{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/verify-both-ends-of-pfsense-lacp-instead-of-treating-bundled-ports-as-automatic-capacity/", "item": { "id": "https://update.dsesecurity.com/updates/verify-both-ends-of-pfsense-lacp-instead-of-treating-bundled-ports-as-automatic-capacity/", "slug": "verify-both-ends-of-pfsense-lacp-instead-of-treating-bundled-ports-as-automatic-capacity", "url": "https://update.dsesecurity.com/updates/verify-both-ends-of-pfsense-lacp-instead-of-treating-bundled-ports-as-automatic-capacity/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/verify-both-ends-of-pfsense-lacp-instead-of-treating-bundled-ports-as-automatic-capacity.md", "json": "https://update.dsesecurity.com/api/v1/posts/verify-both-ends-of-pfsense-lacp-instead-of-treating-bundled-ports-as-automatic-capacity/" }, "title": "Verify both ends of pfSense LACP instead of treating bundled ports as automatic capacity", "summary": "Member speed, MTU, duplex, switch negotiation, and transmit hashing all affect the design.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:16:18+00:00", "modified_at": "2026-10-20T18:34:35+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 248, "potentially_affected": "This concerns pfSense LACP link aggregation.", "dse_recommendation": "DSE recommends documenting the peer's supported aggregation design before attaching multiple cables.", "primary_source": { "name": "Netgate — LAGG (Link Aggregation)", "url": "https://docs.netgate.com/pfsense/en/latest/interfaces/lagg.html", "published_on": null, "authority": "docs.netgate.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Member speed, MTU, duplex, switch negotiation, and transmit hashing all affect the design.

\n

Source facts

\n

Netgate states that LACP requires configuration on both pfSense and its switch peer. Member ports must have identical speed and MTU and operate full-duplex. A failed member reduces available capacity while the group continues. The firewall’s hash selection controls its transmitted traffic and does not determine how the peer distributes traffic in the reverse direction.

\n

Source: Netgate — LAGG (Link Aggregation).

\n

Applicability

\n

This concerns pfSense LACP link aggregation.

\n

DSE recommendation

\n

DSE recommends documenting the peer’s supported aggregation design before attaching multiple cables. Compare every member’s physical and logical settings and agree on the traffic characteristics used for distribution. Size remaining capacity for a member-loss event. Review receive-path distribution on the switch separately from transmit-path settings on the firewall. Maintain a recovery port outside the aggregate while changing its membership or negotiation. Ask both firewall and switch owners to predict the transmit member for a defined set of flows. Measure the two directions separately and include an approved member-loss case. Label single-flow results honestly instead of presenting an aggregate multi-flow total as one application’s expected bandwidth.

\n

Verification

\n

Confirm negotiated membership on both endpoints and inspect per-member counters under authorized varied traffic. Remove one member during an approved test and observe continuity and remaining capacity. Reconnect it and verify that the peer and firewall agree on its return to the group without a loop or unintended standalone port.

\n

Official reference

\n

Netgate — LAGG (Link Aggregation). Reviewed October 20, 2026.

