LAN Port Aggregation

Comments

24 comments

  • Avatar
    Firewalla

    Is your internet connection more than 1Gbit?  is this the reason you have two LAN ports?

    0
    Comment actions Permalink
  • Avatar
    Michael Marrah

    It is not. The two ports are just standard on this modem.

    0
    Comment actions Permalink
  • Avatar
    Firewalla

    If you do not have more than 1 gigabit, you should just leave it one interface.  

    I don't think you can plug the blue in, that port is likely bridged with your ISP.

    -1
    Comment actions Permalink
  • Avatar
    Chris Thomas

    Are there any plans to add link aggregation capabilities to the Firewalla Gold?

     

    I have 6 internal VLANs, at the moment I have two on each 1Gb interface.  Previously, I had a 3Gb LACP lag setup.

    1
    Comment actions Permalink
  • Avatar
    Firewalla

    Is your WAN faster than gigabit? if it is not, then no point do link aggregation;  If you use it for LAN, then best just leave that on the switch.  

    -1
    Comment actions Permalink
  • Avatar
    Chris Thomas

    @Firewalla,

      Whether I personally have multi-gigabit Internet is a moot point as the entire premise behind the Firewalla Gold series is to support segmented networks in both Home and Small Business environments.

    • This would provide link redundancy for the multiple VLANs that are currently spread out across multiple individual ports.
    • This would provide the ability to connect the Firewalla Gold to multiple switches via an MLAG, or in stacking mode.
    • This would ensure that failure of any one port, or cable, would not take down a third of the internal networks,
    • This would allow up to 1Gbps file transfers between two internal VLANs without impacting throughput on one of the other VLANs headed to the Internet.

    Your suggestion is to 'leave it on the switch', which I'm sure you know isn't an option since these are separate layer 3 networks, and the Firewalla Gold is acting as the router.  Clearly, any layer 2 traffic for hosts in the same network would remain on the switch.

     

    ...ct

      

    2
    Comment actions Permalink
  • Avatar
    Firewalla

    Chris

    Thanks, will take your feedback.  I think there will be some type of link bundling,  a few of us just concerned about the amount of east/west traffic between these bundles.  

    If anyone else reading this and want to prioritize this feature, please scream here. 

    0
    Comment actions Permalink
  • Avatar
    Chris Thomas

    IEEE 802.3ad Link Aggregation Control Protocol (LACP) is the only type of bundling I've used on pfSense, OPNSense, Cisco ASA's, Juniper SRX's, and Palo Alto's in last 10 years.

    It is also the only widely supported link aggregation protocol.

    0
    Comment actions Permalink
  • Avatar
    Rolando Nispiros

    This sounds interesting.  My Xfinity router has the option to enable port aggregation (Port 1 & 2).  How would this work exactly with Firewalla Gold in Router mode?

    Would I enable port aggregation in Xfinity, then in Firewalla Gold create another network and configure it as a backup in case the wire failed on the main WAN line?

    0
    Comment actions Permalink
  • Avatar
    Chris Thomas

    Think of it like adding a lane to the hwy. Instead of having one lane in each direction, you would have two.

    No real advantage for internet access, but if you have multiple networks behind your firewall, this gives you more lanes to move traffic between networks.

    2
    Comment actions Permalink
  • Avatar
    Firewalla

    In general link aggregation/bonding in the consumer / small business, is very likely to increase link bandwidth.   (you can also do it with MultipleWAN, but that requires more modems).

    This means link aggregation will only make sense if you have a WAN greater than 1Gigabit.   If you don't, there is no point to bundle; 

     

    1
    Comment actions Permalink
  • Avatar
    Rolando Nispiros

    Yes my WAN is 1GB. How would I try this configuration on the Firewalla side?

    0
    Comment actions Permalink
  • Avatar
    Firewalla

    We don't have link bundle feature (as the time of this message as of 1.972).  We won't have it until some of you start to have 2G WAN. 

    There is absolutely no need to use link bundling if you have 1G.  

