel.
• Two physical switches only work if stacking, MLAG/MC-LAG, or a comparable technology presents them as a shared LACP system.
• The VLAN/trunk configuration and MTU are consistent across all members.

Active-Backup is usually simpler when only redundancy is required. LACP is suitable when multiple parallel connections genuinely need more aggregate bandwidth.

Check members and prepare rollback

Sophos Firewall supports two to four unbound physical interfaces with static IP assignment as LAG members. PPPoE, Cellular WAN, and WLAN interfaces are excluded.

Existing uplink ports are not migrated automatically when the LAG is created. VLANs, Zone Binding, DNS, gateways, SD-WAN, Interface Hosts, Dynamic DNS, NAT, and routing may depend on the old interface. Before the migration:

1. Under Object usage, use Refresh to update and document the dependencies.
2. Prepare a backup, maintenance window, and a specific rollback plan.
3. Test an independent admin connection.
4. Plan VLANs, switch trunks, NAT interfaces, routing, and gateways for the new LAG.
5. Only then remove future members from their existing bindings in a controlled manner.

Plan Sophos Firewall zones and interfaces explains which zone the LAG should use. This article follows one consistent example:

PortF2 + PortF4 → LAG0 → VLAN 10 Clients and VLAN 20 Servers

Create the LAG in WebAdmin

1. Open Network > Interfaces.
2. Select Add interface > Add LAG.
3. Under Name, enter a descriptive display name with no more than 58 characters, for example LAG_Core_Uplink.
4. Set a Hardware name with no more than 10 characters using A-Z, a-z, 0-9, and underscores, for example lag_core. It cannot be changed later and must not contain reserved names such as all, gre, eth, or WLAN.
5. Under Member interface, add two to four prepared ports, PortF2 and PortF4 in this example.
6. Select Active-Backup or 802.3ad as the Bonding mode.
7. For 802.3ad, select the Xmit Hash Policy.
8. Assign the appropriate Zone.
9. Configure IP assignment for IPv4 and, if required, IPv6.
10. Under the advanced settings, check Link mode, Auto-negotiation for media type, model-dependent FEC, MTU, and, if required, Override MSS. Show recommended settings or Load recommended configuration helps apply the values supported by the port.
11. Use the default MAC address of the first member, or override it only when there is a clear design requirement.
12. Select Save.

The logical interface, for example lag0, then appears under Network > Interfaces. VLANs are subsequently created with the LAG as their parent. Set up and test a Sophos Firewall VLAN explains the procedure for VLAN ID, Zone, gateway, DHCP, and acceptance testing.

⚠️ The current Sophos Known Issues List still lists NC-94073 without a fixed version: On XGS hardware with 10G interfaces, the link may go down with Auto-negotiation, both on physical interfaces and in a LAG. In this case, manually set the affected port or LAG to 10000 Mbps – Full-Duplex and check the link again. This workaround is officially documented but was not tested here in an XGS 10G lab.

Choose the right Xmit Hash Policy

For 802.3ad, the Xmit Hash Policy determines which member Sophos Firewall uses to send outgoing traffic. The switch distributes traffic arriving at the firewall using its own hash policy. The algorithms therefore do not have to be identical; each side makes an independent decision for its transmit direction.

• Layer2: uses the source and destination MAC addresses. With only a few MAC address pairs, one member may carry significantly more traffic.
• Layer2+3: also considers the source and destination IP addresses and is often a sensible starting point for mixed network traffic.
• Layer3+4: additionally uses transport-layer information. This can distribute multiple connections between the same hosts more effectively. However, fragmented traffic may not include port information; fragments may be hashed differently and cause packet reordering.

No policy distributes a single flow across all links. The appropriate choice must therefore be tested with real traffic and member counters in both directions, not by matching the hash name on the switch.

Configure the switch side

With Active-Backup, the ports are not combined into a static or LACP port channel. Both ports use the same VLAN/trunk configuration and connect to the same Layer 2 network. Also check whether Spanning Tree, Port Security, or MAC move settings delay or block the change unnecessarily.

With 802.3ad, the switch ports must:

• be in the same LACP port channel,
• actively use LACP,
• match the firewall for speed, duplex, VLANs, and MTU,
• belong to one shared logical LACP system when two switches are used.

Creating a LAG only on the firewall is not sufficient. If the switch continues to treat the ports independently or uses static bonding instead of LACP, packet loss, asymmetric behavior, or a partially active LAG may result.

Validate the LAG and failover

Before the first failure test, document the initial state, member status, LACP status, and interface counters on the firewall and switch. Then perform the following tests:

1. Normal operation: Test the gateway, internal destinations, and required services in both directions.
2. Disconnect each member individually: Measure reachability, packet loss, existing sessions, and switchover time. Failover is not automatically completely interruption-free.
3. Reconnect the member: Check on the firewall and switch that it becomes active again and that the error counters remain stable.
4. Test LACP with multiple flows: Generate multiple connections with different source/destination combinations in both directions and compare the member counters.
5. Check the VLANs: In this example, test VLAN 10 and VLAN 20 separately for the gateway, permitted destinations, blocked destinations, DHCP, and DNS.

For Layer3+4, a test client outside the firewall can use iPerf3 with four parallel flows instead of a single connection, for example, because their ports differ:

iperf3 -c 10.20.20.50 -P 4 -t 30
iperf3 -c 10.20.20.50 -P 4 -t 30 -R

Replace 10.20.20.50 with the address of the iPerf3 test server. With Layer2 or Layer2+3, multiple source/destination host pairs or different MAC or IP addresses are required. The test intentionally generates load and should run during an appropriate maintenance window. -R tests the reverse direction. Test Sophos Firewall performance with iPerf3 explains the complete endpoint setup.

Common errors

• Member does not appear: The port is still bound, does not use static assignment, or belongs to an excluded interface type.
• LACP does not become active: Compare the switch port channel, LACP mode, member assignment, speed/duplex, VLANs, and MTU.
• Two switches but no shared LACP peer: Stacking or MLAG/MC-LAG is missing. Limit LACP to one logical peer or plan Active-Backup accordingly.
• XGS 10G link remains down with Auto-negotiation: According to NC-94073, manually set 10000 Mbps – Full-Duplex.
• Almost all load is on one member: This can be correct when there are few flows. Test multiple suitable connections and compare the counters for both transmit directions; the switch hash policy does not need the same name.
• VLAN or internet connectivity fails after migration: Check the VLAN parent, Zone, network objects, NAT inbound/outbound interfaces, routing, and gateways. Normal firewall rules match zones and networks, not a physical member port.
• Failover loses packets or sessions: Measure the switchover time and check the switch settings for MAC move, Spanning Tree, and Port Security.
• Hardware name is incorrect: The technical name cannot be changed later; the LAG must be recreated if the name needs to be changed.

Operational checklist

• Active-Backup or 802.3ad selected according to the redundancy and bandwidth objective
• two to four unbound static physical members prepared
• Object Usage, backup, recovery path, and independent admin connection checked
• switch ports configured for Active-Backup or LACP as appropriate
• Link mode, Auto-negotiation, FEC, MTU, and MSS checked
• Xmit Hash Policy understood as applying only to the firewall’s transmit direction
• failure and recovery of every member tested
• LACP tested with multiple flows in both directions and member counters
• VLAN parents, Zone, NAT, routing, and gateways validated after migration

FAQ