topic Re: Change interfaces of a bonding group in Firewall and Security Management

Change interfaces of a bonding group

Josh28 — Mon, 13 Apr 2026 07:31:45 GMT

Hello mates,

I need to change the physical interfaces of a bonding group on a clusterXL (running R81.20 JHF 126). It seems straightforward to me but just in case, I’d like your opinion on the matter. I was thinking of doing it like this to avoid disruption:

On the STANDBY member, modify the interfaces of the bonding group (delete bonding group x interface ethx and add bonding group x interface eth1-0x)
On the stanby router shutdown of the former physical interfaces and port-channel and no shut of the new physical interfaces and port-channel
Force a failover on the newly modify member and repeat the operation on the former active member of the cluster.

The configuration of the vlan interfaces associated to this bond shouldn’t be impacted ?

As I’m not doing any changes on the vlan interfaces, I don’t think I’ll need to something on the topology of the cluster in the smartConsole either?

Thanks for your feedback.

Re: Change interfaces of a bonding group

simonemantovani — Mon, 13 Apr 2026 08:19:00 GMT

From my experience:

keep the bonding group (unless there is a specific reason to remove it).
add the new interface in the bonding group of the standby unit.
remove the old interface in the bonding group of the standby unit, and check cluster status and vlan tag using the follwing command just to be suretaht everything is ok. tcpdump -i <bonding group> -nn -e vlan
swtich the cluster and check the everything is working.
Then repeat the configuration on the remaining member and switch the traffic to this member.

This is what I would do

Re: Change interfaces of a bonding group

ZaferGr — Mon, 13 Apr 2026 08:58:14 GMT

After this process, I recommend checking whether everything is normal on the bond interface of the backup gateway. You can perform this check with a simple command.
#more /proc/net/bonding/bond* | grep MII

Re: Change interfaces of a bonding group

emmap — Mon, 13 Apr 2026 10:40:05 GMT

That'll work. Make sure you check the cluster state (cphaprob stat) and cluster interfaces (cphaprob -a if) before attempting the failover, make sure the standby is still standby and it's reporting the interfaces are up. As you aren't removing the bonding group you won't have to worry about vlan interfaces or topology, they won't be affected.

Re: Change interfaces of a bonding group

Bob_Zimmerman — Mon, 13 Apr 2026 15:13:10 GMT

To elaborate a little on the order of steps 2 and 3, a bond must have at least one member. If you add the new member then remove the old member, that will always work, even for bonds which have only one member.

After adding the new interface and removing the old one, the member may go Down for a bit, but it should get back to Standby within a minute once cluster control traffic can go back and forth over the bond again. Then you can try packet captures or whatever else you want.

Re: Change interfaces of a bonding group

Vincent_Bacher — Tue, 14 Apr 2026 05:48:54 GMT

@PhoneBoy Just wanted to press the button "Accept as Solution" here because this is exactly how it's been done but i get an error message about not activated JavaScript what is misleading i guess.

Re: Change interfaces of a bonding group

PhoneBoy — Tue, 14 Apr 2026 23:44:14 GMT

Not sure why it didn't work for you, but it did for me.
If anyone else has issues doing this, let me know and I'll investigate.