", "content_text": "Member speed, MTU, duplex, switch negotiation, and transmit hashing all affect the design.\nSource facts\nNetgate states that LACP requires configuration on both pfSense and its switch peer. Member ports must have identical speed and MTU and operate full-duplex. A failed member reduces available capacity while the group continues. The firewall’s hash selection controls its transmitted traffic and does not determine how the peer distributes traffic in the reverse direction.\nSource: Netgate — LAGG (Link Aggregation).\nApplicability\nThis concerns pfSense LACP link aggregation.\nDSE recommendation\nDSE recommends documenting the peer’s supported aggregation design before attaching multiple cables. Compare every member’s physical and logical settings and agree on the traffic characteristics used for distribution. Size remaining capacity for a member-loss event. Review receive-path distribution on the switch separately from transmit-path settings on the firewall. Maintain a recovery port outside the aggregate while changing its membership or negotiation. Ask both firewall and switch owners to predict the transmit member for a defined set of flows. Measure the two directions separately and include an approved member-loss case. Label single-flow results honestly instead of presenting an aggregate multi-flow total as one application’s expected bandwidth.\nVerification\nConfirm negotiated membership on both endpoints and inspect per-member counters under authorized varied traffic. Remove one member during an approved test and observe continuity and remaining capacity. Reconnect it and verify that the peer and firewall agree on its return to the group without a loop or unintended standalone port.\nOfficial reference\nNetgate — LAGG (Link Aggregation). Reviewed October 20, 2026.", "content_markdown": "Member speed, MTU, duplex, switch negotiation, and transmit hashing all affect the design.\n\n## Source facts\n\nNetgate states that LACP requires configuration on both pfSense and its switch peer. Member ports must have identical speed and MTU and operate full-duplex. A failed member reduces available capacity while the group continues. The firewall’s hash selection controls its transmitted traffic and does not determine how the peer distributes traffic in the reverse direction.\n\nSource: [Netgate — LAGG (Link Aggregation)](https://docs.netgate.com/pfsense/en/latest/interfaces/lagg.html).\n\n## Applicability\n\nThis concerns pfSense LACP link aggregation.\n\n## DSE recommendation\n\nDSE recommends documenting the peer’s supported aggregation design before attaching multiple cables. Compare every member’s physical and logical settings and agree on the traffic characteristics used for distribution. Size remaining capacity for a member-loss event. Review receive-path distribution on the switch separately from transmit-path settings on the firewall. Maintain a recovery port outside the aggregate while changing its membership or negotiation. Ask both firewall and switch owners to predict the transmit member for a defined set of flows. Measure the two directions separately and include an approved member-loss case. Label single-flow results honestly instead of presenting an aggregate multi-flow total as one application’s expected bandwidth.\n\n## Verification\n\nConfirm negotiated membership on both endpoints and inspect per-member counters under authorized varied traffic. Remove one member during an approved test and observe continuity and remaining capacity. Reconnect it and verify that the peer and firewall agree on its return to the group without a loop or unintended standalone port.\n\n## Official reference\n\n[Netgate — LAGG (Link Aggregation)](https://docs.netgate.com/pfsense/en/latest/interfaces/lagg.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/verify-both-ends-of-pfsense-lacp-instead-of-treating-bundled-ports-as-automatic-capacity/", "url": "https://update.dsesecurity.com/updates/verify-both-ends-of-pfsense-lacp-instead-of-treating-bundled-ports-as-automatic-capacity/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/verify-both-ends-of-pfsense-lacp-instead-of-treating-bundled-ports-as-automatic-capacity/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Verify both ends of pfSense LACP instead of treating bundled ports as automatic capacity", "item": "https://update.dsesecurity.com/updates/verify-both-ends-of-pfsense-lacp-instead-of-treating-bundled-ports-as-automatic-capacity/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/verify-both-ends-of-pfsense-lacp-instead-of-treating-bundled-ports-as-automatic-capacity/#article", "identifier": "https://update.dsesecurity.com/updates/verify-both-ends-of-pfsense-lacp-instead-of-treating-bundled-ports-as-automatic-capacity/", "url": "https://update.dsesecurity.com/updates/verify-both-ends-of-pfsense-lacp-instead-of-treating-bundled-ports-as-automatic-capacity/", "headline": "Verify both ends of pfSense LACP instead of treating bundled ports as automatic capacity", "description": "Member speed, MTU, duplex, switch negotiation, and transmit hashing all affect the design.", "abstract": "Member speed, MTU, duplex, switch negotiation, and transmit hashing all affect the design.", "articleBody": "Member speed, MTU, duplex, switch negotiation, and transmit hashing all affect the design.\nSource facts\nNetgate states that LACP requires configuration on both pfSense and its switch peer. Member ports must have identical speed and MTU and operate full-duplex. A failed member reduces available capacity while the group continues. The firewall’s hash selection controls its transmitted traffic and does not determine how the peer distributes traffic in the reverse direction.\nSource: Netgate — LAGG (Link Aggregation).\nApplicability\nThis concerns pfSense LACP link aggregation.\nDSE recommendation\nDSE recommends documenting the peer’s supported aggregation design before attaching multiple cables. Compare every member’s physical and logical settings and agree on the traffic characteristics used for distribution. Size remaining capacity for a member-loss event. Review receive-path distribution on the switch separately from transmit-path settings on the firewall. Maintain a recovery port outside the aggregate while changing its membership or negotiation. Ask both firewall and switch owners to predict the transmit member for a defined set of flows. Measure the two directions separately and include an approved member-loss case. Label single-flow results honestly instead of presenting an aggregate multi-flow total as one application’s expected bandwidth.\nVerification\nConfirm negotiated membership on both endpoints and inspect per-member counters under authorized varied traffic. Remove one member during an approved test and observe continuity and remaining capacity. Reconnect it and verify that the peer and firewall agree on its return to the group without a loop or unintended standalone port.\nOfficial reference\nNetgate — LAGG (Link Aggregation). Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:16:18+00:00", "dateModified": "2026-10-20T18:34:35+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/verify-both-ends-of-pfsense-lacp-instead-of-treating-bundled-ports-as-automatic-capacity/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/verify-both-ends-of-pfsense-lacp-instead-of-treating-bundled-ports-as-automatic-capacity/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Verify both ends of pfSense LACP instead of treating bundled ports as automatic capacity" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 248, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Netgate — LAGG (Link Aggregation)", "url": "https://docs.netgate.com/pfsense/en/latest/interfaces/lagg.html" } } ] } }