Configure a bonded network interface on RHEL

On RHEL 8 and RHEL 9, NetworkManager makes nmcli the practical route to a bonded interface. A bond combines physical NICs into one logical link, commonly bond0, so the host presents a single IP address to applications, switches, and routing tables.

For Australian administrators, resilience matters because infrastructure is spread across Sydney, Melbourne, Brisbane, Adelaide, and Perth, where distant facilities can expose links to carrier or environmental faults. A bond can protect against one port or cable failing, but it cannot rescue a shared upstream switch, fibre path, or data-centre outage.

Plan for realistic failure handling

Choose a bond mode before touching the interfaces. The active-backup mode sends traffic over one member and leaves the others ready for failover; it needs no special switch protocol, although both links must share the same VLAN. The 802.3ad mode uses LACP to aggregate links and requires matching configuration on the switch.

Australian colocation and carrier environments in Sydney and Melbourne commonly offer redundant paths, but both server ports may still converge on the same rack, power feed, or switch. Confirm where physical diversity ends, and remember that a bond inside Australia does not by itself satisfy contractual data-residency rules. Related RHEL material is available at linuxtpoint.com.

Prepare interfaces before bonding

Identify the candidate NICs and their current NetworkManager profiles with nmcli device status, ip -br link, and nmcli connection show. Use interface names such as eno1 and eno2 only after confirming that they map to the intended physical ports; connector names can differ on server hardware.

Check carrier, speed, and MTU with nmcli -f GENERAL,WIRED-PROPERTIES device show eno1 or ethtool eno1. Keep the existing connections available until the bond profiles are ready, because moving a live server to a new logical interface can interrupt remote access.

Create bond and member connections

Create the logical interface with nmcli connection add type bond con-name bond0 ifname bond0 bond.options "mode=active-backup,miimon=100,updelay=200,downdelay=200". The monitoring interval detects link failure, while the delay values reduce disruption from ports that flap briefly.

Add each physical NIC as a member profile using nmcli connection add type ethernet con-name bond0-eno1 ifname eno1 master bond0 and the equivalent command for eno2. Then enable automatic startup with nmcli connection modify bond0-eno1 connection.autoconnect yes and the matching eno2 command.

If a suitable wired profile already exists, reuse it by setting connection.master bond0 and connection.slave-type bond, rather than creating a duplicate profile. Any addresses or routes on those member profiles must be moved to bond0, and the member profiles should remain set to autoconnect so they return after a reboot.

Configure addressing and routing

Apply the host address to the bond, not the physical ports. For example, nmcli connection modify bond0 ipv4.method manual ipv4.addresses 192.0.2.10/24 ipv4.gateway 192.0.2.1 ipv4.dns "1.1.1.1 9.9.9.9" uses documentation addresses; replace them with the organisation’s real subnet, gateway, and internal resolvers. Configure IPv6 separately if the service requires dual stack.

Activate the connection with nmcli connection up bond0, then confirm the address and route with ip -br address show bond0, ip route, and nmcli device status. Applications should reference bond0 or the host address, never a member NIC, so traffic remains on the logical interface.

Align firewalld and switch settings

RHEL commonly combines firewalld with NetworkManager. Check the active zones with firewall-cmd --get-active-zones, then add the bond to the intended zone, for example firewall-cmd --zone=public --add-interface=bond0 --permanent, followed by firewall-cmd --reload. Avoid the trusted zone unless its broad access policy is explicitly required.

Upstream settings must match the design. For active-backup, place both ports in the same VLAN and give them matching MTU and speed where practical. For LACP, create the switch-side aggregator, enable 802.3ad, and assign the correct VLAN. In Australian enterprise environments, this coordination is often shared between the server team and the carrier or colocation provider.

Test failover and reboot persistence

Inspect cat /proc/net/bonding/bond0 to confirm the mode, active member, and monitoring state. During an approved test, disconnect the active member and watch the active slave change, then restore it and ensure the original member returns as available. With the demonstrated monitoring interval and delays, recovery is fast but is not instantaneous.

Reboot during a maintenance window to prove that NetworkManager restores bond0, both members, addresses, routes, and firewall rules. A separate network monitoring reference can complement the runbook, but /proc/net/bonding/bond0 remains the authoritative host-side view. Australian Essential Eight-aligned processes also need logging, backups, and access controls, since a bond addresses only connectivity.

Compare bonding modes for deployment

Bonding modes differ mainly in traffic distribution and switch requirements. The comparison below aligns the RHEL host with the availability and throughput needs of the service.

Bond mode	Traffic behaviour	Switch requirement	Typical fit
active-backup	One active member, others standing by	Same VLAN; no LACP needed	Straightforward failover
802.3ad	Multiple flows distributed using LACP	802.3ad/LACP required	Higher aggregate throughput
balance-xor	Traffic follows a hash, often using one member	No LACP required	Moderate distribution with simple setup
balance-rr	Packets distributed in round-robin order	Verify switch behaviour	Specialist legacy installations

For most RHEL servers needing uncomplicated NIC failover, active-backup is the conservative choice when switch-side LACP is unavailable. Choose 802.3ad when tested aggregation is valuable and the network team can operate LACP. The dependable result is one persistent bond0 address whose surviving member carries traffic after a controlled port failure.