    0
    Comment actions Permalink
  • Avatar
    Rolando Nispiros

    No problem thank you!

    0
    Comment actions Permalink
  • Avatar
    Erik Neville

    how about if you want to setup 2GB link for internal traffic? what should the switch config look like if you have 2 firewalla gold ports part of the same network?

    0
    Comment actions Permalink
  • Avatar
    Firewalla

    @Erik, the LAN links wouldn't make much a difference if the bottleneck is the WAN side.  Remember, this is a router and the rate depends on how fast your WAN is. 

    0
    Comment actions Permalink
  • Avatar
    Erik Neville

    @Firewalla, yes I agree on the but what about the inter-network/vlan routing the default gw is on the firewalla it's limited to the links connected to the firewalla gold. an example is if I can virtualize firewalla can leverage my 10GB nic on my ESXi servers.

    Even if this is not on the roadmap, virtualization of firewalla that is, if we can get the firewalla to learn via IP then I can move the router function to virtual pfsense lets say, and have the firewalla as my edge device. The reason I don't do this now is because I lose out on all the DPI function of firewalla as of now you learn via mac

    0
    Comment actions Permalink
  • Avatar
    Firewalla

    Virtualized Firewalla is possible, but the problem is more on the economics.  It is far easy for us to build hardware with 4 ports, and we know everything that's inside, software behavior is fairly deterministic.   The cost of maintaining/support software on the virtualized env is going to be expensive.

    0
    Comment actions Permalink
  • Avatar
    Peter van W

    Have 10G WAN (1:1), which is a bit of an overkill. However, I would like to understand when I can do Port Aggregation from my Firewalla Gold to switch. Currently I have the Gold running in Router Mode & everything is behind the firewall. This means I am limited to 1gb for the whole net. With the home office the network is pushed to the max by video conferences & streaming going on simultaneously.

    Would be very happy when the feature is added. Interested in using the combination of port aggregation from WAN and LAN perspective as I have a switch & all Gold ports are gigabit. Happy to test once features come in beta.

    0
    Comment actions Permalink
  • Avatar
    Chris Hills

    I was looking at purchasing a Firewalla Gold but the lack of link aggregation is a deal breaker for me. The point that it is only useful if your WAN is 1Gbs is incorrect. If I can aggregate all 4 ports, that gives me an inter-vlan capacity of 4Gbps regardless of which is the WAN.

    0
    Comment actions Permalink
  • Avatar
    Chris Thomas

    Hit that up-vote button!

    0
    Comment actions Permalink
  • Avatar
    Firewalla

    Please vote for this in the feature request section.  

    0
    Comment actions Permalink
  • Avatar
    Phil

    Let me add that this is a feature that is much desired. Service is now available and many have, as do I, greater than 1 Gbps WAN speeds to the internet. Due to the lack of link aggregation nor multigigabit ethernet, I am not able to achieve the speeds I am paying for with the Firewalla Gold. Nor does it look like the Purple will be able to accommodate this need (I'm hopeful that can change before release) As such, I have opted to add a UDM Pro to my setup. I am keeping the FG because it serves a need that the UDMP doesn't do well. But, I have to say that the UDMP does seem to be a more capable machine in terms of port throughput, link aggregation, and port management; not to mention the other features that come along with it, and for less than the FG. It's really surprising. I would really like to use these two devices completely in tandem because they both do different things well, but the limited throughput on the Firewalla has limited my options there.

    Important to note that the WAN aggregation is great, and works well, but I'm now unable to pipe that feed back into an aggregated connection on the LAN side, limiting the ability to use a simplified setup with consolidated traffic at 2Gbps. I've spent many hours and resets trying to get some configuration to work with the FG and it just won't do it.

    "Waiting for internet speeds to justify the capability" (paraphrasing) isn't helping Firewalla in this market space as speeds continue to rise. I would encourage Firewalla to be a little more forward leaning in anticipating needs rather than trying to catch up after the fact. I like your product and I'd like to see you continue to succeed. 

    0
    Comment actions Permalink

Please sign in to leave a comment.