Solved, the solution:
Dynamic LACP needs at least two physical links to form a LAGG via SwOS. An exception might be a static configured LAGG where a trunk is entered manually (Not tested). Important: The LAGG only formed as soon as you see a trunk member number. If this is not the case, your LAGG did not form.

Hello together,

I'm using a pfSense firewall which I want to connect to my CRS326 Switch (running SwOS) via LACP. Sadly, I cannot get this to work. The uplink to the pfSense should remain untagged without any VLANs being tagged. For testing purposed, I'm trying to get this up and running with one port only (Port 16, see screenshots below).

On the pfSense side, everything was configured to get LACP working. As soon as I attach my pfSense to a Switchport, I can see that a neighbor is seen and the link gets up (Partner MAC of the correct pfSense interface is shown). User traffic sadly doesn't go through this link. I posted my pfSense config here: https://forum.netgate.com/topic/152313/ ... tik-switch

Could someone verify my SwOS config and tell me if something is missing?


Nothing configured at the Link tab


Set the mode to "active", since pfSense speaks passive. I'm missing that a number in "trunk" shows up (which should happen, according to Youtube videos explaning SwOS).


Played with the VLAN settings on both sides. Untagged is wanted, that's how it is configured now. Tagged didn't work either when configuring on both sides

Thanks a lot and stay healthy!

User traffic sadly doesn't go through this link.

I do not understand....
It does not go through both Links of the 802.3ad or none of the links are used?
In case it does not go through both links, that is normal, since 802.3ad will not break connections and share them between links...

I'm only testing with one link so far, and this link doesn't work at all. I'm guessing the issue happens because trunk number is shown in the LAG settings for that port.

Is it possible to troubleshoot if the LACP link goes up correctly at the SwOS side?

The default VLAN Mode is "optional" and VLAN Receive "any"...
Why did you change those ?

Only for testing, because I wanted to force an untagged uplink. VLAN mode "optional" and VLAN Receive "any" didn't work either.
I just set them back to their defaults, still not working.

So you are using VLANs in your whole setup ?

Did you change the Modes of the LACP ?

Mode (default: passive) Specify LACP packet exchange mode or Static LAG mode on ports:
Passive: Place port in listening state, use LACP only when it's contrary port uses active LACP mode
Active: Prefer to start LACP regardless contrary port mode
Static: Set port in a Static LAG mode

https://wiki.mikrotik.com/wiki/SwOS/CSS326#LAG

Not using any VLANs, no. I wanted to be sure the uplink will remain untagged. The VLAN mode was changed back to the defaults.
Since the pfSense is speaking passive LACP only, I configured active LACP on the uplink to the pfSense (2nd screenshot in first post). The MAC of the pfSense is shown there.

I'm unsure if my settings work, since I didn't find a way to debug the LACP state on both sides.

I would try adding a second link inside the LAG, since obviously LACP needs more that one interfaces to work...

Thanks, that was the issue. At least two interfaces are needed to form a LAGG. I know the LACP implementation from other network vendors, where forming an LACP with one link only is no issue.
Really bad about the Mikrotik implementation is, that the LACP gets down again when one of two links is failing. Just tested the behavior.

One link might be working with a LAGG when it's statically configured. This is not working with a pfSense.

I have FreeNAS with a CRS309 and 2x ports in LACP. Both ports on the CRS309 are set on Active. If one link goes down, LACP stops working and the network disconnects

Does the device that FreeNAS is installed on support the 802.3ad protocol ?